# Criteria

URL: /systems/trust-and-governance/criteria · Id: `page:systems/trust-and-governance/criteria`

> Every framework criterion, with the controls that satisfy it.

Each criterion lists the controls that satisfy it, so every claim traces to [Evidence](/business/nouns/evidence).

| Criterion | Text | Controls |
| --- | --- | --- |
| [SOC2 CC1.1](/systems/trust-and-governance/criteria/soc2/cc1-1) | The entity demonstrates a commitment to integrity and ethical values. | [Conduct](/systems/trust-and-governance/controls/conduct) |
| [SOC2 CC1.2](/systems/trust-and-governance/criteria/soc2/cc1-2) | The board of directors is independent of management and oversees the development and performance of internal control. | [Governance oversight](/systems/trust-and-governance/controls/governance-oversight) |
| [SOC2 CC1.3](/systems/trust-and-governance/criteria/soc2/cc1-3) | Management establishes, with board oversight, structures, reporting lines, authorities and responsibilities in pursuit of objectives. | [Role structure](/systems/trust-and-governance/controls/role-structure) |
| [SOC2 CC1.4](/systems/trust-and-governance/criteria/soc2/cc1-4) | The entity attracts, develops and retains competent individuals in alignment with its objectives. | [Worker competence](/systems/trust-and-governance/controls/worker-competence) |
| [SOC2 CC1.5](/systems/trust-and-governance/criteria/soc2/cc1-5) | The entity holds individuals accountable for their internal control responsibilities in pursuit of objectives. | [Action accountability](/systems/trust-and-governance/controls/action-accountability) |
| [SOC2 CC2.1](/systems/trust-and-governance/criteria/soc2/cc2-1) | The entity obtains or generates and uses relevant, quality information to support internal control. | [Log completeness](/systems/trust-and-governance/controls/log-completeness) |
| [SOC2 CC2.2](/systems/trust-and-governance/criteria/soc2/cc2-2) | The entity communicates internally the objectives and responsibilities for internal control that support its functioning. | [Role structure](/systems/trust-and-governance/controls/role-structure), [System description](/systems/trust-and-governance/controls/system-description) |
| [SOC2 CC2.3](/systems/trust-and-governance/criteria/soc2/cc2-3) | The entity communicates with external parties about matters that affect the functioning of internal control. | [System description](/systems/trust-and-governance/controls/system-description), [Trust status](/systems/trust-and-governance/controls/trust-status) |
| [SOC2 CC3.1](/systems/trust-and-governance/criteria/soc2/cc3-1) | The entity specifies objectives precisely enough to identify and assess the risks that relate to them. | [Risk assessment](/systems/trust-and-governance/controls/risk-assessment) |
| [SOC2 CC3.2](/systems/trust-and-governance/criteria/soc2/cc3-2) | The entity identifies risks to its objectives across the entity and analyzes them to decide how to manage them. | [Risk assessment](/systems/trust-and-governance/controls/risk-assessment) |
| [SOC2 CC3.3](/systems/trust-and-governance/criteria/soc2/cc3-3) | The entity considers the potential for fraud when it assesses risks to its objectives. | [Fraud screening](/systems/trust-and-governance/controls/fraud-screening) |
| [SOC2 CC3.4](/systems/trust-and-governance/criteria/soc2/cc3-4) | The entity identifies and assesses changes that could significantly affect the system of internal control. | [Control wake review](/systems/trust-and-governance/controls/control-wake-review) |
| [SOC2 CC4.1](/systems/trust-and-governance/criteria/soc2/cc4-1) | The entity performs ongoing or separate evaluations to confirm that the components of internal control are present and functioning. | [Continuous control testing](/systems/trust-and-governance/controls/continuous-testing), [Control sameness](/systems/trust-and-governance/controls/control-sameness), [Adversarial control testing](/systems/trust-and-governance/controls/adversarial-testing), [Period sign-off](/systems/trust-and-governance/controls/period-sign-off) |
| [SOC2 CC4.2](/systems/trust-and-governance/criteria/soc2/cc4-2) | The entity evaluates internal control deficiencies and communicates them in time to the parties responsible for corrective action. | [Deviation closure](/systems/trust-and-governance/controls/deviation-closure) |
| [SOC2 CC5.1](/systems/trust-and-governance/criteria/soc2/cc5-1) | The entity selects and develops control activities that mitigate risks to its objectives to acceptable levels. | [Control wake review](/systems/trust-and-governance/controls/control-wake-review), [Control definition](/systems/trust-and-governance/controls/control-definition), [Inherited floors](/systems/trust-and-governance/controls/inherited-floors), [One-way Action windows](/systems/trust-and-governance/controls/one-way-windows), [Segregation of duties](/systems/trust-and-governance/controls/segregation-of-duties) |
