SOC 2 · PI - Processing Integrity
SOC 2 SOC2-PI1.1: PI1.1 Quality information about processing objectives, data definitions and specifications
SOC 2 SOC2-PI1.1 covers PI1.1 Quality information about processing objectives, data definitions and specifications. The held text names 3 evidence records for it, the first being Data dictionaries or field specifications provided to customers. The common gap an assessor flags is Customers given outputs with no definition of fields or units.
Relevant, good-quality information about processing objectives, including what the processed data means and what products and services are specified to do, is obtained or generated, used and communicated to support use of the products and services. Points of focus: the information specifications needed to use products and services are identified; where data is supplied as part of a service or a reporting obligation, its definition is available to users and covers the population included, the nature of each element, sources, units of measure, accuracy and precision, uncertainty, the date or period observed and the inclusion and exclusion factors, is complete and accurate, and any metadata needed to understand it is described; and for goods, the information users need is available, clearly identifiable and validated.
What evidence supports SOC2-PI1.1?
- Processing integrityData dictionaries or field specifications provided to customers
- Processing integrityProduct and service specifications for processing outputs
- Processing integrityReview or validation records for published specifications
Where this requirement comes from
This is our own statement of SOC 2 SOC2-PI1.1, read from the copy we hold (issuer free complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.
Common gaps an assessor flags
- Customers given outputs with no definition of fields or units
- Specifications outdated after product changes
- Data definitions never checked for accuracy
How it maps to ISO 27001:2022
No reviewed link is held for this control.
A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.