audit-labs/control-coverage

 1# SOC 2 — Trust Services Criteria (AICPA, 2017 with 2022 revised points of focus).
 2#
 3# The full Common Criteria (the "Security" category every SOC 2 report covers)
 4# plus the Availability, Confidentiality, Processing Integrity, and Privacy
 5# categories. A control's full code is "SOC2:<id>", matching the codes
 6# audit-report rulesets cite.
 7#
 8# COPYRIGHT: The Trust Services Criteria are copyright AICPA. The `title` fields
 9# below are our own short-form paraphrases used as labels — not the normative
10# criteria text. Only the criterion identifiers (e.g. CC6.1) are reproduced. For
11# the authoritative wording and points of focus, consult the AICPA TSC. These
12# control-to-signal mappings are the maintainers' interpretation and are not
13# reviewed or endorsed by the AICPA. See ../../MAPPING.md.
14framework: SOC2
15name: SOC 2 (Trust Services Criteria)
16version: "2017 (rev. 2022)"
17coverage: complete
18source: AICPA Trust Services Criteria (identifiers only; titles paraphrased)
19controls:
20  # CC1 — Control Environment
21  - {id: CC1.1, family: Control Environment, title: "Commitment to integrity and ethical values"}
22  - {id: CC1.2, family: Control Environment, title: "Board independence and internal-control oversight"}
23  - {id: CC1.3, family: Control Environment, title: "Structures, reporting lines, and authorities established"}
24  - {id: CC1.4, family: Control Environment, title: "Commitment to attracting and retaining competent people"}
25  - {id: CC1.5, family: Control Environment, title: "Accountability for internal-control responsibilities"}
26  # CC2 — Communication and Information
27  - {id: CC2.1, family: Communication and Information, title: "Relevant, quality information supporting internal control"}
28  - {id: CC2.2, family: Communication and Information, title: "Internal communication of control objectives and duties"}
29  - {id: CC2.3, family: Communication and Information, title: "External communication on internal-control matters"}
30  # CC3 — Risk Assessment
31  - {id: CC3.1, family: Risk Assessment, title: "Objectives specified clearly enough to identify risk"}
32  - {id: CC3.2, family: Risk Assessment, title: "Identification and analysis of risks to objectives"}
33  - {id: CC3.3, family: Risk Assessment, title: "Fraud potential considered in risk assessment"}
34  - {id: CC3.4, family: Risk Assessment, title: "Assessment of changes affecting internal control"}
35  # CC4 — Monitoring Activities
36  - {id: CC4.1, family: Monitoring Activities, title: "Ongoing and separate evaluations of internal control"}
37  - {id: CC4.2, family: Monitoring Activities, title: "Timely evaluation and reporting of control deficiencies"}
38  # CC5 — Control Activities
39  - {id: CC5.1, family: Control Activities, title: "Control activities selected to mitigate risk"}
40  - {id: CC5.2, family: Control Activities, title: "General technology controls developed"}
41  - {id: CC5.3, family: Control Activities, title: "Control activities deployed via policies and procedures"}
42  # CC6 — Logical and Physical Access Controls
43  - {id: CC6.1, family: Logical and Physical Access Controls, title: "Logical access security over protected assets"}
44  - {id: CC6.2, family: Logical and Physical Access Controls, title: "User registration, authorization, and deprovisioning"}
45  - {id: CC6.3, family: Logical and Physical Access Controls, title: "Role- and least-privilege-based access management"}
46  - {id: CC6.4, family: Logical and Physical Access Controls, title: "Physical access restricted to facilities and assets"}
47  - {id: CC6.5, family: Logical and Physical Access Controls, title: "Protections removed only after data made unreadable"}
48  - {id: CC6.6, family: Logical and Physical Access Controls, title: "Perimeter defenses against external threats"}
49  - {id: CC6.7, family: Logical and Physical Access Controls, title: "Restricted transmission and removal of information"}
50  - {id: CC6.8, family: Logical and Physical Access Controls, title: "Prevention and detection of unauthorized software"}
51  # CC7 — System Operations
52  - {id: CC7.1, family: System Operations, title: "Detection of configuration changes and vulnerabilities"}
53  - {id: CC7.2, family: System Operations, title: "Monitoring for anomalies indicating malicious acts"}
54  - {id: CC7.3, family: System Operations, title: "Evaluation of security events against objectives"}
55  - {id: CC7.4, family: System Operations, title: "Defined security-incident response program"}
56  - {id: CC7.5, family: System Operations, title: "Recovery from security incidents"}
57  # CC8 — Change Management
58  - {id: CC8.1, family: Change Management, title: "Change management across infrastructure, data, and software"}
59  # CC9 — Risk Mitigation
60  - {id: CC9.1, family: Risk Mitigation, title: "Risk-mitigation activities for business disruptions"}
61  - {id: CC9.2, family: Risk Mitigation, title: "Vendor and business-partner risk management"}
62  # Availability category
63  - {id: A1.1, family: Availability, title: "Processing-capacity monitoring against demand"}
64  - {id: A1.2, family: Availability, title: "Environmental protections, backup, and recovery infrastructure"}
65  - {id: A1.3, family: Availability, title: "Recovery-plan testing"}
66  # Confidentiality category
67  - {id: C1.1, family: Confidentiality, title: "Identification and safeguarding of confidential information"}
68  - {id: C1.2, family: Confidentiality, title: "Disposal of confidential information"}
69  # Processing Integrity category
70  - {id: PI1.1, family: Processing Integrity, title: "Quality information about processing objectives and specs"}
71  - {id: PI1.2, family: Processing Integrity, title: "Input controls for completeness and accuracy"}
72  - {id: PI1.3, family: Processing Integrity, title: "Processing controls producing objective-meeting output"}
73  - {id: PI1.4, family: Processing Integrity, title: "Output delivered completely, accurately, and on time"}
74  - {id: PI1.5, family: Processing Integrity, title: "Storage of inputs, work in process, and outputs"}
75  # Privacy category
76  - {id: P1.1, family: Privacy, title: "Notice of privacy practices to data subjects"}
77  - {id: P2.1, family: Privacy, title: "Choice and consent over personal-information handling"}
78  - {id: P3.1, family: Privacy, title: "Collection consistent with privacy objectives"}
79  - {id: P3.2, family: Privacy, title: "Explicit consent obtained before collection where required"}
80  - {id: P4.1, family: Privacy, title: "Use of personal information limited to stated purposes"}
81  - {id: P4.2, family: Privacy, title: "Retention of personal information per objectives"}
82  - {id: P4.3, family: Privacy, title: "Secure disposal of personal information"}
83  - {id: P5.1, family: Privacy, title: "Data-subject access to their personal information"}
84  - {id: P5.2, family: Privacy, title: "Correction and amendment of personal information"}
85  - {id: P6.1, family: Privacy, title: "Third-party disclosure only with consent"}
86  - {id: P6.2, family: Privacy, title: "Record of authorized disclosures"}
87  - {id: P6.3, family: Privacy, title: "Record of unauthorized disclosures"}
88  - {id: P6.4, family: Privacy, title: "Privacy commitments obtained from vendors and third parties"}
89  - {id: P6.5, family: Privacy, title: "Vendor commitments to notify of unauthorized disclosure"}
90  - {id: P6.6, family: Privacy, title: "Breach notification to affected parties and regulators"}
91  - {id: P6.7, family: Privacy, title: "Accounting of personal information and disclosures on request"}
92  - {id: P7.1, family: Privacy, title: "Accuracy and currency of personal information"}
93  - {id: P8.1, family: Privacy, title: "Handling of privacy inquiries, complaints, and disputes"}