PKxl/_rels/workbook.xml.rels PK0kxl/theme/theme1.xml PKUZZ xl/styles.xml PK?~~xl/worksheets/sheet1.xml Control CodeCriterionTrust Services CategoryControl Requirement (Plain English)Auditor Evidence RequiredImplementation Guidance / Why Auditors AskPriority WeightImplementation StatusInternal OwnerAudit Notes & Reference LinksCC1.1Security (Common Criteria)CC1: Control EnvironmentAre information security policies documented, approved by leadership, and communicated to all personnel?Information security policy document; leadership approval record; evidence of communication (e.g. onboarding pack, intranet post)Auditors start here: without written, approved policies, every other control lacks authority. This is the most common Day-1 gap.Critical (Weight 3)Not StartedCC1.2Security (Common Criteria)CC1: Control EnvironmentAre security roles and responsibilities formally assigned (e.g. a named security owner)?RACI or role description naming the security owner; org chartSomeone must own security decisions. In small teams this can be the CTO wearing a second hat — but it must be written down.Medium (Weight 2)Not StartedCC1.3Security (Common Criteria)CC1: Control EnvironmentIs there a formal joiner/mover/leaver process covering access provisioning and revocation?Joiner/mover/leaver procedure; sample of recent joiners/leavers with access grant and revoke timestampsOrphaned accounts from ex-employees are one of the top audit findings. Auditors sample leavers and check deprovisioning dates.Critical (Weight 3)Not StartedCC2.1Security (Common Criteria)CC2: Communication & InformationAre security responsibilities communicated to employees at onboarding and at least annually?Security awareness training records; onboarding checklist showing the security briefingPolicies nobody has read don't count. Auditors look for training records, not good intentions.Medium (Weight 2)Not StartedCC2.2Security (Common Criteria)CC2: Communication & InformationIs there a defined channel for reporting security concerns, known to all staff?Published reporting channel; internal comms referencing itA reporting channel (even a monitored inbox) shows the control environment is alive, not just documented.Low (Weight 1)Not StartedCC3.1Security (Common Criteria)CC3: Risk AssessmentHas a formal risk assessment been performed in the last 12 months, identifying threats to the system?Risk assessment report dated within the last 12 months; risk registerThe risk assessment drives everything else — auditors expect it to be recent, documented, and actually used to choose controls.Critical (Weight 3)Not StartedCC3.2Security (Common Criteria)CC3: Risk AssessmentAre identified risks rated, assigned owners, and tracked to remediation?Risk register with ratings, owners, and status updatesA risk list with no ratings, owners, or follow-up is decoration. Auditors check that significant risks have treatment plans.Medium (Weight 2)Not StartedCC4.1Security (Common Criteria)CC4: Monitoring ActivitiesAre key controls monitored on an ongoing basis (automated checks, alerts, or scheduled reviews)?Monitoring dashboards or alert rules; review logs showing the cadencePoint-in-time controls fail Type 2. Auditors want evidence that controls operated across the whole review period.Medium (Weight 2)Not StartedCC4.2Security (Common Criteria)CC4: Monitoring ActivitiesAre control deficiencies and exceptions logged, tracked, and remediated within defined timeframes?Exception/deficiency log with remediation datesFinding gaps is expected; ignoring them is not. Auditors sample exceptions to see the remediation trail.Medium (Weight 2)Not StartedCC5.1Security (Common Criteria)CC5: Control ActivitiesDo documented procedures exist for the key security control activities (not just policies, but how-tos)?Standard operating procedures for access provisioning, incident handling, and change deploymentPolicies say what; procedures say how. Auditors test whether staff actually follow the documented steps.Medium (Weight 2)Not StartedCC6.1Security (Common Criteria)CC6: Logical & Physical AccessIs logical access to production restricted to authorized personnel with unique credentials and least-privilege roles?Access control policy; IAM role definitions; list of production access holdersThe single most-tested control family. Shared accounts and standing admin access are instant findings.Critical (Weight 3)Not StartedCC6.2Security (Common Criteria)CC6: Logical & Physical AccessIs multi-factor authentication enforced for remote access, admin consoles, and production systems?IdP MFA enforcement policy; report showing MFA coverage across usersMFA gaps are among the most common failures. Auditors verify enforcement, not just availability.Critical (Weight 3)Not StartedCC6.3Security (Common Criteria)CC6: Logical & Physical AccessAre user access rights reviewed periodically (at least quarterly) by system or asset owners?Quarterly access review records with reviewer sign-off and resulting access changesAccess reviews with no evidence didn't happen. Auditors ask for the review records and follow up on revocations.Critical (Weight 3)Not StartedCC6.4Security (Common Criteria)CC6: Logical & Physical AccessAre credentials managed securely — no shared accounts, no secrets or keys in code repositories?Secrets management tool in use; repository scan results; no-shared-accounts attestationSecrets in git history are a classic startup finding. Auditors run scans or ask for your secret-management story.Critical (Weight 3)Not