| [SOC2 CC5.2](/systems/trust-and-governance/criteria/soc2/cc5-2) | The entity selects and develops general control activities over technology to support its objectives. | [Inherited floors](/systems/trust-and-governance/controls/inherited-floors), [Control sameness](/systems/trust-and-governance/controls/control-sameness) |
| [SOC2 CC5.3](/systems/trust-and-governance/criteria/soc2/cc5-3) | The entity deploys control activities through policies that set expectations and procedures that put them into action. | [Control definition](/systems/trust-and-governance/controls/control-definition), [Policy approval](/systems/trust-and-governance/controls/policy-approval) |
| [SOC2 CC6.1](/systems/trust-and-governance/criteria/soc2/cc6-1) | The entity implements logical access security software, infrastructure and architectures over protected information assets. | [Authenticated Actions](/systems/trust-and-governance/controls/authenticated-actions), [Task-bound access](/systems/trust-and-governance/controls/task-bound-access), [Secret rotation](/systems/trust-and-governance/controls/secret-rotation), [Namespace isolation](/systems/trust-and-governance/controls/namespace-isolation), [Encryption](/systems/trust-and-governance/controls/encryption), [Bank detail changes](/systems/trust-and-governance/controls/bank-detail-changes) |
| [SOC2 CC6.2](/systems/trust-and-governance/criteria/soc2/cc6-2) | The entity registers and authorizes new users before issuing credentials, and removes credentials once access is no longer authorized. | [Permission decay](/systems/trust-and-governance/controls/permission-decay), [Permission widening](/systems/trust-and-governance/controls/permission-widening), [Unseated access](/systems/trust-and-governance/controls/unseated-access) |
| [SOC2 CC6.3](/systems/trust-and-governance/criteria/soc2/cc6-3) | The entity authorizes, modifies or removes access based on roles, least privilege and segregation of duties. | [Task-bound access](/systems/trust-and-governance/controls/task-bound-access), [Permission decay](/systems/trust-and-governance/controls/permission-decay), [Permission widening](/systems/trust-and-governance/controls/permission-widening), [Unseated access](/systems/trust-and-governance/controls/unseated-access) |
| [SOC2 CC6.4](/systems/trust-and-governance/criteria/soc2/cc6-4) | The entity restricts physical access to facilities and protected information assets to authorized personnel. | [Upstream review](/systems/trust-and-governance/controls/upstream-review) |
| [SOC2 CC6.5](/systems/trust-and-governance/criteria/soc2/cc6-5) | The entity removes protections over physical assets only after the data on them can no longer be recovered. | [Upstream review](/systems/trust-and-governance/controls/upstream-review) |
| [SOC2 CC6.6](/systems/trust-and-governance/criteria/soc2/cc6-6) | The entity implements logical access security measures against threats from sources outside its system boundaries. | [Boundary protection](/systems/trust-and-governance/controls/boundary-protection) |
| [SOC2 CC6.7](/systems/trust-and-governance/criteria/soc2/cc6-7) | The entity restricts the transmission, movement and removal of information to authorized parties, and protects it in transit. | [Encryption](/systems/trust-and-governance/controls/encryption) |
| [SOC2 CC6.8](/systems/trust-and-governance/criteria/soc2/cc6-8) | The entity prevents or detects the introduction of unauthorized or malicious software. | [Deploy reconciliation](/systems/trust-and-governance/controls/deploy-reconciliation) |
| [SOC2 CC7.1](/systems/trust-and-governance/criteria/soc2/cc7-1) | The entity uses detection and monitoring to identify configuration changes and newly discovered vulnerabilities. | [Vulnerability management](/systems/trust-and-governance/controls/vulnerability-management), [Deploy reconciliation](/systems/trust-and-governance/controls/deploy-reconciliation) |
| [SOC2 CC7.2](/systems/trust-and-governance/criteria/soc2/cc7-2) | The entity monitors system components for anomalies that indicate malicious acts, natural disasters or errors. | [Log completeness](/systems/trust-and-governance/controls/log-completeness), [Append-only records](/systems/trust-and-governance/controls/append-only-records), [Anomaly monitoring](/systems/trust-and-governance/controls/anomaly-monitoring) |
