Control Code,Criterion,Trust Services Category,Control Requirement (Plain English),Auditor Evidence Required,Implementation Guidance / Why Auditors Ask,Priority Weight,Implementation Status,Internal Owner,Audit Notes & Reference Links
CC1.1,Security (Common Criteria),CC1: Control Environment,"Are information security policies documented, approved by leadership, and communicated to all personnel?","Information security policy document; leadership approval record; evidence of communication (e.g. onboarding pack, intranet post)","Auditors start here: without written, approved policies, every other control lacks authority. This is the most common Day-1 gap.",Critical (Weight 3),Not Started,,
CC1.2,Security (Common Criteria),CC1: Control Environment,Are security roles and responsibilities formally assigned (e.g. a named security owner)?,RACI or role description naming the security owner; org chart,Someone must own security decisions. In small teams this can be the CTO wearing a second hat — but it must be written down.,Medium (Weight 2),Not Started,,
CC1.3,Security (Common Criteria),CC1: Control Environment,Is there a formal joiner/mover/leaver process covering access provisioning and revocation?,Joiner/mover/leaver procedure; sample of recent joiners/leavers with access grant and revoke timestamps,Orphaned accounts from ex-employees are one of the top audit findings. Auditors sample leavers and check deprovisioning dates.,Critical (Weight 3),Not Started,,
CC2.1,Security (Common Criteria),CC2: Communication & Information,Are security responsibilities communicated to employees at onboarding and at least annually?,Security awareness training records; onboarding checklist showing the security briefing,"Policies nobody has read don't count. Auditors look for training records, not good intentions.",Medium (Weight 2),Not Started,,
CC2.2,Security (Common Criteria),CC2: Communication & Information,"Is there a defined channel for reporting security concerns, known to all staff?",Published reporting channel; internal comms referencing it,"A reporting channel (even a monitored inbox) shows the control environment is alive, not just documented.",Low (Weight 1),Not Started,,
CC3.1,Security (Common Criteria),CC3: Risk Assessment,"Has a formal risk assessment been performed in the last 12 months, identifying threats to the system?",Risk assessment report dated within the last 12 months; risk register,"The risk assessment drives everything else — auditors expect it to be recent, documented, and actually used to choose controls.",Critical (Weight 3),Not Started,,
CC3.2,Security (Common Criteria),CC3: Risk Assessment,"Are identified risks rated, assigned owners, and tracked to remediation?","Risk register with ratings, owners, and status updates","A risk list with no ratings, owners, or follow-up is decoration. Auditors check that significant risks have treatment plans.",Medium (Weight 2),Not Started,,
CC4.1,Security (Common Criteria),CC4: Monitoring Activities,"Are key controls monitored on an ongoing basis (automated checks, alerts, or scheduled reviews)?",Monitoring dashboards or alert rules; review logs showing the cadence,Point-in-time controls fail Type 2. Auditors want evidence that controls operated across the whole review period.,Medium (Weight 2),Not Started,,
CC4.2,Security (Common Criteria),CC4: Monitoring Activities,"Are control deficiencies and exceptions logged, tracked, and remediated within defined timeframes?",Exception/deficiency log with remediation dates,Finding gaps is expected; ignoring them is not. Auditors sample exceptions to see the remediation trail.,Medium (Weight 2),Not Started,,
CC5.1,Security (Common Criteria),CC5: Control Activities,"Do documented procedures exist for the key security control activities (not just policies, but how-tos)?","Standard operating procedures for access provisioning, incident handling, and change deployment",Policies say what; procedures say how. Auditors test whether staff actually follow the documented steps.,Medium (Weight 2),Not Started,,
CC6.1,Security (Common Criteria),CC6: Logical & Physical Access,Is logical access to production restricted to authorized personnel with unique credentials and least-privilege roles?,Access control policy; IAM role definitions; list of production access holders,The single most-tested control family. Shared accounts and standing admin access are instant findings.,Critical (Weight 3),Not Started,,
CC6.2,Security (Common Criteria),CC6: Logical & Physical Access,"Is multi-factor authentication enforced for remote access, admin consoles, and production systems?",IdP MFA enforcement policy; report showing MFA coverage across users,"MFA gaps are among the most common failures. Auditors verify enforcement, not just availability.",Critical (Weight 3),Not Started,,
CC6.3,Security (Common Criteria),CC6: Logical & Physical Access,Are user access rights reviewed periodically (at least quarterly) by system or asset owners?,Quarterly access review records with reviewer sign-off and resulting access changes,Access reviews with no evidence didn't happen. Auditors ask for the review records and follow up on revocations.,Critical (Weight 3),Not Started,,
CC6.4,Security (Common Criteria),CC6: Logical & Physical Access,"Are credentials managed securely — no shared accounts, no secrets or keys in code repositories?",Secrets management tool in use; repository scan results; no-shared-accounts attestation,Secrets in git history are a classic startup finding. Auditors run scans or ask for your secret-management story.,Critical (Weight 3),Not Started,,
