A SOC 2 report is an auditor's opinion on controls at a service organisation against the AICPA Trust Services Criteria. Security, covered by the common criteria CC1 to CC9, is always in scope. Availability, confidentiality, processing integrity and privacy are added by choice. This list covers all five categories.
Free account needed to download. You come straight back to the file.
Who it is for. Software and service companies that hold customer data and are asked by customers for independent assurance. It is common in SaaS, cloud and outsourcing.
What this list covers. AICPA Trust Services Criteria, common criteria CC1 to CC9 and the additional categories: 51 criteria. Each has a reference, a heading and a sentence in plain English.
| Ref | Control | What it asks for |
|---|---|---|
| CC1.1 | Integrity and ethical values | Show a commitment to integrity and ethics through standards of conduct that are enforced. |
| CC1.2 | Board oversight | Have a board or equivalent that is independent of management and oversees the control system. |
| CC1.3 | Structure, reporting lines and authority | Define structures, reporting lines and responsibilities that support the objectives. |
| CC1.4 | Commitment to competence | Attract, develop and keep people with the skills the objectives need. |
| CC1.5 | Accountability | Hold people accountable for their responsibilities for internal control. |
| Ref | Control | What it asks for |
|---|---|---|
| CC2.1 | Quality information | Obtain or produce relevant, quality information to support internal control. |
| CC2.2 | Internal communication | Tell people internally what they need to know about objectives and control responsibilities. |
| CC2.3 | External communication | Communicate with customers, partners and others about matters that affect control. |
| Ref | Control | What it asks for |
|---|---|---|
| CC3.1 | Clear objectives | Specify objectives clearly enough to identify and assess the risks to them. |
| CC3.2 | Identify and analyse risk | Identify risks across the entity and analyse them to decide how to manage them. |
| CC3.3 | Consider fraud | Take the potential for fraud into account when assessing risk. |
| CC3.4 | Assess significant change | Identify and assess changes that could affect the system of internal control. |
| Ref | Control | What it asks for |
|---|---|---|
| CC4.1 | Evaluate controls | Carry out ongoing or separate evaluations of whether controls are present and working. |
| CC4.2 | Communicate deficiencies | Evaluate and report control deficiencies to those who can act, including management and the board. |
| Ref | Control | What it asks for |
|---|---|---|
| CC5.1 | Select and develop control activities | Choose and build control activities that reduce risks to an acceptable level. |
| CC5.2 | Technology general controls | Select and develop general controls over technology to support the objectives. |
| CC5.3 | Policies and procedures | Deploy control activities through policies that set expectations and procedures that put them into action. |
| Ref | Control | What it asks for |
|---|---|---|
| CC6.1 | Logical access controls | Implement logical access security over information assets to protect them from outside threats. |
| CC6.2 | Provision access | Register and authorise users before issuing credentials, and remove access when it is no longer needed. |
| CC6.3 | Role-based, least-privilege access | Grant, change and remove access based on role, need and separation of duties. |
| CC6.4 | Restrict physical access | Limit physical access to facilities and protected information assets to authorised people. |
| CC6.5 | Dispose of assets | Remove data and software from assets and make them unreadable before disposal. |
| CC6.6 | Protect against outside threats | Put controls in place against threats from sources outside the system boundary. |
| CC6.7 | Restrict movement of information | Limit the transmission, movement and removal of information to authorised parties and protect it in transit. |
| CC6.8 | Prevent malicious software | Prevent or detect and act on unauthorised or malicious software. |
| Ref | Control | What it asks for |
|---|---|---|
| CC7.1 | Detect vulnerabilities and changes | Use detection and monitoring to find configuration changes and newly discovered vulnerabilities. |
| CC7.2 | Monitor for anomalies | Monitor systems and components for anomalies that might indicate malicious acts, failures or errors. |
| CC7.3 | Evaluate security events | Evaluate events to decide whether they are incidents that affect the objectives. |
| CC7.4 | Respond to incidents | Respond to identified incidents with a defined programme that contains, remediates and communicates. |
| CC7.5 | Recover from incidents | Identify, develop and carry out activities to recover from incidents. |
| Ref | Control | What it asks for |
|---|---|---|
| CC8.1 | Manage changes | Authorise, design, test, approve and implement changes to infrastructure, data, software and procedures. |
| Ref | Control | What it asks for |
|---|---|---|
| CC9.1 | Business disruption | Identify, select and develop risk mitigation activities for business disruptions. |
| CC9.2 | Vendors and partners | Assess and manage the risks that come from vendors and business partners. |
| Ref | Control | What it asks for |
|---|---|---|
| A1.1 | Capacity | Maintain, monitor and evaluate processing capacity so availability commitments can be met. |
| A1.2 | Environmental protection and backup | Put in place protections, software and backup processes that support recovery. |
| A1.3 | Test recovery | Test the recovery plan procedures that support system recovery. |
| Ref | Control | What it asks for |
|---|---|---|
| C1.1 | Identify and protect confidential information | Identify and maintain confidential information to meet confidentiality commitments. |
| C1.2 | Dispose of confidential information | Dispose of confidential information when it is no longer needed to meet commitments. |
| Ref | Control | What it asks for |
|---|---|---|
| PI1.1 | Define what is processed | Obtain and use information that defines what the system should produce and how. |
| PI1.2 | Check system inputs | Put policies and procedures in place so that inputs are complete, accurate and timely. |
| PI1.3 | Check processing | Put policies and procedures in place so that processing is complete, accurate and authorised. |
| PI1.4 | Check outputs | Make outputs complete, accurate and timely, and deliver them to the intended recipients. |
| PI1.5 | Protect stored items | Store inputs, items in process and outputs completely, accurately and timely. |
| Ref | Control | What it asks for |
|---|---|---|
| P1 | Notice and communication | Give data subjects notice of the privacy practices and objectives. |
| P2 | Choice and consent | Describe the choices available and obtain consent where it is required. |
| P3 | Collection | Collect personal information only for the identified purposes and in the ways described. |
| P4 | Use, retention and disposal | Limit use to the stated purposes, keep it only as long as needed and dispose of it securely. |
| P5 | Access | Let individuals see and correct their personal information. |
| P6 | Disclosure and notification | Disclose to third parties only as agreed, and notify of breaches and incidents. |
| P7 | Quality | Keep personal information accurate, complete and relevant for its purposes. |
| P8 | Monitoring and enforcement | Monitor compliance with privacy commitments and deal with complaints and disputes. |
Type 1 reports on whether controls are suitably designed at a point in time. Type 2 also tests that they operated effectively over a period, usually six to twelve months.
The Security category, which is the common criteria CC1 to CC9. The other four categories are chosen according to the commitments you make to customers.
No. A licensed CPA firm issues the report after an audit. A list like this is for preparation.
No. The criteria references identify each item and the wording beside them is our own summary. The AICPA publishes the criteria and points of focus.