| [SOC2 CC7.3](/systems/trust-and-governance/criteria/soc2/cc7-3) | The entity evaluates security events to determine whether they are incidents that require a response. | [Anomaly monitoring](/systems/trust-and-governance/controls/anomaly-monitoring), [Incident handling](/systems/trust-and-governance/controls/incident-handling), [Breach notification](/systems/trust-and-governance/controls/breach-notification) |
| [SOC2 CC7.4](/systems/trust-and-governance/criteria/soc2/cc7-4) | The entity responds to security incidents with a defined program to understand, contain, remediate and communicate them. | [Incident handling](/systems/trust-and-governance/controls/incident-handling), [Revert by query](/systems/trust-and-governance/controls/revert-by-query) |
| [SOC2 CC7.5](/systems/trust-and-governance/criteria/soc2/cc7-5) | The entity identifies, develops and performs activities to recover from identified security incidents. | [Incident handling](/systems/trust-and-governance/controls/incident-handling), [Revert by query](/systems/trust-and-governance/controls/revert-by-query), [Point-in-time recovery](/systems/trust-and-governance/controls/point-in-time-recovery) |
| [SOC2 CC8.1](/systems/trust-and-governance/criteria/soc2/cc8-1) | The entity authorizes, designs, develops, configures, documents, tests, approves and implements changes to infrastructure, data, software and procedures. | [Deploy reconciliation](/systems/trust-and-governance/controls/deploy-reconciliation), [Change approval](/systems/trust-and-governance/controls/change-approval), [Agent definition evals](/systems/trust-and-governance/controls/agent-definition-evals), [Environment separation](/systems/trust-and-governance/controls/environment-separation) |
| [SOC2 CC9.1](/systems/trust-and-governance/criteria/soc2/cc9-1) | The entity identifies, selects and develops risk mitigation activities for risks from potential business disruptions. | [Risk assessment](/systems/trust-and-governance/controls/risk-assessment), [Point-in-time recovery](/systems/trust-and-governance/controls/point-in-time-recovery) |
| [SOC2 CC9.2](/systems/trust-and-governance/criteria/soc2/cc9-2) | The entity assesses and manages risks associated with vendors and business partners. | [Upstream review](/systems/trust-and-governance/controls/upstream-review) |
| [SOC2 A1.1](/systems/trust-and-governance/criteria/soc2/a1-1) | The entity maintains, monitors and evaluates processing capacity and use to manage demand and add capacity. | [Capacity headroom](/systems/trust-and-governance/controls/capacity-headroom) |
| [SOC2 A1.2](/systems/trust-and-governance/criteria/soc2/a1-2) | The entity designs, operates, monitors and maintains environmental protections, backups and recovery infrastructure. | [Point-in-time recovery](/systems/trust-and-governance/controls/point-in-time-recovery) |
| [SOC2 A1.3](/systems/trust-and-governance/criteria/soc2/a1-3) | The entity tests the recovery plan procedures that support system recovery. | [Point-in-time recovery](/systems/trust-and-governance/controls/point-in-time-recovery) |
| [SOC2 C1.1](/systems/trust-and-governance/criteria/soc2/c1-1) | The entity identifies and maintains confidential information to meet its confidentiality objectives. | [Namespace isolation](/systems/trust-and-governance/controls/namespace-isolation), [Purpose limitation](/systems/trust-and-governance/controls/purpose-limitation) |
| [SOC2 C1.2](/systems/trust-and-governance/criteria/soc2/c1-2) | The entity disposes of confidential information to meet its confidentiality objectives. | [Retention restriction](/systems/trust-and-governance/controls/retention-restriction) |
| [SOC2 PI1.1](/systems/trust-and-governance/criteria/soc2/pi1-1) | The entity generates and communicates relevant, quality information about processing, including definitions of the data it processes. | [Processing definitions](/systems/trust-and-governance/controls/processing-definitions) |
| [SOC2 PI1.2](/systems/trust-and-governance/criteria/soc2/pi1-2) | The entity implements policies and procedures over system inputs so that they are complete and accurate. | [Input validation](/systems/trust-and-governance/controls/input-validation), [Manual Entry review](/systems/trust-and-governance/controls/manual-entry-review) |
| [SOC2 PI1.3](/systems/trust-and-governance/criteria/soc2/pi1-3) | The entity implements policies and procedures over processing so that it is complete, accurate and timely. | [One-way Action windows](/systems/trust-and-governance/controls/one-way-windows), [Action completion](/systems/trust-and-governance/controls/action-completion) |