StartedCC6.5Security (Common Criteria)CC6: Logical & Physical AccessIs access revoked promptly when people leave or change roles (within 24 hours for privileged access)?Deprovisioning tickets or logs matched to HR termination datesAuditors sample terminated employees and compare last working day against the deprovisioning timestamp.Critical (Weight 3)Not StartedCC7.1Security (Common Criteria)CC7: System Operations & IncidentsAre production systems monitored for security events, with alerts on anomalies?SIEM or monitoring configuration; sample alerts with documented responsesLogging without alerting is archiving. Auditors check that someone actually looks at the signals.Medium (Weight 2)Not StartedCC7.2Security (Common Criteria)CC7: System Operations & IncidentsIs there a documented incident response plan, tested (tabletop or live) in the last 12 months?Incident response plan; tabletop exercise notes with date and attendees; resulting action itemsAn untested incident response plan is a draft. Auditors want the test record and any lessons-learned actions.Critical (Weight 3)Not StartedCC7.3Security (Common Criteria)CC7: System Operations & IncidentsAre backups performed on schedule and restoration tested at least annually?Backup schedule; restore test report with date and resultUntested backups are Schrodinger's backups. Auditors ask for the restore test evidence.Medium (Weight 2)Not StartedCC8.1Security (Common Criteria)CC8: Change ManagementDo production changes follow a formal process — approval, testing, and a rollback plan?Change tickets showing approval and testing; rollback recordsPaper-only change management is a top-five finding. Auditors sample recent deploys for approval and test evidence.Critical (Weight 3)Not StartedCC8.2Security (Common Criteria)CC8: Change ManagementAre production deployments separated from development (no direct edits to production)?CI/CD pipeline configuration; branch protection rules; evidence of no direct production accessDirect production edits bypass every other control. Pipelines with branch protection are the expected pattern.Medium (Weight 2)Not StartedCC9.1Security (Common Criteria)CC9: Risk Mitigation & Vendor RiskAre new vendors and subservice organizations assessed for security risk before onboarding?Vendor risk assessment procedure; completed assessments for critical vendorsYour auditors inherit your vendors' risk. Having no vendor assessment process is a common startup gap.Critical (Weight 3)Not StartedCC9.2Security (Common Criteria)CC9: Risk Mitigation & Vendor RiskAre SOC 2 reports (or equivalent assurance) collected and reviewed annually for critical vendors?Vendor SOC 2 reports on file; review notes and follow-up on any qualificationsFor subservice organizations in your audit boundary, auditors expect you to monitor their controls — usually via their SOC 2 report.Medium (Weight 2)Not StartedA1.1AvailabilityA1: Availability & Disaster RecoveryAre availability commitments (uptime SLA or targets) defined and communicated to customers?SLA wording in customer contracts or terms; status page showing targetsYou can't be audited against commitments you never made. SLAs usually live in contracts or on a status page.Low (Weight 1)Not StartedA1.2AvailabilityA1: Availability & Disaster RecoveryIs production infrastructure designed for resilience (redundancy, failover, multi-zone)?Architecture diagram showing redundancy; failover test recordsSingle points of failure undermine availability claims. Auditors ask for the architecture story.Medium (Weight 2)Not StartedA1.3AvailabilityA1: Availability & Disaster RecoveryAre recovery objectives (RTO/RPO) defined and supported by backup and restore capabilities?Defined RTO/RPO; restore tests demonstrating they are metRTO/RPO turn 'we have backups' into measurable commitments auditors can test.Medium (Weight 2)Not StartedA1.4AvailabilityA1: Availability & Disaster RecoveryIs there a documented disaster recovery / business continuity plan, tested in the last 12 months?DR/business continuity plan; test report with date, scope, and resultsSame bar as incident response: documented and tested, or it doesn't count.Critical (Weight 3)Not StartedA1.5AvailabilityA1: Availability & Disaster RecoveryIs capacity monitored with alerting to prevent availability incidents?Capacity monitoring dashboards; alert thresholdsRunning out of disk or compute is an avoidable outage. Auditors like to see proactive monitoring.Low (Weight 1)Not StartedA1.6AvailabilityA1: Availability & Disaster RecoveryAre availability incidents tracked, with post-incident reviews for significant outages?Incident log; post-mortem reports for major incidentsRepeat outages without learning are a control failure. Auditors sample incident records.Medium (Weight 2)Not StartedPI1.1Processing IntegrityPI1: Processing Integrity & Data ValidationAre system inputs validated for completeness and accuracy before processing?Input validation rules; error and rejection logsGarbage in, garbage out — auditors check that input controls exist for material processing.Medium (Weight 2)Not StartedPI1.2Processing IntegrityPI1: Processing Integrity & Data ValidationAre processing errors logged, investigated, and corrected within defined timeframes?Error logs with investigation and resolution recordsError handling is where integrity controls prove themselves under stress.Medium (Weight 2)Not StartedPI1.3Processing IntegrityPI1: Processing Integrity & Data ValidationAre system outputs reconciled or validated against expected