SOC 2 · C - Confidentiality
SOC 2 SOC2-C1.1: C1.1 Identifying and maintaining confidential information
SOC 2 SOC2-C1.1 covers C1.1 Identifying and maintaining confidential information. The held text names 4 evidence records for it, the first being Data classification policy defining confidential information. The common gap an assessor flags is Confidential customer data not identified in any inventory.
Confidential information is identified and kept in line with the organisation's confidentiality objectives. Points of focus: procedures define confidential information and identify and designate it when received or created, and set how long it is kept; it is protected from erasure or destruction during that period; and, added in 2022, it is kept no longer than the identified purpose needs unless a law or regulation requires otherwise.
What evidence supports SOC2-C1.1?
- ConfidentialityData classification policy defining confidential information
- ConfidentialityData inventory tagging confidential data and its retention period
- ConfidentialityRetention schedule and controls preventing premature deletion
- ConfidentialityEvidence of deletion or review when confidential information passes its retention period
Where this requirement comes from
This is our own statement of SOC 2 SOC2-C1.1, read from the copy we hold (issuer free complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.
Common gaps an assessor flags
- Confidential customer data not identified in any inventory
- No defined retention period for confidential information
- Confidential data deletable by anyone with general access
- Confidential data kept indefinitely after the purpose ended
How it maps to ISO 27001:2022
- 5.12 high Identifying and maintaining confidential information is the classification determination an assessor tests.
- 5.13 medium Identification of confidential information implies handling marks but labelling itself is not required.
- 5.9 medium Identifying and maintaining confidential information covers information assets only, not the full asset inventory.
A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.