| [SOC2 PI1.4](/systems/trust-and-governance/criteria/soc2/pi1-4) | The entity makes outputs available, complete, accurate and timely, and only to authorized recipients. | [Action completion](/systems/trust-and-governance/controls/action-completion), [Outcome confirmation](/systems/trust-and-governance/controls/outcome-confirmation), [Reconciliation completeness](/systems/trust-and-governance/controls/reconciliation-completeness) |
| [SOC2 PI1.5](/systems/trust-and-governance/criteria/soc2/pi1-5) | The entity stores inputs, items in processing and outputs completely, accurately and on time. | [Append-only records](/systems/trust-and-governance/controls/append-only-records) |
| [SOC2 P1.1](/systems/trust-and-governance/criteria/soc2/p1-1) | The entity notifies data subjects about its privacy practices. | [Privacy notice](/systems/trust-and-governance/controls/privacy-notice) |
| [SOC2 P2.1](/systems/trust-and-governance/criteria/soc2/p2-1) | The entity communicates choices about the collection, use, retention, disclosure and disposal of personal information, and obtains consent. | [Lawful basis](/systems/trust-and-governance/controls/lawful-basis) |
| [SOC2 P3.1](/systems/trust-and-governance/criteria/soc2/p3-1) | The entity collects personal information consistent with its privacy objectives. | [Lawful basis](/systems/trust-and-governance/controls/lawful-basis) |
| [SOC2 P3.2](/systems/trust-and-governance/criteria/soc2/p3-2) | The entity obtains explicit consent where it is required, and communicates the consequences of refusing. | [Lawful basis](/systems/trust-and-governance/controls/lawful-basis) |
| [SOC2 P4.1](/systems/trust-and-governance/criteria/soc2/p4-1) | The entity limits the use of personal information to the purposes identified in its objectives. | [Purpose limitation](/systems/trust-and-governance/controls/purpose-limitation) |
| [SOC2 P4.2](/systems/trust-and-governance/criteria/soc2/p4-2) | The entity retains personal information consistent with its objectives. | [Retention restriction](/systems/trust-and-governance/controls/retention-restriction) |
| [SOC2 P4.3](/systems/trust-and-governance/criteria/soc2/p4-3) | The entity securely disposes of personal information consistent with its objectives. | [Retention restriction](/systems/trust-and-governance/controls/retention-restriction) |
| [SOC2 P5.1](/systems/trust-and-governance/criteria/soc2/p5-1) | The entity grants data subjects access to their stored personal information for review and copy. | [Privacy requests](/systems/trust-and-governance/controls/privacy-requests) |
| [SOC2 P5.2](/systems/trust-and-governance/criteria/soc2/p5-2) | The entity corrects or amends personal information at a data subject’s request and tells third parties of the change. | [Privacy requests](/systems/trust-and-governance/controls/privacy-requests) |
| [SOC2 P6.1](/systems/trust-and-governance/criteria/soc2/p6-1) | The entity discloses personal information to third parties only with the data subject’s consent. | [Lawful basis](/systems/trust-and-governance/controls/lawful-basis), [Disclosure record](/systems/trust-and-governance/controls/disclosure-record) |
| [SOC2 P6.2](/systems/trust-and-governance/criteria/soc2/p6-2) | The entity keeps a complete, accurate and timely record of authorized disclosures of personal information. | [Disclosure record](/systems/trust-and-governance/controls/disclosure-record) |
| [SOC2 P6.3](/systems/trust-and-governance/criteria/soc2/p6-3) | The entity keeps a complete, accurate and timely record of detected or reported unauthorized disclosures, including breaches. | [Breach notification](/systems/trust-and-governance/controls/breach-notification) |
| [SOC2 P6.4](/systems/trust-and-governance/criteria/soc2/p6-4) | The entity obtains privacy commitments from vendors and third parties with access to personal information, and assesses their compliance. | [Upstream review](/systems/trust-and-governance/controls/upstream-review) |
| [SOC2 P6.5](/systems/trust-and-governance/criteria/soc2/p6-5) | The entity obtains commitments from vendors and third parties to tell it of any unauthorized disclosure of personal information. | [Upstream review](/systems/trust-and-governance/controls/upstream-review) |
| [SOC2 P6.6](/systems/trust-and-governance/criteria/soc2/p6-6) | The entity notifies affected data subjects, regulators and others of breaches and incidents. | [Breach notification](/systems/trust-and-governance/controls/breach-notification) |
| [SOC2 P6.7](/systems/trust-and-governance/criteria/soc2/p6-7) | The entity gives data subjects, on request, an accounting of the personal information it holds and its disclosures. | [Disclosure record](/systems/trust-and-governance/controls/disclosure-record), [Records of processing](/systems/trust-and-governance/controls/processing-records) |
