Oh no! No description found. But not to worry. Read from Tasks below how to advance this topic.
SOC 2 framework specifies how organizations should protect customer data from e.g. unauthorized access, security incidents or other vulnerabilities. It is developed by the American Institute of Certified Public Accountants (AICPA).
SOC 2 framework specifies how organizations should protect customer data from e.g. unauthorized access, security incidents or other vulnerabilities. It is developed by the American Institute of Certified Public Accountants (AICPA).
SOC 2 includes 5 different requirement sets: security, availability, processing integrity, confidentiality and privacy. A SOC 2 audit can be carried out related to one or all of these criteria. Each criteria has specific requirements that the company needs to comply with by implementing controls.
Below you'll find all of the requirements of this framework. In Cyberday, we map all requirement to global tasks, making multi-compliance management easy. Do it once, and see the progress across all frameworks!
For information requiring explicit consent, the entity communicates the need for such consent, as well as the consequences of a failure to provide consent for the request for personal information, and obtains the consent prior to the collection of the information to meet the entity’s objectives related to privacy.
Points of focus:
- Obtains Explicit Consent for Sensitive Information
- Documents Explicit Consent to Retain Information




The entity limits the use of personal information to the purposes identified in the entity’s objectives related to privacy.
Points of focus:
- Uses Personal Information for Intended Purposes












The entity retains personal information consistent with the entity’s objectives related to privacy.
Points of focus:
- Retains Personal Information
- Protects Personal Information




The entity securely disposes of personal information to meet the entity’s objectives related to privacy.
Points of focus:
- Captures, Identifies, and Flags Requests for Deletion
- Disposes of, Destroys, and Redacts Personal Information
- Destroys Personal Information








The entity grants identified and authenticated data subjects the ability to access their stored personal information for review and, upon request, provides physical or electronic copies of that information to data subjects to meet the entity’s objectives related to privacy. If access is denied, data subjects are informed of the denial and reason for such denial, as required, to meet the entity’s objectives related to privacy.
Points of focus:
- Authenticates Data Subjects’ Identity
- Permits Data Subjects Access to Their Personal Information
- Provides Understandable Personal Information Within Reasonable Time
- Informs Data Subjects If Access Is Denied












The entity corrects, amends, or appends personal information based on information provided by data subjects and communicates such information to third parties, as committed or required, to meet the entity’s objectives related to privacy. If a request for correction is denied, data subjects are informed of the denial and reason for such denial to meet the entity’s objectives related to privacy.
Points of focus:
- Communicates Denial of Access Requests
- Permits Data Subjects to Update or Correct Personal Information
- Communicates Denial of Correction Requests








The entity discloses personal information to third parties with the explicit consent of data subjects, and such consent is obtained prior to disclosure to meet the entity’s objectives related to privacy.
Points of focus:
- Communicates Privacy Policies to Third Parties
- Discloses Personal Information Only When Appropriate
- Discloses Personal Information Only to Appropriate Third Parties
- Discloses Information to Third Parties for New Purposes and Uses








The entity creates and retains a complete, accurate, and timely record of authorized disclosures of personal information to meet the entity’s objectives related to privacy.
Points of focus:
- Creates and Retains Record of Authorized Disclosures




The entity creates and retains a complete, accurate, and timely record of detected or reported unauthorized disclosures (including breaches) of personal information to meet the entity’s objectives related to privacy.
Points of focus:
- Creates and Retains Record of Detected or Reported Unauthorized Disclosures








The entity obtains privacy commitments from vendors and other third parties who have access to personal information to meet the entity’s objectives related to privacy. The entity assesses those parties’ compliance on a periodic and as- needed basis and takes corrective action, if necessary.
Points of focus:
- Discloses Personal Information Only to Appropriate Third Parties
- Remediates Misuse of Personal Information by a Third Party












The entity obtains commitments from vendors and other third parties with access to personal information to notify the entity in the event of actual or suspected unauthorized disclosures of personal information. Such notifications are reported to appropriate personnel and acted on in accordance with established incident response procedures to meet the entity’s objectives related to privacy.
Points of focus:
- Remediates Misuse of Personal Information by a Third Party
- Reports Actual or Suspected Unauthorized Disclosures
















The entity provides notification of breaches and incidents to affected data subjects, regulators, and others to meet the entity’s objectives related to privacy.
Points of focus:
- Remediates Misuse of Personal Information by a Third Party
- Provides Notice of Breaches and Incidents








The entity provides data subjects with an accounting of the personal information held and disclosure of the data subjects’ personal information, upon the data subjects’ request, to meet the entity’s objectives related to privacy.
Points of focus:
- Identifies Types of Personal Information and Handling Process
- Captures, Identifies, and Communicates Requests for Information












The entity collects and maintains accurate, up- to- date, complete, and relevant personal information to meet the entity’s objectives related to privacy.
Points of focus:
- Ensures Accuracy and Completeness of Personal Information
- Ensures Relevance of Personal Information








The entity implements a process for receiving, addressing, resolving, and communicating the resolution of inquiries, complaints, and disputes from data subjects and others and periodically monitors compliance to meet the entity’s objectives related to privacy. Corrections and other necessary actions related to identified deficiencies are made or taken in a timely manner.
Points of focus:
- Communicates to Data Subjects
- Addresses Inquiries, Complaints, and Disputes
- Documents and Communicates Dispute Resolution and Recourse
- Documents and Reports Compliance Review Results
- Documents and Reports Instances of Noncompliance
- Performs Ongoing Monitoring




















Points of focus:
- Identifies and Manages the Inventory of Information Assets
























Explore our comprehensive resources and improve your security with the themes of this framework.
Discover specific ways our platform streamlines your ISO 27001 compliance process, from automated controls to audit preparation.
Explore use caseTake our comprehensive assessment to identify gaps in your current implementation and get personalized recommendations.
Start assessmentDive deeper with our articles, case studies, and expert insights on framework implementation.
Read articleGet a concise overview of all requirements, controls, and implementation steps in our quick guide.
Get the guideSee how the overlap and differences with any other framework to optimize your compliance strategy.
Compare frameworkParticipate in expert-led sessions covering implementation strategies, common pitfalls, and best practices for compliance.
Register for webinarParticipate in expert-led sessions covering implementation strategies, common pitfalls, and best practices for compliance.
Register for webinarUnderstand the basics of cyber security frameworks with our comprehensive guide.
Read the articleWhen building an ISMS, it's important to understand the different levels of information hierarchy. Here's how Cyberday is structured.
Sets the overall compliance standard or regulation your organization needs to follow.
Break down the framework into specific obligations that must be met.
Concrete actions and activities your team carries out to satisfy each requirement.
Documented rules and practices that are created and maintained as a result of completing tasks.