CC6.5,Security (Common Criteria),CC6: Logical & Physical Access,Is access revoked promptly when people leave or change roles (within 24 hours for privileged access)?,Deprovisioning tickets or logs matched to HR termination dates,Auditors sample terminated employees and compare last working day against the deprovisioning timestamp.,Critical (Weight 3),Not Started,,
CC7.1,Security (Common Criteria),CC7: System Operations & Incidents,"Are production systems monitored for security events, with alerts on anomalies?",SIEM or monitoring configuration; sample alerts with documented responses,Logging without alerting is archiving. Auditors check that someone actually looks at the signals.,Medium (Weight 2),Not Started,,
CC7.2,Security (Common Criteria),CC7: System Operations & Incidents,"Is there a documented incident response plan, tested (tabletop or live) in the last 12 months?",Incident response plan; tabletop exercise notes with date and attendees; resulting action items,An untested incident response plan is a draft. Auditors want the test record and any lessons-learned actions.,Critical (Weight 3),Not Started,,
CC7.3,Security (Common Criteria),CC7: System Operations & Incidents,Are backups performed on schedule and restoration tested at least annually?,Backup schedule; restore test report with date and result,Untested backups are Schrodinger's backups. Auditors ask for the restore test evidence.,Medium (Weight 2),Not Started,,
CC8.1,Security (Common Criteria),CC8: Change Management,"Do production changes follow a formal process — approval, testing, and a rollback plan?",Change tickets showing approval and testing; rollback records,Paper-only change management is a top-five finding. Auditors sample recent deploys for approval and test evidence.,Critical (Weight 3),Not Started,,
CC8.2,Security (Common Criteria),CC8: Change Management,Are production deployments separated from development (no direct edits to production)?,CI/CD pipeline configuration; branch protection rules; evidence of no direct production access,Direct production edits bypass every other control. Pipelines with branch protection are the expected pattern.,Medium (Weight 2),Not Started,,
CC9.1,Security (Common Criteria),CC9: Risk Mitigation & Vendor Risk,Are new vendors and subservice organizations assessed for security risk before onboarding?,Vendor risk assessment procedure; completed assessments for critical vendors,Your auditors inherit your vendors' risk. Having no vendor assessment process is a common startup gap.,Critical (Weight 3),Not Started,,
CC9.2,Security (Common Criteria),CC9: Risk Mitigation & Vendor Risk,Are SOC 2 reports (or equivalent assurance) collected and reviewed annually for critical vendors?,Vendor SOC 2 reports on file; review notes and follow-up on any qualifications,"For subservice organizations in your audit boundary, auditors expect you to monitor their controls — usually via their SOC 2 report.",Medium (Weight 2),Not Started,,
A1.1,Availability,A1: Availability & Disaster Recovery,Are availability commitments (uptime SLA or targets) defined and communicated to customers?,SLA wording in customer contracts or terms; status page showing targets,You can't be audited against commitments you never made. SLAs usually live in contracts or on a status page.,Low (Weight 1),Not Started,,
A1.2,Availability,A1: Availability & Disaster Recovery,"Is production infrastructure designed for resilience (redundancy, failover, multi-zone)?",Architecture diagram showing redundancy; failover test records,Single points of failure undermine availability claims. Auditors ask for the architecture story.,Medium (Weight 2),Not Started,,
A1.3,Availability,A1: Availability & Disaster Recovery,Are recovery objectives (RTO/RPO) defined and supported by backup and restore capabilities?,Defined RTO/RPO; restore tests demonstrating they are met,RTO/RPO turn 'we have backups' into measurable commitments auditors can test.,Medium (Weight 2),Not Started,,
A1.4,Availability,A1: Availability & Disaster Recovery,"Is there a documented disaster recovery / business continuity plan, tested in the last 12 months?","DR/business continuity plan; test report with date, scope, and results","Same bar as incident response: documented and tested, or it doesn't count.",Critical (Weight 3),Not Started,,
A1.5,Availability,A1: Availability & Disaster Recovery,Is capacity monitored with alerting to prevent availability incidents?,Capacity monitoring dashboards; alert thresholds,Running out of disk or compute is an avoidable outage. Auditors like to see proactive monitoring.,Low (Weight 1),Not Started,,
A1.6,Availability,A1: Availability & Disaster Recovery,"Are availability incidents tracked, with post-incident reviews for significant outages?",Incident log; post-mortem reports for major incidents,Repeat outages without learning are a control failure. Auditors sample incident records.,Medium (Weight 2),Not Started,,
PI1.1,Processing Integrity,PI1: Processing Integrity & Data Validation,Are system inputs validated for completeness and accuracy before processing?,Input validation rules; error and rejection logs,"Garbage in, garbage out — auditors check that input controls exist for material processing.",Medium (Weight 2),Not Started,,
PI1.2,Processing Integrity,PI1: Processing Integrity & Data Validation,"Are processing errors logged, investigated, and corrected within defined timeframes?",Error logs with investigation and resolution records,Error handling is where integrity controls prove themselves under stress.,Medium (Weight 2),Not Started,,