| [SOC2 P7.1](/systems/trust-and-governance/criteria/soc2/p7-1) | The entity collects and maintains accurate, up-to-date, complete and relevant personal information. | [Privacy requests](/systems/trust-and-governance/controls/privacy-requests) |
| [SOC2 P8.1](/systems/trust-and-governance/criteria/soc2/p8-1) | The entity receives, addresses and resolves privacy inquiries, complaints and disputes, and monitors its own compliance. | [Privacy requests](/systems/trust-and-governance/controls/privacy-requests) |
| [ISO27001 A.5.1](/systems/trust-and-governance/criteria/iso27001/a-5-1) | Information security policies are defined, approved by management, published, communicated and reviewed at set intervals. | [Policy approval](/systems/trust-and-governance/controls/policy-approval) |
| [ISO27001 A.5.2](/systems/trust-and-governance/criteria/iso27001/a-5-2) | Information security roles and responsibilities are defined and allocated. | [Role structure](/systems/trust-and-governance/controls/role-structure) |
| [ISO27001 A.5.3](/systems/trust-and-governance/criteria/iso27001/a-5-3) | Conflicting duties and conflicting areas of responsibility are segregated. | [Change approval](/systems/trust-and-governance/controls/change-approval) |
| [ISO27001 A.5.15](/systems/trust-and-governance/criteria/iso27001/a-5-15) | Rules control physical and logical access to information and assets, based on business and security requirements. | [Task-bound access](/systems/trust-and-governance/controls/task-bound-access) |
| [ISO27001 A.5.16](/systems/trust-and-governance/criteria/iso27001/a-5-16) | The full life of every identity is managed. | [Authenticated Actions](/systems/trust-and-governance/controls/authenticated-actions) |
| [ISO27001 A.5.17](/systems/trust-and-governance/criteria/iso27001/a-5-17) | The allocation and management of authentication information is controlled. | [Secret rotation](/systems/trust-and-governance/controls/secret-rotation) |
| [ISO27001 A.5.18](/systems/trust-and-governance/criteria/iso27001/a-5-18) | Access rights are provisioned, reviewed, modified and removed according to the access control policy. | [Permission decay](/systems/trust-and-governance/controls/permission-decay), [Permission widening](/systems/trust-and-governance/controls/permission-widening) |
| [ISO27001 A.5.19](/systems/trust-and-governance/criteria/iso27001/a-5-19) | Processes manage the information security risks of using supplier products and services. | [Upstream review](/systems/trust-and-governance/controls/upstream-review) |
| [ISO27001 A.5.22](/systems/trust-and-governance/criteria/iso27001/a-5-22) | Supplier security practices and service delivery are monitored, reviewed and managed through change. | [Upstream review](/systems/trust-and-governance/controls/upstream-review) |
| [ISO27001 A.5.23](/systems/trust-and-governance/criteria/iso27001/a-5-23) | Acquiring, using, managing and exiting cloud services follow the information security requirements. | [Upstream review](/systems/trust-and-governance/controls/upstream-review) |
| [ISO27001 A.5.24](/systems/trust-and-governance/criteria/iso27001/a-5-24) | Incident management is prepared in advance, with defined processes, roles and responsibilities. | [Incident handling](/systems/trust-and-governance/controls/incident-handling) |
| [ISO27001 A.5.26](/systems/trust-and-governance/criteria/iso27001/a-5-26) | Information security incidents are answered according to documented procedures. | [Incident handling](/systems/trust-and-governance/controls/incident-handling), [Revert by query](/systems/trust-and-governance/controls/revert-by-query) |
| [ISO27001 A.5.28](/systems/trust-and-governance/criteria/iso27001/a-5-28) | Records of information security events are identified, collected and preserved for later use. | [Log completeness](/systems/trust-and-governance/controls/log-completeness) |
| [ISO27001 A.5.29](/systems/trust-and-governance/criteria/iso27001/a-5-29) | Information security holds at an appropriate level during a disruption. | [Point-in-time recovery](/systems/trust-and-governance/controls/point-in-time-recovery) |
| [ISO27001 A.5.30](/systems/trust-and-governance/criteria/iso27001/a-5-30) | Technology readiness for business continuity is designed, implemented, maintained and tested. | [Point-in-time recovery](/systems/trust-and-governance/controls/point-in-time-recovery) |
| [ISO27001 A.5.33](/systems/trust-and-governance/criteria/iso27001/a-5-33) | Records are protected from loss, destruction, falsification, unauthorized access and unauthorized release. | [Append-only records](/systems/trust-and-governance/controls/append-only-records) |
