Compliancemanzill.com
System and Organization Controls (SOC) 2

Compliance assessment

System and Organization Controls (SOC) 2

61 controls in 13 families. Read each control, mark it Met, Partially Met or Not Met, and keep evidence alongside. Your score is saved as you go, so you can pick up where you left off.

Start at A1.1

Availability3

A1.1Maintains, monitors, and evaluates processing capacity and use of system componentsNot assessedA1.2Establish and maintain environmental protection proceduresNot assessedA1.3Test recovery plan proceduresNot assessed

Confidentiality2

C1.1Identify and maintain confidential informationNot assessedC1.2Dispose confidential informationNot assessed

CC1 Control Environment5

CC1.1COSO Principle 1: The entity demonstrates a commitment to integrity and ethical valuesNot assessedCC1.2COSO Principle 2: The board of directors demonstrates independence from management and exercises oversight of the development and performance of internal controlNot assessedCC1.3COSO Principle 3: Management establishes, with board oversight, structures, reporting lines, and appropriate authorities and responsibilities in the pursuit of objectivesNot assessedCC1.4COSO Principle 4: The entity demonstrates a commitment to attract , develop, and retain competent individuals in alignment with objectivesNot assessedCC1.5COSO Principle 5: The entity holds individuals accountable for their internal control responsibilities in the pursuit of objectivesNot assessed

CC2 Communication and Information3

CC2.1COSO Principle 13: The entity obtains or generates and uses relevant, quality information to support the functioning of internal controlNot assessedCC2.2COSO Principle 14: The entity internally communicates information, including objectives and responsibilities for internal control, necessary to support the functioning of internal controlNot assessedCC2.3COSO Principle 15: The entity communicates with external parties regarding matters affecting the functioning of internal controlNot assessed

CC3 Risk Assessment4

CC3.1COSO Principle 6: The entity specifies objectives with sufficient clarity to enable the identification and assessment of risks relating to objectivesNot assessedCC3.2COSO Principle 7: The entity identifies risks to the achievement of its objectives across the entity and analyzes risks as a basis for determining how the risks should be managedNot assessedCC3.3COSO Principle 8: The entity considers the potential for fraud in assessing risks to the achievement of objectivesNot assessedCC3.4COSO Principle 9: The entity identifies and assesses changes that could significantly impact the system of internal controlNot assessed

CC4 Monitoring Activities2

CC4.1COSO Principle 16: The entity selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioningNot assessedCC4.2COSO Principle 17: The entity evaluates and communicates internal control deficiencies in a timely manner to those parties responsible for taking corrective action, including senior management and the board of directors, as appropriateNot assessed

CC5 Control Activities3

CC5.1COSO Principle 10: The entity selects and develops control activities that contribute to the mitigation of risks to the achievement of objectives to acceptable levelsNot assessedCC5.2COSO Principle 11: The entity also selects and develops general control activities over technology to support the achievement of objectivesNot assessedCC5.3COSO Principle 12: The entity deploys control activities through policies that establish what is expected and in procedures that put policies into actionNot assessed

Logical and physical access controls8

CC6.1Implement logical access securityNot assessedCC6.2Authorizes users prior to issuing system credentials and granting system accessNot assessedCC6.3Authorizes, modifies, or removes access to dataNot assessedCC6.4Restricts physical access to facilities and protected information assetsNot assessedCC6.5Discontinues logical and physical protections over no longer required physical assetsNot assessedCC6.6Implements logical access security measures to protect against threatsNot assessedCC6.7Restrict the transmission, movement, and removal of information to authorized internal and external usersNot assessedCC6.8Implements controls to prevent or detect unauthorized or malicious softwareNot assessed

System operations5

CC7.1Detects and Monitors for Unauthorized Configuration ChangesNot assessedCC7.2Monitors for System AnomaliesNot assessedCC7.3Evaluates security eventsNot assessedCC7.4Responds to security incidents by executing a defined incident-response programNot assessedCC7.5Identifies, develops, and implements activities to recover from security incidentsNot assessed

Change management1

CC8.1Establish and maintain document for changes in infrastructure, data, software, and proceduresNot assessed

Risk mitigation2

CC9.1Identifies, selects, and develops risk mitigation activitiesNot assessedCC9.2Assess and manages risks associated with vendorsNot assessed

Privacy18

P1.1Provide notice to data subjects about its privacy practicesNot assessedP2.1Use, retention, disclosure, and disposal of personal information to the data subjectsNot assessedP3.1Collect personal information as per privacy policyNot assessedP3.2Obtain the consent prior to the collection of the informationNot assessedP4.1Limits the use of personal informationNot assessedP4.2Retain personal informationNot assessedP4.3Dispose personal information securelyNot assessedP5.1Grant access to personal information only for identified and authenticated data subjectsNot assessedP5.2Correct, amends, or appends personal information based on information provided by data subjectsNot assessedP6.1Disclose personal information to third parties with consent of data subjectsNot assessedP6.2Create and retain record of authorized disclosures of personal informationNot assessedP6.3Create and retain record of detected or reported unauthorized disclosure of personal informationNot assessedP6.4Establish and maintain privacy commitments from vendors and other third partiesNot assessedP6.5Notify entity in the event unauthorized disclosures of personal information of vendorNot assessedP6.6Notification of breaches and incidents to affected data subjects, regulators, and othersNot assessedP6.7Disclosure of the data subjects' personal informationNot assessedP7.1Collect and maintain accurate, up-to-date, complete, and relevant personal informationNot assessedP8.1Implements a process for identify and resolving inquiries, complaints, and disputes from data subjectsNot assessed

Processing integrity5

PI1.1Obtain or generate and use quality information regarding the objectives related to processingNot assessedPI1.2Implement policies and procedures over system inputsNot assessedPI1.3Implements policies and procedures over system processingNot assessedPI1.4Ensures the complete, accurate, and timely processing of dataNot assessedPI1.5Implements policies and procedures to store inputs, items in processingNot assessed