PI1.3,Processing Integrity,PI1: Processing Integrity & Data Validation,Are system outputs reconciled or validated against expected results?,Reconciliation procedures and completed reconciliations,Reconciliations catch what input validation misses. Expected for financial or customer-facing outputs.,Medium (Weight 2),Not Started,,
PI1.4,Processing Integrity,PI1: Processing Integrity & Data Validation,Is data retained and disposed of according to a defined retention schedule?,Data retention policy; disposal/deletion logs,Keeping everything forever is both a privacy and an integrity risk.,Low (Weight 1),Not Started,,
PI1.5,Processing Integrity,PI1: Processing Integrity & Data Validation,"Are processing specifications documented, with changes to processing logic formally controlled?",Processing specifications; change records for logic changes,Undocumented processing logic can't be audited. Changes need the same rigor as code deploys.,Medium (Weight 2),Not Started,,
PI1.6,Processing Integrity,PI1: Processing Integrity & Data Validation,Is data protected against unauthorized modification during processing and transmission?,Encryption in transit (TLS); integrity checks; transmission controls,"Integrity means data nobody was supposed to touch stays untouched — checksums, signed payloads, TLS.",Medium (Weight 2),Not Started,,
C1.1,Confidentiality,C1: Confidentiality & Data Classification,Is confidential information identified and classified (what counts as confidential)?,Data classification policy with defined categories,You can't protect what you haven't defined. Classification usually starts with customer data and credentials.,Medium (Weight 2),Not Started,,
C1.2,Confidentiality,C1: Confidentiality & Data Classification,Is confidential data encrypted at rest and in transit?,Encryption standards; at-rest encryption evidence; TLS configuration,"Encryption is the baseline expectation; auditors verify it, not just the claim.",Critical (Weight 3),Not Started,,
C1.3,Confidentiality,C1: Confidentiality & Data Classification,"Are confidentiality / NDA agreements in place with employees, contractors, and relevant third parties?",Signed NDAs / confidentiality clauses; contractor agreements,The legal layer of the control — auditors sample agreements.,Medium (Weight 2),Not Started,,
C1.4,Confidentiality,C1: Confidentiality & Data Classification,Is access to confidential information restricted on a need-to-know basis?,Access matrices for confidential data stores; justification records,"Overlaps with logical access but scoped to data: who can see customer data, and why them?",Medium (Weight 2),Not Started,,
C1.5,Confidentiality,C1: Confidentiality & Data Classification,"Are there procedures for secure disposal of confidential information (media, documents, devices)?",Disposal procedure; device wipe/destruction certificates,Decommissioned laptops and old backups are classic leakage points.,Low (Weight 1),Not Started,,
C1.6,Confidentiality,C1: Confidentiality & Data Classification,Are confidentiality commitments to customers documented and monitored for compliance?,Contract confidentiality clauses; monitoring/compliance records,"If your contracts promise confidentiality, auditors check you keep the promise.",Medium (Weight 2),Not Started,,
P1.1,Privacy,P1: Privacy Notice & Policy,Is there a published privacy notice describing what personal data is collected and why?,Published privacy notice; version history,Notice is the foundation of every privacy criterion. Auditors read it first.,Medium (Weight 2),Not Started,,
P2.1,Privacy,P2: Choice & Consent,Is a lawful basis (consent or equivalent) established before collecting personal data?,Consent records or lawful-basis register,"Collect first, justify later fails. The basis must be documented per data type.",Medium (Weight 2),Not Started,,
P3.1,Privacy,P3: Collection Limitation,Is collection limited to personal data necessary for the stated purpose (data minimization)?,Data inventory showing the purpose per data element,Hoarding personal data 'just in case' is a finding. Auditors ask why each field is collected.,Medium (Weight 2),Not Started,,
P4.1,Privacy,"P4: Use, Retention & Disposal","Is personal data retained only as long as necessary, then securely deleted?",Retention schedule; deletion logs,Retention schedules must exist and be followed — auditors sample deleted-vs-retained records.,Medium (Weight 2),Not Started,,
P5.1,Privacy,P5: Access & Correction,"Can individuals access, correct, or delete their personal data on request, within defined timelines?",Data-subject-request procedure; log of requests with response times,"Data subject rights need a working process, not a policy paragraph. Auditors test it.",Critical (Weight 3),Not Started,,
P6.1,Privacy,P6: Disclosure to Third Parties,"Is personal data shared with third parties only with proper basis, with records of disclosures?",Data processing agreements with subprocessors; disclosure register,Subprocessors and data sharing need contracts (DPAs) and a disclosure register.,Medium (Weight 2),Not Started,,
P8.1,Privacy,P8: Monitoring & Enforcement,"Are privacy incidents (breaches) identified, risk-assessed, and notified per policy and legal deadlines?",Breach response procedure; incident log; notification templates,Breach notification has legal clocks (e.g. 72 hours under GDPR). Auditors check the process exists before it's needed.,Critical (Weight 3),Not Started,,