| [ISO27001 A.5.34](/systems/trust-and-governance/criteria/iso27001/a-5-34) | Privacy and the protection of personal data meet applicable laws, regulations and contractual requirements. | [Purpose limitation](/systems/trust-and-governance/controls/purpose-limitation) |
| [ISO27001 A.5.35](/systems/trust-and-governance/criteria/iso27001/a-5-35) | The approach to information security is reviewed independently at set intervals and after significant changes. | [Adversarial control testing](/systems/trust-and-governance/controls/adversarial-testing) |
| [ISO27001 A.5.36](/systems/trust-and-governance/criteria/iso27001/a-5-36) | Compliance with the information security policy, rules and standards is reviewed on a set schedule. | [Continuous control testing](/systems/trust-and-governance/controls/continuous-testing), [Deviation closure](/systems/trust-and-governance/controls/deviation-closure) |
| [ISO27001 A.6.1](/systems/trust-and-governance/criteria/iso27001/a-6-1) | Candidates are screened before joining and on an ongoing basis, in proportion to risk. | [Worker competence](/systems/trust-and-governance/controls/worker-competence) |
| [ISO27001 A.6.3](/systems/trust-and-governance/criteria/iso27001/a-6-3) | Personnel receive security awareness, education and training relevant to their job. | [Worker competence](/systems/trust-and-governance/controls/worker-competence) |
| [ISO27001 A.6.5](/systems/trust-and-governance/criteria/iso27001/a-6-5) | Security responsibilities that remain after termination or a change of job are defined and enforced. | [Unseated access](/systems/trust-and-governance/controls/unseated-access) |
| [ISO27001 A.8.2](/systems/trust-and-governance/criteria/iso27001/a-8-2) | The allocation and use of privileged access rights is restricted and managed. | [Permission widening](/systems/trust-and-governance/controls/permission-widening) |
| [ISO27001 A.8.3](/systems/trust-and-governance/criteria/iso27001/a-8-3) | Access to information and assets is restricted according to the access control policy. | [Namespace isolation](/systems/trust-and-governance/controls/namespace-isolation) |
| [ISO27001 A.8.5](/systems/trust-and-governance/criteria/iso27001/a-8-5) | Secure authentication technologies and procedures are implemented according to access restrictions. | [Authenticated Actions](/systems/trust-and-governance/controls/authenticated-actions) |
| [ISO27001 A.8.6](/systems/trust-and-governance/criteria/iso27001/a-8-6) | The use of resources is monitored and adjusted in line with current and expected capacity needs. | [Capacity headroom](/systems/trust-and-governance/controls/capacity-headroom) |
| [ISO27001 A.8.8](/systems/trust-and-governance/criteria/iso27001/a-8-8) | Information about technical vulnerabilities is obtained, exposure is evaluated, and measures are taken. | [Vulnerability management](/systems/trust-and-governance/controls/vulnerability-management) |
| [ISO27001 A.8.9](/systems/trust-and-governance/criteria/iso27001/a-8-9) | Configurations, including security configurations, are established, documented, implemented, monitored and reviewed. | [Deploy reconciliation](/systems/trust-and-governance/controls/deploy-reconciliation) |
| [ISO27001 A.8.13](/systems/trust-and-governance/criteria/iso27001/a-8-13) | Backup copies of information, software and systems are maintained and tested on a set schedule. | [Point-in-time recovery](/systems/trust-and-governance/controls/point-in-time-recovery) |
| [ISO27001 A.8.15](/systems/trust-and-governance/criteria/iso27001/a-8-15) | Logs of activities, exceptions, faults and other relevant events are produced, stored, protected and analyzed. | [Log completeness](/systems/trust-and-governance/controls/log-completeness) |
| [ISO27001 A.8.16](/systems/trust-and-governance/criteria/iso27001/a-8-16) | Networks, systems and applications are monitored for anomalous behavior, and potential incidents are acted on. | [Anomaly monitoring](/systems/trust-and-governance/controls/anomaly-monitoring) |
| [ISO27001 A.8.20](/systems/trust-and-governance/criteria/iso27001/a-8-20) | Networks and network devices are secured, managed and controlled to protect the information they carry. | [Boundary protection](/systems/trust-and-governance/controls/boundary-protection) |
| [ISO27001 A.8.24](/systems/trust-and-governance/criteria/iso27001/a-8-24) | Rules for the effective use of cryptography, including key management, are defined and implemented. | [Encryption](/systems/trust-and-governance/controls/encryption) |
