# SOC 2 C1.1 — Confidential Information Identification and Maintenance

- Source: https://support.icompaas.com/support/solutions/articles/a_gen_soc2_c11_198fc0c37a-soc-2-c11-confidential-information-identification-and-maintenance
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [SOC2 Readiness](https://support.icompaas.com/support/solutions/62000111733) › [Confidentiality](https://support.icompaas.com/support/solutions/folders/f_gen_62000111733_confidentiality)
- Last updated: 2026-05-30
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

SOC 2 · Control C1.1 · Priority: high · Component: Confidentiality

### What this control covers

The entity identifies and maintains confidential information to meet the entity's objectives related to confidentiality.

### Why it matters

Risk is the language an executive team understands; this control connects technical reality to board-level decisions and budget allocation.

### How to implement

#### AWS

Codify the policy intent as **SCPs, AWS Config conformance packs, and Security Hub standards** so the cloud enforces what the document says.

#### Azure

Codify in **Azure Policy initiatives** (built-in regulatory compliance for CIS, ISO 27001, SOC 2, HIPAA) and assign at management-group level.

#### On-premises

Maintain a policy library with a documented review cadence (annual minimum); store in your GRC tool with attestation tracking. Map each policy to controls so an audit pull cites the exact policy clause.

### Evidence to collect

-   `policy_document` — A signed, version-controlled policy stating leadership intent and the named owner.

Signed policy or standard documents the safeguard. Focus: Confidential Information Identification and Maintenance (Original component: Confidentiality).

### Quick checklist

-   Information — Objectives / Identification
-   Risk — Objectives / Identification
-   Management — Objectives / Identification
-   Confidential — Objectives / Identification

### Related articles on this site

-   [NIST 800-171 3.2.2 Ensure that personnel are trained to carry out their assigned information security-related duties and responsibilities.](https://support.icompaas.com/support/solutions/articles/62000229266-nist-800-171-3-2-2-ensure-that-personnel-are-trained-to-carry-out-their-assigned-information-security)
-   [CMMC 2.0 AT.2.057 Ensure that personnel are trained to carry out their assigned information security-related duties and responsibilities.](https://support.icompaas.com/support/solutions/articles/62000229423-cmmc-2-0-at-2-057-ensure-that-personnel-are-trained-to-carry-out-their-assigned-information-security-)
-   [HIPAA 164.308(a)(4)(i) Information Access Management](https://support.icompaas.com/support/solutions/articles/62000230524-hipaa-164-308-a-4-i-information-access-management)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): The full SOC 2 implementation guide: scoping the Trust Services Criteria, the roadmap to a Type 2 report, and what the auditor samples.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): Teams that finish SOC 2 usually add ISO 27001 next; the control overlap is large and the guide explains what is genuinely extra.