SOC 2 · C - Confidentiality
SOC 2 SOC2-C1.2: C1.2 Disposing of confidential information
SOC 2 SOC2-C1.2 covers C1.2 Disposing of confidential information. The held text names 3 evidence records for it, the first being Data disposal procedure. The common gap an assessor flags is Data kept indefinitely past its retention period.
Confidential information is disposed of in line with confidentiality objectives. Points of focus: confidential information whose retention period has ended is identified for destruction; and it is erased or otherwise destroyed.
What evidence supports SOC2-C1.2?
- ConfidentialityData disposal procedure
- ConfidentialityEvidence of scheduled deletion jobs or destruction logs
- ConfidentialityCustomer data deletion records on contract termination
Where this requirement comes from
This is our own statement of SOC 2 SOC2-C1.2, read from the copy we hold (issuer free complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.
Common gaps an assessor flags
- Data kept indefinitely past its retention period
- No evidence customer data was deleted after offboarding
- Deletion does not reach backups or replicas within a defined time
How it maps to ISO 27001:2022
- 8.10 high Secure disposal of confidential information is deletion of information no longer required.
A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.