Oh no! No description found. But not to worry. Read from Tasks below how to advance this topic.
SOC 2 framework specifies how organizations should protect customer data from e.g. unauthorized access, security incidents or other vulnerabilities. It is developed by the American Institute of Certified Public Accountants (AICPA).
SOC 2 framework specifies how organizations should protect customer data from e.g. unauthorized access, security incidents or other vulnerabilities. It is developed by the American Institute of Certified Public Accountants (AICPA).
SOC 2 includes 5 different requirement sets: security, availability, processing integrity, confidentiality and privacy. A SOC 2 audit can be carried out related to one or all of these criteria. Each criteria has specific requirements that the company needs to comply with by implementing controls.
Below you'll find all of the requirements of this framework. In Cyberday, we map all requirement to global tasks, making multi-compliance management easy. Do it once, and see the progress across all frameworks!
The entity authorizes, designs, develops or acquires, configures, documents, tests, approves, and implements changes to infrastructure, data, software, and procedures to meet its objectives. /desc
Points of focus:
- Manages Changes Throughout the System Lifecycle
- Authorizes Changes
- Designs and Develops Changes
- Documents Changes
- Tracks System Changes
- Configures Software
- Tests System Changes
- Approves System Changes
- Deploys System Changes
- Identifies and Evaluates System Change
- Identifies Changes in Infrastructure, Data, Software, and Procedures Required to Remediate Incidents
- Creates Baseline Configuration of IT Technology
- Provides for Changes Necessary in Emergency Situations
- Protects Confidential Information
- Protects Personal Information








































The entity identifies, selects, and develops risk mitigation activities for risks arising from potential business disruptions.
Points of focus:
- Considers Mitigation of Risks of Business Disruption
- Considers the Use of Insurance to Mitigate Financial Impact Risks




The entity assesses and manages risks associated with vendors and business partners.
Points of focus:
- Establishes Requirements for Vendor and Business Partner Engagements
- Assesses Vendor and Business Partner Risks
- Assigns Responsibility and Accountability for Managing Vendors and Business Partners
- Establishes Communication Protocols for Vendors and Business Partners
- Establishes Exception Handling Procedures From Vendors and Business Partners
- Assesses Vendor and Business Partner Performance
- Implements Procedures for Addressing Issues Identified During Vendor and Business Partner Assessments
- Implements Procedures for Terminating Vendor and Business Partner Relationships
- Obtains Confidentiality Commitments from Vendors and Business Partners
- Assesses Compliance With Confidentiality Commitments of Vendors and Business Partners
- Obtains Privacy Commitments from Vendors and Business Partners
- Assesses Compliance with Privacy Commitments of Vendors and Business Partners
































The entity maintains, monitors, and evaluates current processing capacity and use of system components (infrastructure, data, and software) to manage capacity demand and to enable the implementation of additional capacity to help meet its objectives.
Points of focus:
- Measures Current Usage
- Forecasts Capacity
- Makes Changes Based on Forecasts








The entity authorizes, designs, develops or acquires, implements, operates, approves, maintains, and monitors environmental protections, software, data back- up processes, and recovery infrastructure to meet its objectives.
Points of focus:
- Identifies Environmental Threats
- Designs Detection Measures
- Implements and Maintains Environmental Protection Mechanisms
- Implements Alerts to Analyze Anomalies
- Responds to Environmental Threat Events
- Communicates and Reviews Detected Environmental Threat Events
- Determines Data Requiring Backup
- Performs Data Backup
- Addresses Offsite Storage
- Implements Alternate Processing Infrastructure








































The entity tests recovery plan procedures supporting system recovery to meet its objectives.
Points of focus:
- Implements Business Continuity Plan Testing
- Tests Integrity and Completeness of Back- Up Data








The entity identifies and maintains confidential information to meet the entity’s objectives related to confidentiality.
Points of focus:
- Identifies Confidential information
- Protects Confidential Information from Destruction












The entity disposes of confidential information to meet the entity’s objectives related to confidentiality.
Points of focus:
- Identifies Confidential Information for Destruction
- Destroys Confidential Information








