SOC 2 Handbook

• Control Environment

  Establish the organizational foundation for internal control: integrity, board oversight, structure, competence, and accountability.

  5 criteria

• Communication and Information

  Generate quality information and communicate internal control responsibilities internally and externally.

  3 criteria

• Risk Assessment

  Specify objectives, identify and analyze risks including fraud, and assess significant change.

  4 criteria

• Monitoring Activities

  Evaluate whether controls are present and functioning, and communicate deficiencies for corrective action.

  2 criteria

• Control Activities

  Select, develop, and deploy control activities, including general controls over technology, through policies and procedures.

  3 criteria

• Logical and Physical Access Controls

  Restrict logical and physical access to systems and data to authorized users, and protect against unauthorized access and malicious software.

  8 criteria

• System Operations

  Detect and monitor configuration changes, vulnerabilities, and anomalies, and evaluate, respond to, and recover from security events.

  5 criteria

• Change Management

  Authorize, design, test, approve, and implement changes to infrastructure, data, software, and procedures.

  1 criterion

• Risk Mitigation

  Mitigate the risks of business disruption and of vendors and business partners.

  2 criteria

• Availability

  Manage capacity and protect, back up, and recover the system to meet availability commitments.

  3 criteria

• Confidentiality

  Identify, protect, and dispose of confidential information in line with confidentiality commitments.

  2 criteria

• Processing Integrity

  Ensure processing is complete, valid, accurate, timely, and authorized from input through output and storage.

  5 criteria

• Notice and Communication of Objectives

  Provide notice to data subjects about privacy practices and objectives.

  1 criterion

• Choice and Consent

  Communicate choices and obtain consent for the collection, use, and disclosure of personal information.

  1 criterion

• Collection

  Collect personal information consistent with privacy objectives, with explicit consent where required.

  2 criteria

• Use, Retention, and Disposal

  Limit use of personal information to identified purposes, retain it only as long as needed, and dispose of it securely.

  3 criteria

• Access

  Give data subjects access to their personal information and a way to correct it.

  2 criteria

• Disclosure and Notification

  Disclose personal information only with consent, keep records of disclosures, manage third parties, and notify affected parties of breaches.

  7 criteria

• Quality

  Maintain accurate, up-to-date, complete, and relevant personal information.

  1 criterion

• Monitoring and Enforcement

  Address privacy inquiries, complaints, and disputes, and monitor compliance with privacy commitments.

  1 criterion

Need help putting this into practice? See our SOC 2 compliance services.