| [ISO27001 A.8.25](/systems/trust-and-governance/criteria/iso27001/a-8-25) | Rules for the secure development of software and systems are established and applied. | [Change approval](/systems/trust-and-governance/controls/change-approval) |
| [ISO27001 A.8.29](/systems/trust-and-governance/criteria/iso27001/a-8-29) | Security testing processes are defined and implemented in the development life of every system. | [Agent definition evals](/systems/trust-and-governance/controls/agent-definition-evals) |
| [ISO27001 A.8.31](/systems/trust-and-governance/criteria/iso27001/a-8-31) | Development, testing and production environments are separated and secured. | [Environment separation](/systems/trust-and-governance/controls/environment-separation) |
| [ISO27001 A.8.32](/systems/trust-and-governance/criteria/iso27001/a-8-32) | Changes to information processing facilities and systems follow change management procedures. | [Change approval](/systems/trust-and-governance/controls/change-approval) |
| [HIPAA 164.308(a)(1)](/systems/trust-and-governance/criteria/hipaa/164-308-a-1) | A covered entity implements policies and procedures to prevent, detect, contain and correct security violations, including risk analysis. | [Risk assessment](/systems/trust-and-governance/controls/risk-assessment) |
| [HIPAA 164.308(a)(3)](/systems/trust-and-governance/criteria/hipaa/164-308-a-3) | Workforce members get appropriate access to electronic protected health information, and others are prevented from obtaining it. | [Unseated access](/systems/trust-and-governance/controls/unseated-access) |
| [HIPAA 164.308(a)(4)](/systems/trust-and-governance/criteria/hipaa/164-308-a-4) | Access to electronic protected health information is authorized consistent with the minimum necessary. | [Task-bound access](/systems/trust-and-governance/controls/task-bound-access), [Permission decay](/systems/trust-and-governance/controls/permission-decay) |
| [HIPAA 164.308(a)(5)](/systems/trust-and-governance/criteria/hipaa/164-308-a-5) | The entity runs a security awareness and training program for every member of its workforce. | [Worker competence](/systems/trust-and-governance/controls/worker-competence) |
| [HIPAA 164.308(a)(6)](/systems/trust-and-governance/criteria/hipaa/164-308-a-6) | The entity identifies, responds to, mitigates and documents security incidents. | [Incident handling](/systems/trust-and-governance/controls/incident-handling) |
| [HIPAA 164.308(a)(7)](/systems/trust-and-governance/criteria/hipaa/164-308-a-7) | The entity keeps a contingency plan with data backup, disaster recovery and emergency mode operation. | [Point-in-time recovery](/systems/trust-and-governance/controls/point-in-time-recovery) |
| [HIPAA 164.308(a)(8)](/systems/trust-and-governance/criteria/hipaa/164-308-a-8) | The entity evaluates on a set schedule how well its security policies and procedures meet the rule. | [Continuous control testing](/systems/trust-and-governance/controls/continuous-testing) |
| [HIPAA 164.308(b)(1)](/systems/trust-and-governance/criteria/hipaa/164-308-b-1) | A business associate handles protected health information only under satisfactory written assurances. | [Health data agreements](/systems/trust-and-governance/controls/health-data-agreements) |
| [HIPAA 164.310(a)(1)](/systems/trust-and-governance/criteria/hipaa/164-310-a-1) | Physical access to electronic information systems and the facilities that house them is limited to authorized access. | [Upstream review](/systems/trust-and-governance/controls/upstream-review) |
| [HIPAA 164.312(a)(1)](/systems/trust-and-governance/criteria/hipaa/164-312-a-1) | Systems that hold electronic protected health information allow access only to authorized persons or software. | [Task-bound access](/systems/trust-and-governance/controls/task-bound-access) |
| [HIPAA 164.312(b)](/systems/trust-and-governance/criteria/hipaa/164-312-b) | Mechanisms record and examine activity in systems that hold electronic protected health information. | [Log completeness](/systems/trust-and-governance/controls/log-completeness) |
| [HIPAA 164.312(c)(1)](/systems/trust-and-governance/criteria/hipaa/164-312-c-1) | Electronic protected health information is protected from improper alteration or destruction. | [Append-only records](/systems/trust-and-governance/controls/append-only-records) |
| [HIPAA 164.312(d)](/systems/trust-and-governance/criteria/hipaa/164-312-d) | The entity verifies that a person or entity seeking access is the one claimed. | [Authenticated Actions](/systems/trust-and-governance/controls/authenticated-actions) |