results?Reconciliation procedures and completed reconciliationsReconciliations catch what input validation misses. Expected for financial or customer-facing outputs.Medium (Weight 2)Not StartedPI1.4Processing IntegrityPI1: Processing Integrity & Data ValidationIs data retained and disposed of according to a defined retention schedule?Data retention policy; disposal/deletion logsKeeping everything forever is both a privacy and an integrity risk.Low (Weight 1)Not StartedPI1.5Processing IntegrityPI1: Processing Integrity & Data ValidationAre processing specifications documented, with changes to processing logic formally controlled?Processing specifications; change records for logic changesUndocumented processing logic can't be audited. Changes need the same rigor as code deploys.Medium (Weight 2)Not StartedPI1.6Processing IntegrityPI1: Processing Integrity & Data ValidationIs data protected against unauthorized modification during processing and transmission?Encryption in transit (TLS); integrity checks; transmission controlsIntegrity means data nobody was supposed to touch stays untouched — checksums, signed payloads, TLS.Medium (Weight 2)Not StartedC1.1ConfidentialityC1: Confidentiality & Data ClassificationIs confidential information identified and classified (what counts as confidential)?Data classification policy with defined categoriesYou can't protect what you haven't defined. Classification usually starts with customer data and credentials.Medium (Weight 2)Not StartedC1.2ConfidentialityC1: Confidentiality & Data ClassificationIs confidential data encrypted at rest and in transit?Encryption standards; at-rest encryption evidence; TLS configurationEncryption is the baseline expectation; auditors verify it, not just the claim.Critical (Weight 3)Not StartedC1.3ConfidentialityC1: Confidentiality & Data ClassificationAre confidentiality / NDA agreements in place with employees, contractors, and relevant third parties?Signed NDAs / confidentiality clauses; contractor agreementsThe legal layer of the control — auditors sample agreements.Medium (Weight 2)Not StartedC1.4ConfidentialityC1: Confidentiality & Data ClassificationIs access to confidential information restricted on a need-to-know basis?Access matrices for confidential data stores; justification recordsOverlaps with logical access but scoped to data: who can see customer data, and why them?Medium (Weight 2)Not StartedC1.5ConfidentialityC1: Confidentiality & Data ClassificationAre there procedures for secure disposal of confidential information (media, documents, devices)?Disposal procedure; device wipe/destruction certificatesDecommissioned laptops and old backups are classic leakage points.Low (Weight 1)Not StartedC1.6ConfidentialityC1: Confidentiality & Data ClassificationAre confidentiality commitments to customers documented and monitored for compliance?Contract confidentiality clauses; monitoring/compliance recordsIf your contracts promise confidentiality, auditors check you keep the promise.Medium (Weight 2)Not StartedP1.1PrivacyP1: Privacy Notice & PolicyIs there a published privacy notice describing what personal data is collected and why?Published privacy notice; version historyNotice is the foundation of every privacy criterion. Auditors read it first.Medium (Weight 2)Not StartedP2.1PrivacyP2: Choice & ConsentIs a lawful basis (consent or equivalent) established before collecting personal data?Consent records or lawful-basis registerCollect first, justify later fails. The basis must be documented per data type.Medium (Weight 2)Not StartedP3.1PrivacyP3: Collection LimitationIs collection limited to personal data necessary for the stated purpose (data minimization)?Data inventory showing the purpose per data elementHoarding personal data 'just in case' is a finding. Auditors ask why each field is collected.Medium (Weight 2)Not StartedP4.1PrivacyP4: Use, Retention & DisposalIs personal data retained only as long as necessary, then securely deleted?Retention schedule; deletion logsRetention schedules must exist and be followed — auditors sample deleted-vs-retained records.Medium (Weight 2)Not StartedP5.1PrivacyP5: Access & CorrectionCan individuals access, correct, or delete their personal data on request, within defined timelines?Data-subject-request procedure; log of requests with response timesData subject rights need a working process, not a policy paragraph. Auditors test it.Critical (Weight 3)Not StartedP6.1PrivacyP6: Disclosure to Third PartiesIs personal data shared with third parties only with proper basis, with records of disclosures?Data processing agreements with subprocessors; disclosure registerSubprocessors and data sharing need contracts (DPAs) and a disclosure register.Medium (Weight 2)Not StartedP8.1PrivacyP8: Monitoring & EnforcementAre privacy incidents (breaches) identified, risk-assessed, and notified per policy and legal deadlines?Breach response procedure; incident log; notification templatesBreach notification has legal clocks (e.g. 72 hours under GDPR). Auditors check the process exists before it's needed.Critical (Weight 3)Not StartedPK`xl/metadata.xml PK{XXxl/workbook.xml PKJjLL _rels/.rels PKRHHdocProps/app.xml SheetJSWorksheets1SOC 2 Complete Controls ListPK֒|ZZdocProps/core.xml PKj[Content_Types].xml PKxl/_rels/workbook.xml.relsPK0kxl/theme/theme1.xmlPKUZZ xl/styles.xmlPK?~~%xl/worksheets/sheet1.xmlPK`xl/metadata.xmlPK{XX?xl/workbook.xmlPKJjLL ĩ_rels/.relsPKRHH9docProps/app.xmlPK֒|ZZdocProps/core.xmlPKj8[Content_Types].xmlPK {~