.svg)
SOC 2
Posts tagged SOC 2
97 posts
Complementary User Entity Controls (CUECs) in SOC 2: What They Are and How to Evidence Them
Complementary user entity controls (CUECs) are the controls a vendor's SOC 2 report assumes its customers operate. A typical cloud arrangement: the ...
SOC 2 Evidence Collection Without APIs: Hypervisors, Firewalls, and Servers You Patch by Hand
SOC 2 evidence collection on-prem works without APIs: auditors accept evidence collected by hand, by script, or by screenshot, provided it is...
SOC 2 for Hybrid and On-Prem Infrastructure: Scoping and the System Description
A service that runs partly in a public cloud and partly on company-owned hardware is one system for SOC 2 whenever customer data or commands cross...
SOC 2 on a Neocloud: What Changes When You Move Off a Hyperscaler
A SOC 2 report survives a move from a hyperscaler to a neocloud, but its system description, boundary, vendor list and a set of controls change. The...
SOC 2 CC7.5: Recovering From Identified Security Incidents
SOC 2 CC7.5 requires a company to identify, develop, and implement the activities that recover the environment after a security incident, and to...
SOC 2 CC7.4: Responding to Security Incidents
SOC 2 CC7.4 requires a company to respond to security incidents through a defined incident-response program that understands, contains, remediates,...
SOC 2 CC7.3: Evaluating Security Events to Identify Incidents
SOC 2 CC7.3 requires a company to evaluate detected security events, decide which of them are incidents, and act on the ones that are. It sits in the...
SOC 2 CC1.2: Board Independence and Oversight
SOC 2 CC1.2 requires that a board of directors, or the body that plays the board's role, stays independent from management and exercises oversight of...
SOC 2 CC5.2: General Controls Over Technology
SOC 2 CC5.2 requires an organization to select and develop general control activities over technology so its systems support the objectives the...
SOC 2 CC2.2: Internal Communication
SOC 2 CC2.2 requires an organization to communicate internal control information, including objectives and responsibilities, to the people inside the...
SOC 2 CC1.5: Accountability for Internal Control
SOC 2 CC1.5 requires an organization to hold individuals accountable for the internal control responsibilities assigned to them. It closes the CC1...
SOC 2 CC6.8: Preventing and Detecting Unauthorized or Malicious Software
SOC 2 CC6.8 requires controls that prevent, or detect and act on, the introduction of unauthorized or malicious software. It sits in the CC6 series...
SOC 2 CC6.7: Restricting the Transmission, Movement, and Removal of Information
SOC 2 CC6.7 requires that information is protected when it is transmitted, moved, or removed, and that only authorized users and processes can do so....
SOC 2 CC6.6: Protecting Against Threats From Outside System Boundaries
SOC 2 CC6.6 requires logical access security measures that protect the system against threats originating outside its boundaries. It sits in the CC6...
SOC 2 CC6.5: Discontinuing Protections Over Disposed Assets
SOC 2 CC6.5 requires that data and software are rendered unrecoverable before an asset loses its protections or leaves the company's control. It sits...
SOC 2 CC3.3: Considering the Potential for Fraud in Risk Assessment
SOC 2 CC3.3 requires an entity to consider the potential for fraud when it assesses risks to its objectives. It sits in the CC3 series (Risk...
SOC 2 CC3.4: Identifying and Assessing Significant Changes
SOC 2 CC3.4 requires an entity to identify and assess changes that could significantly affect its system of internal control. It closes the CC3...
SOC 2 CC5.3: Policies and Procedures
SOC 2 CC5.3 requires an organization to deploy its control activities through policies that state what is expected and procedures that put those...
SOC 2 CC5.1: Selecting and Developing Control Activities
SOC 2 CC5.1 requires an organization to select and develop control activities that reduce its risks to an acceptable level, choosing each control...
SOC 2 CC2.3: External Communication
SOC 2 CC2.3 requires an organization to communicate with external parties about matters that affect how its internal control operates, and to give...
SOC 2 CC3.1: Specifying Objectives With Enough Clarity to Assess Risk
SOC 2 CC3.1 requires an entity to state its objectives clearly enough that the risks to those objectives can be identified and assessed. It opens the...
SOC 2 CC3.2: Identifying and Analyzing Risk to Your Objectives
SOC 2 CC3.2 requires an entity to identify risks to its objectives across the whole organization and to analyze them well enough to decide how each...
SOC 2 CC1.4: Commitment to Competence
SOC 2 CC1.4 requires an organization to attract, develop, and retain people who are competent to carry out their responsibilities, and to hold...
SOC 2 CC2.1: Quality Information Supporting Controls
SOC 2 CC2.1 requires an organization to obtain or generate and use relevant, quality information so that its internal controls can function. It opens...
SOC 2 CC1.3: Structures, Reporting Lines, and Authorities
SOC 2 CC1.3 requires management, with board oversight, to set up the organizational structures, reporting lines, and authorities the business needs...
SOC 2 CC1.1: Integrity and Ethical Values
SOC 2 CC1.1 requires an organization to demonstrate a commitment to integrity and ethical values, starting with how the board and management behave...
SOC 2 CC4.2: Evaluating and Communicating Deficiencies
SOC 2 CC4.2 requires an organization to evaluate the deficiencies its monitoring turns up and communicate them, in a timely way, to the people who...
SOC 2 CC4.1: Ongoing and Separate Evaluations
SOC 2 CC4.1 requires an organization to select, develop, and run a mix of ongoing and separate evaluations to confirm its internal controls are...
SOC 2 CC6.4: Restricting Physical Access to Facilities and Assets
SOC 2 CC6.4 requires that physical access to facilities and protected information assets is restricted to authorized personnel. It sits in the CC6...
SOC 2 CC9.2: Vendor and Business Partner Risk Management
SOC 2 CC9.2 is the vendor and business partner risk criterion: it requires an organization to assess and manage the risks that come from the third...