SOC 2 Trust Service Criteria Checklist

The entity internally communicates information, including objectives and responsibilities, necessary to support the functioning of internal controls.

The entity communicates with external parties regarding matters affecting the functioning of internal controls.

The entity identifies risks to the achievement of its objectives across the entity and analyses risks as a basis for determining how the risks should be managed.

The entity considers the potential for fraud in assessing risks to the achievement of objectives.

The entity identifies and assesses changes that could significantly impact the system of internal controls.

The entity evaluates and communicates internal control deficiencies in a timely manner to parties responsible for taking corrective action.

The entity selects and develops general control activities over technology to support the achievement of objectives.

The entity deploys control activities through policies that establish what is expected and in procedures that put policies into action.

Prior to issuing credentials to access information assets, the entity registers and authorises new internal users.

The entity removes access to information assets when access is no longer required.

The entity restricts physical access to facilities and protected information assets.

The entity discontinues logical and physical protections over physical assets only after the ability to read or recover information from those assets has been diminished.

The entity implements controls to prevent or detect and act upon the introduction of unauthorised or malicious software.

The entity restricts the transmission, movement, and removal of information to authorised internal and external users and processes.

The entity implements controls to prevent or detect and act upon the introduction of unauthorised or malicious software.

The entity monitors system components and the operation of those components for anomalies.

The entity evaluates security events to determine whether they could or have resulted in a failure of the entity to meet its objectives.

The entity responds to identified security incidents by executing a defined incident response programme.

The entity identifies, develops, and implements activities to recover from identified security incidents.

The entity assesses and manages risks associated with vendors and business partners.

The entity authorises, designs, develops/acquires, implements, operates, approves, maintains, and monitors environmental protections, software, data back-up processes, and recovery infrastructure.

The entity tests recovery plan procedures supporting system availability to meet its objectives.

The entity disposes of confidential information to meet the entity's objectives related to confidentiality.

The entity implements policies and procedures over system inputs, including controls over completeness and accuracy, to result in products, services, and reporting to meet the entity's objectives.

The entity implements policies and procedures over system processing to result in products, services, and reporting to meet the entity's objectives.

The entity implements policies and procedures to make available or deliver output completely, accurately, and timely in accordance with specifications to meet the entity's objectives.

The entity implements policies and procedures to store inputs, items in processing, and outputs completely, accurately, and timely in accordance with system specifications to meet the entity's objectives.

The entity communicates choices available regarding the collection, use, retention, disclosure, and disposal of personal information and obtains implicit or explicit consent.

Personal information is collected consistent with the entity's objectives related to privacy.

The entity limits the use of personal information to the purposes identified in the notice and for which the individual has provided implicit or explicit consent, and retains and disposes of it consistent with the entity's objectives related to privacy.

The entity grants identified and authenticated data subjects the ability to access their personal information for review and, upon request, correction or deletion.

The entity discloses personal information to third parties only for the purposes identified in the notice and with implicit or explicit consent, and notifies data subjects of unauthorised disclosures or breaches.

The entity collects and maintains accurate, up-to-date, complete, and relevant personal information to meet the entity's objectives related to privacy.

The entity implements a process for receiving, addressing, resolving, and communicating the resolution of inquiries, complaints, and disputes, and periodically monitors compliance with its privacy policies.