Evidence Binderthe free audit-evidence library, and the binder you build from it

61 held requirements. issuer free complete copy.

SOC 2 evidence requirements

Every requirement we hold for SOC 2, stated in our words and cited to the clause, with the evidence records the text describes and the reviewed links to the other framework.

Build a request list for SOC 2All frameworks

Requirements in SOC 2

  1. SOC2-A1.1A1.1 Managing processing capacity
  2. SOC2-A1.2A1.2 Environmental protection, backup and recovery infrastructure
  3. SOC2-A1.3A1.3 Testing recovery plan procedures
  4. SOC2-C1.1C1.1 Identifying and maintaining confidential information
  5. SOC2-C1.2C1.2 Disposing of confidential information
  6. SOC2-CC1.1CC1.1 Commitment to integrity and ethical values (COSO principle 1)
  7. SOC2-CC1.2CC1.2 Board independence and oversight of internal control (COSO principle 2)
  8. SOC2-CC1.3CC1.3 Structures, reporting lines, authorities and responsibilities (COSO principle 3)
  9. SOC2-CC1.4CC1.4 Attracting, developing and retaining competent people (COSO principle 4)
  10. SOC2-CC1.5CC1.5 Accountability for internal control responsibilities (COSO principle 5)
  11. SOC2-CC2.1CC2.1 Relevant, quality information to support internal control (COSO principle 13)
  12. SOC2-CC2.2CC2.2 Internal communication of objectives and control responsibilities (COSO principle 14)
  13. SOC2-CC2.3CC2.3 Communication with external parties about internal control (COSO principle 15)
  14. SOC2-CC3.1CC3.1 Objectives specified clearly enough to assess risk (COSO principle 6)
  15. SOC2-CC3.2CC3.2 Identifying and analysing risks to objectives (COSO principle 7)
  16. SOC2-CC3.3CC3.3 Considering fraud risk (COSO principle 8)
  17. SOC2-CC3.4CC3.4 Identifying and assessing significant changes (COSO principle 9)
  18. SOC2-CC4.1CC4.1 Ongoing and separate evaluations of control (COSO principle 16)
  19. SOC2-CC4.2CC4.2 Evaluating and communicating control deficiencies (COSO principle 17)
  20. SOC2-CC5.1CC5.1 Selecting control activities that mitigate risk (COSO principle 10)
  21. SOC2-CC5.2CC5.2 General controls over technology (COSO principle 11)
  22. SOC2-CC5.3CC5.3 Deploying controls through policies and procedures (COSO principle 12)
  23. SOC2-CC6.1CC6.1 Logical access security over protected information assets
  24. SOC2-CC6.2CC6.2 Registering and authorising users before issuing credentials
  25. SOC2-CC6.3CC6.3 Role-based access, least privilege and segregation of duties
  26. SOC2-CC6.4CC6.4 Restricting physical access to facilities and assets
  27. SOC2-CC6.5CC6.5 Protecting data on assets until disposal
  28. SOC2-CC6.6CC6.6 Protection against threats from outside the system boundary
  29. SOC2-CC6.7CC6.7 Restricting and protecting information in transmission, movement and removal
  30. SOC2-CC6.8CC6.8 Preventing and detecting unauthorised or malicious software
  31. SOC2-CC7.1CC7.1 Detecting configuration changes and new vulnerabilities
  32. SOC2-CC7.2CC7.2 Monitoring system components for anomalies
  33. SOC2-CC7.3CC7.3 Evaluating security events to identify incidents
  34. SOC2-CC7.4CC7.4 Responding to security incidents
  35. SOC2-CC7.5CC7.5 Recovering from security incidents
  36. SOC2-CC8.1CC8.1 Managing changes to procedures, software, data and infrastructure
  37. SOC2-CC9.1CC9.1 Mitigating risks of business disruption
  38. SOC2-CC9.2CC9.2 Assessing and managing vendor and business partner risk
  39. SOC2-P1.1P1.1 Privacy notice to data subjects
  40. SOC2-P2.1P2.1 Choice and consent
  41. SOC2-P3.1P3.1 Collecting personal information consistent with objectives
  42. SOC2-P3.2P3.2 Explicit consent before collecting information that requires it
  43. SOC2-P4.1P4.1 Limiting use to identified purposes
  44. SOC2-P4.2P4.2 Retaining personal information
  45. SOC2-P4.3P4.3 Securely disposing of personal information
  46. SOC2-P5.1P5.1 Data subject access
  47. SOC2-P5.2P5.2 Correction of personal information
  48. SOC2-P6.1P6.1 Disclosure to third parties with consent
  49. SOC2-P6.2P6.2 Record of authorised disclosures
  50. SOC2-P6.3P6.3 Record of unauthorised disclosures and breaches
  51. SOC2-P6.4P6.4 Privacy commitments from vendors and third parties
  52. SOC2-P6.5P6.5 Vendor commitments to report unauthorised disclosures
  53. SOC2-P6.6P6.6 Notifying breaches and incidents
  54. SOC2-P6.7P6.7 Accounting of personal information held and disclosed
  55. SOC2-P7.1P7.1 Quality of personal information
  56. SOC2-P8.1P8.1 Inquiries, complaints, disputes and compliance monitoring
  57. SOC2-PI1.1PI1.1 Quality information about processing objectives, data definitions and specifications
  58. SOC2-PI1.2PI1.2 Controls over system inputs
  59. SOC2-PI1.3PI1.3 Controls over system processing
  60. SOC2-PI1.4PI1.4 Controls over output delivery
  61. SOC2-PI1.5PI1.5 Controls over stored inputs, work in process and outputs