What evidence does SOC 2 SOC2-P6.7 need?

Data map of personal information across systems and third parties. Log of accounting requests and responses. Log of requests from controller customers asking what personal data is held, with responses (processor role)

SOC2-P6.7 of SOC 2, stated here in our words and cited to that clause.

Does it map to the other framework?

The held record carries no reviewed link for this control, and does not invent one.

SOC 2 P6.7 evidence | Evidence Binder, audit evidence

SOC 2 P6.7: P6.7 Accounting of personal information held and disclosed

SOC 2 P6.7 covers P6.7 Accounting of personal information held and disclosed. The held text names 3 evidence records for it, the first being Data map of personal information across systems and third parties. The common gap an assessor flags is Data map incomplete so accounting responses miss systems.

On request, data subjects receive a report of what personal information is held about them and its disclosures. Points of focus: the types of personal and sensitive personal information, and the processes, systems and third parties that handle them, are identified; and requests for an accounting are captured and answered. The 2022 revision adds, for data processors, answering data controllers when they ask what personal information the processor holds, in line with service agreements.

What evidence supports P6.7?

Data subject rightsData map of personal information across systems and third parties
Data subject rightsLog of accounting requests and responses
Data subject rightsLog of requests from controller customers asking what personal data is held, with responses (processor role)

Where this requirement comes from

This is our own statement of SOC 2 P6.7, read from the copy we hold (issuer free complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.

Common gaps an assessor flags

Data map incomplete so accounting responses miss systems
Requests not tracked

How it maps to ISO 27001:2022

No reviewed link is held for this control.

A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.