The entity obtains or generates, uses, and communicates relevant, quality information regarding the objectives related to processing, including definitions of data processed and product and service specifications, to support the use of products and services.
Points of focus:
- Identifies Information Specifications
- Defines Data Necessary to Support a Product or Service
















The entity implements policies and procedures over system inputs, including controls over completeness and accuracy, to result in products, services, and reporting to meet the entity’s objectives.
Points of focus:
- Defines Characteristics of Processing Inputs
- Evaluates Processing Inputs
- Creates and Maintains Records of System Inputs




The entity implements policies and procedures over system processing to result in products, services, and reporting to meet the entity’s objectives.
Points of focus:
- Defines Processing Specifications
- Defines Processing Activities
- Detects and Corrects Production Errors
- Records System Processing Activities
- Processes Inputs




The entity implements policies and procedures to make available or deliver output completely, accurately, and timely in accordance with specifications to meet the entity’s objectives.
Points of focus:
- Protects Output
- Distributes Output Only to Intended Parties
- Distributes Output Completely and Accurately
- Creates and Maintains Records of System Output Activities




The entity implements policies and procedures to store inputs, items in processing, and outputs completely, accurately, and timely in accordance with system specifications to meet the entity’s objectives.
Points of focus:
- Protects Stored Items
- Archives and Protects System Records
- Stores Data Completely and Accurately
- Creates and Maintains Records of System Storage Activities




The entity provides notice to data subjects about its privacy practices to meet the entity’s objectives related to privacy. The notice is updated and communicated to data subjects in a timely manner for changes to the entity’s privacy practices, including changes in the use of personal information, to meet the entity’s objectives related to privacy.
Points of focus:
- Communicates to Data Subjects
- Provides Notice to Data Subjects
- Covers Entities and Activities in Notice
- Uses Clear and Conspicuous Language
















The entity communicates choices available regarding the collection, use, retention, disclosure, and disposal of personal information to the data subjects and the consequences, if any, of each choice. Explicit consent for the collection, use, retention, disclosure, and disposal of personal information is obtained from data subjects or other authorized persons, if required. Such consent is obtained only for the intended purpose of the information to meet the entity’s objectives related to privacy. The entity’s basis for determining implicit consent for the collection, use, retention, disclosure, and disposal of personal information is documented.
Points of focus:
- Communicates to Data Subjects
- Communicates Consequences of Denying or Withdrawing Consent
- Obtains Implicit or Explicit Consent
- Documents and Obtains Consent for New Purposes and Uses
- Obtains Explicit Consent for Sensitive Information
- Obtains Consent for Data Transfers
















Personal information is collected consistent with the entity’s objectives related to privacy.
Points of focus:
- Limits the Collection of Personal Information
- Collects Information by Fair and Lawful Means
- Collects Information From Reliable Sources
- Informs Data Subjects When Additional Information Is Acquired












Explore our comprehensive resources and improve your security with the themes of this framework.
Discover specific ways our platform streamlines your ISO 27001 compliance process, from automated controls to audit preparation.
Explore use caseTake our comprehensive assessment to identify gaps in your current implementation and get personalized recommendations.
Start assessmentDive deeper with our articles, case studies, and expert insights on framework implementation.
Read articleGet a concise overview of all requirements, controls, and implementation steps in our quick guide.
Get the guideSee how the overlap and differences with any other framework to optimize your compliance strategy.
Compare frameworkParticipate in expert-led sessions covering implementation strategies, common pitfalls, and best practices for compliance.
Register for webinarParticipate in expert-led sessions covering implementation strategies, common pitfalls, and best practices for compliance.
Register for webinarUnderstand the basics of cyber security frameworks with our comprehensive guide.
Read the articleWhen building an ISMS, it's important to understand the different levels of information hierarchy. Here's how Cyberday is structured.
Sets the overall compliance standard or regulation your organization needs to follow.
Break down the framework into specific obligations that must be met.
Concrete actions and activities your team carries out to satisfy each requirement.
Documented rules and practices that are created and maintained as a result of completing tasks.