| [HIPAA 164.312(e)(1)](/systems/trust-and-governance/criteria/hipaa/164-312-e-1) | Technical measures guard against unauthorized access to protected health information sent over a network. | [Encryption](/systems/trust-and-governance/controls/encryption) |
| [HIPAA 164.316](/systems/trust-and-governance/criteria/hipaa/164-316) | The entity documents its security policies and procedures and retains that documentation for six years. | [Policy approval](/systems/trust-and-governance/controls/policy-approval) |
| [HIPAA 164.404](/systems/trust-and-governance/criteria/hipaa/164-404) | A covered entity notifies each affected individual of a breach of unsecured protected health information without unreasonable delay. | [Breach notification](/systems/trust-and-governance/controls/breach-notification) |
| [GDPR Art.5](/systems/trust-and-governance/criteria/gdpr/art-5) | Personal data is processed lawfully, fairly and transparently, for specified purposes, minimized, accurate, limited in storage and secure. | [Purpose limitation](/systems/trust-and-governance/controls/purpose-limitation) |
| [GDPR Art.6](/systems/trust-and-governance/criteria/gdpr/art-6) | Processing is lawful only on a stated basis, such as consent, contract, legal obligation or legitimate interest. | [Lawful basis](/systems/trust-and-governance/controls/lawful-basis) |
| [GDPR Art.7](/systems/trust-and-governance/criteria/gdpr/art-7) | A controller shows that consent was given, and withdrawing consent takes no more effort than giving it. | [Lawful basis](/systems/trust-and-governance/controls/lawful-basis) |
| [GDPR Art.13](/systems/trust-and-governance/criteria/gdpr/art-13) | A controller tells data subjects its identity, purposes, legal basis, recipients, retention and their rights at collection. | [Privacy notice](/systems/trust-and-governance/controls/privacy-notice) |
| [GDPR Art.15](/systems/trust-and-governance/criteria/gdpr/art-15) | A data subject obtains confirmation of processing and a copy of their personal data on request. | [Privacy requests](/systems/trust-and-governance/controls/privacy-requests) |
| [GDPR Art.16](/systems/trust-and-governance/criteria/gdpr/art-16) | A data subject obtains correction of inaccurate personal data without undue delay. | [Privacy requests](/systems/trust-and-governance/controls/privacy-requests) |
| [GDPR Art.17](/systems/trust-and-governance/criteria/gdpr/art-17) | A data subject obtains erasure of personal data without undue delay when a listed ground applies. | [Privacy requests](/systems/trust-and-governance/controls/privacy-requests) |
| [GDPR Art.20](/systems/trust-and-governance/criteria/gdpr/art-20) | A data subject receives their personal data in a structured, machine-readable format and may move it elsewhere. | [Privacy requests](/systems/trust-and-governance/controls/privacy-requests) |
| [GDPR Art.21](/systems/trust-and-governance/criteria/gdpr/art-21) | A data subject objects to processing based on legitimate interest or for direct marketing, and marketing processing stops. | [Privacy requests](/systems/trust-and-governance/controls/privacy-requests) |
| [GDPR Art.25](/systems/trust-and-governance/criteria/gdpr/art-25) | A controller builds data protection into processing by design and processes only necessary data by default. | [Purpose limitation](/systems/trust-and-governance/controls/purpose-limitation) |
| [GDPR Art.28](/systems/trust-and-governance/criteria/gdpr/art-28) | A controller uses only processors that give sufficient guarantees, bound by a contract with the required terms. | [Upstream review](/systems/trust-and-governance/controls/upstream-review) |
| [GDPR Art.30](/systems/trust-and-governance/criteria/gdpr/art-30) | Each controller and processor keeps a record of its processing activities. | [Records of processing](/systems/trust-and-governance/controls/processing-records) |
| [GDPR Art.32](/systems/trust-and-governance/criteria/gdpr/art-32) | Controllers and processors implement security appropriate to the risk, including encryption, resilience and regular testing. | [Namespace isolation](/systems/trust-and-governance/controls/namespace-isolation), [Encryption](/systems/trust-and-governance/controls/encryption) |
| [GDPR Art.33](/systems/trust-and-governance/criteria/gdpr/art-33) | A controller notifies the supervisory authority of a personal data breach within 72 hours where feasible. | [Breach notification](/systems/trust-and-governance/controls/breach-notification) |
| [GDPR Art.34](/systems/trust-and-governance/criteria/gdpr/art-34) | A controller tells data subjects without undue delay about a breach likely to put them at high risk. | [Breach notification](/systems/trust-and-governance/controls/breach-notification) |