Oh no! No description found. But not to worry. Read from Tasks below how to advance this topic.
SOC 2 framework specifies how organizations should protect customer data from e.g. unauthorized access, security incidents or other vulnerabilities. It is developed by the American Institute of Certified Public Accountants (AICPA).
SOC 2 framework specifies how organizations should protect customer data from e.g. unauthorized access, security incidents or other vulnerabilities. It is developed by the American Institute of Certified Public Accountants (AICPA).
SOC 2 includes 5 different requirement sets: security, availability, processing integrity, confidentiality and privacy. A SOC 2 audit can be carried out related to one or all of these criteria. Each criteria has specific requirements that the company needs to comply with by implementing controls.
Below you'll find all of the requirements of this framework. In Cyberday, we map all requirement to global tasks, making multi-compliance management easy. Do it once, and see the progress across all frameworks!
COSO Principle 11: The entity also selects and develops general control activities over technology to support the achievement of objectives.
Points of focus:
- Determines Dependency Between the Use of Technology in Business Processes and Technology General Controls
- Establishes Relevant Technology Infrastructure Control Activities
- Establishes Relevant Security Management Process Controls Activities
- Establishes Relevant Technology Acquisition, Development, and Maintenance Process Control Activities








COSO Principle 12: The entity deploys control activities through policies that establish what is expected and in procedures that put policies into action.
Points of focus:
- Establishes Policies and Procedures to Support Deployment of Management ‘s Directives
- Establishes Responsibility and Accountability for Executing Policies and Procedures
- Performs in a Timely Manner
- Takes Corrective Action
- Performs Using Competent Personnel
- Reassesses Policies and Procedures












The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives.
Points of focus:
- Restricts Logical Access
- Identifies and Authenticates Users
- Manages Points of Access
- Restricts Access to Information Assets
- Manages Identification and Authentication
- Manages Credentials for Infrastructure and Software
























Prior to issuing system credentials and granting system access, the entity registers and authorizes new internal and external users whose access is administered by the entity. For those users whose access is administered by the entity, user system credentials are removed when user access is no longer authorized.
Points of focus:
- Controls Access Credentials to Protected Assets
- Removes Access to Protected Assets When Appropriate
- Reviews Appropriateness of Access Credentials
























The entity authorizes, modifies, or removes access to data, software, functions, and other protected information assets based on roles, responsibilities, or the system design and changes, giving consideration to the concepts of least privilege and segregation of duties, to meet the entity’s objectives.
Points of focus:
- Creates or Modifies Access to Protected Information Assets
- Removes Access to Protected Information Assets
- Uses Role- Based Access Controls
















The entity restricts physical access to facilities and protected information assets (for example, data center facilities, back- up media storage, and other sensitive locations) to authorized personnel to meet the entity’s objectives.
Points of focus:
- Creates or Modifies Physical Access
- Removes Physical Access
- Reviews Physical Access








































The entity discontinues logical and physical protections over physical assets only after the ability to read or recover data and software from those assets has been diminished and is no longer required to meet the entity’s objectives.
Points of focus:
- Identifies Data and Software for Disposal
- Removes Data and Software From Entity Control




















The entity implements logical access security measures to protect against threats from sources outside its system boundaries.
Points of focus:
- Restricts Access
- Protects Identification and Authentication Credentials
- Requires Additional Authentication or Credentials
- Implements Boundary Protection Systems




























The entity restricts the transmission, movement, and removal of information to authorized internal and external users and processes, and protects it during transmission, movement, or removal to meet the entity’s objectives.
Points of focus:
- Restricts the Ability to Perform Transmission
- Uses Encryption Technologies or Secure Communication Channels to Protect Data
- Protects Removal Media
- Protects Mobile Devices








































The entity implements controls to prevent or detect and act upon the introduction of unauthorized or malicious software to meet the entity’s objectives.
Points of focus:
- Restricts Application and Software Installation
- Detects Unauthorized Changes to Software and Configuration Parameters
- Uses a Defined Change Control Process
- Uses Antivirus and Anti- Malware Software
- Scans Information Assets from Outside the Entity for Malware and Other Unauthorized Software




































To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations that result in the introduction of new vulnerabilities, and (2) susceptibilities to newly discovered vulnerabilities.
Points of focus:
- Uses Defined Configuration Standards
- Monitors Infrastructure and Software
- Implements Change- Detection Mechanisms
- Detects Unknown or Unauthorized Components
- Conducts Vulnerability Scans
























The entity monitors system components and the operation of those components for anomalies that are indicative of malicious acts, natural disasters, and errors affecting the entity's ability to meet its objectives; anomalies are analyzed to determine whether they represent security events.
Points of focus:
- Implements Detection Policies, Procedures, and Tools
- Designs Detection Measures
- Implements Filters to Analyze Anomalies
- Monitors Detection Tools for Effective Operation




























The entity evaluates security events to determine whether they could or have resulted in a failure of the entity to meet its objectives (security incidents) and, if so, takes actions to prevent or address such failures.
Points of focus:
- Responds to Security Incidents
- Communicates and Reviews Detected Security Events
- Develops and Implements Procedures to Analyze Security Incidents
- Assesses the Impact on Personal Information
- Determines Personal Information Used or Disclosed
























The entity responds to identified security incidents by executing a defined incident response program to understand, contain, remediate, and communicate security incidents, as appropriate.
Points of focus:
- Assigns Roles and Responsibilities
- Contains Security Incidents
- Mitigates Ongoing Security Incidents
- Ends Threats Posed by Security Incidents
- Restores Operations
- Develops and Implements Communication Protocols for Security Incidents
- Obtains Understanding of Nature of Incident and Determines Containment Strategy
- Remediates Identified Vulnerabilities
- Communicates Remediation Activities
- Evaluates the Effectiveness of Incident Response
- Periodically Evaluates Incidents
- Communicates Unauthorized Use and Disclosure
- Application of Sanctions




























The entity identifies, develops, and implements activities to recover from identified security incidents.
Points of focus:
- Restores the Affected Environment
- Communicates Information About the Event
- Determines Root Cause of the Event
- Implements Changes to Prevent and Detect Recurrences
- Improves Response and Recovery Procedures
- Implements Incident Recovery Plan Testing
































Explore our comprehensive resources and improve your security with the themes of this framework.
Discover specific ways our platform streamlines your ISO 27001 compliance process, from automated controls to audit preparation.
Explore use caseTake our comprehensive assessment to identify gaps in your current implementation and get personalized recommendations.
Start assessmentDive deeper with our articles, case studies, and expert insights on framework implementation.
Read articleGet a concise overview of all requirements, controls, and implementation steps in our quick guide.
Get the guideSee how the overlap and differences with any other framework to optimize your compliance strategy.
Compare frameworkParticipate in expert-led sessions covering implementation strategies, common pitfalls, and best practices for compliance.
Register for webinarParticipate in expert-led sessions covering implementation strategies, common pitfalls, and best practices for compliance.
Register for webinarUnderstand the basics of cyber security frameworks with our comprehensive guide.
Read the articleWhen building an ISMS, it's important to understand the different levels of information hierarchy. Here's how Cyberday is structured.
Sets the overall compliance standard or regulation your organization needs to follow.
Break down the framework into specific obligations that must be met.
Concrete actions and activities your team carries out to satisfy each requirement.
Documented rules and practices that are created and maintained as a result of completing tasks.
