SOC 2 Trust Services Criteria (2017, with 2022 points of focus)

SOC 2 Trust Services Criteria (2017, with 2022 points of focus)

• SOC 2 (2017 TSC) CC6.1 — Logical Access Controls
• SOC 2 (2017 TSC) CC6.2 — Access Provisioning
• SOC 2 (2017 TSC) CC6.3 — Access Modification
• SOC 2 (2017 TSC) CC6.4 — Physical Access Controls
• SOC 2 (2017 TSC) CC6.5 — Asset Disposal

SOC 2 Trust Services Criteria (2017, with 2022 points of focus)

• SOC 2 (2017 TSC) P6.1 — Third-Party Disclosure with Data Subject Consent
• SOC 2 (2017 TSC) P6.2 — Recordkeeping of Authorized Personal Information Disclosures
• SOC 2 (2017 TSC) P6.3 — Logging and Retention of Unauthorized Disclosure Incidents
• SOC 2 (2017 TSC) P6.4 — Third-Party Privacy Commitments
• SOC 2 (2017 TSC) P6.5 — Third-Party Breach Notification Commitments

SOC 2 Trust Services Criteria (2017, with 2022 points of focus)

• SOC 2 (2017 TSC) CC1.1 — Commitment to Integrity and Ethical Values
• SOC 2 (2017 TSC) CC1.2 — Board Independence and Oversight
• SOC 2 (2017 TSC) CC1.3 — Organizational Structure and Reporting Lines
• SOC 2 (2017 TSC) CC1.4 — Competence and Training
• SOC 2 (2017 TSC) CC1.5 — Accountability for Internal Control Responsibilities

SOC 2 Trust Services Criteria (2017, with 2022 points of focus)

• SOC 2 (2017 TSC) CC7.1 — Change Detection
• SOC 2 (2017 TSC) CC7.2 — Anomaly Detection
• SOC 2 (2017 TSC) CC7.3 — Incident Detection
• SOC 2 (2017 TSC) CC7.4 — Incident Response
• SOC 2 (2017 TSC) CC7.5 — Security Incident Recovery Activities

SOC 2 Trust Services Criteria (2017, with 2022 points of focus)

• SOC 2 (2017 TSC) PI1.1 — Processing Objectives & Information
• SOC 2 (2017 TSC) PI1.2 — Input Controls
• SOC 2 (2017 TSC) PI1.3 — Processing Controls
• SOC 2 (2017 TSC) PI1.4 — Output Controls
• SOC 2 (2017 TSC) PI1.5 — Storage Controls

SOC 2 Trust Services Criteria (2017, with 2022 points of focus)

• SOC 2 (2017 TSC) CC3.1 — Objective Setting
• SOC 2 (2017 TSC) CC3.2 — Risk Identification
• SOC 2 (2017 TSC) CC3.3 — Fraud Risk Assessment
• SOC 2 (2017 TSC) CC3.4 — Change Identification

SOC 2 Trust Services Criteria (2017, with 2022 points of focus)

• SOC 2 (2017 TSC) A1.1 — