SOC 2 · P - Privacy
SOC 2 SOC2-P6.3: P6.3 Record of unauthorised disclosures and breaches
SOC 2 SOC2-P6.3 covers P6.3 Record of unauthorised disclosures and breaches. The held text names 2 evidence records for it, the first being Breach and unauthorised disclosure register. The common gap an assessor flags is Minor disclosures handled but never recorded.
A full, correct and up-to-date log of detected or reported unauthorised disclosures, including breaches, of personal information is created and kept. Point of focus: the record of detected or reported unauthorised disclosures is maintained completely, accurately and promptly.
What evidence supports SOC2-P6.3?
- Breach registerBreach and unauthorised disclosure register
- Breach registerLink from incident records to breach register entries
Where this requirement comes from
This is our own statement of SOC 2 SOC2-P6.3, read from the copy we hold (issuer free complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.
Common gaps an assessor flags
- Minor disclosures handled but never recorded
- Register not reconciled to the incident system
How it maps to ISO 27001:2022
No reviewed link is held for this control.
A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.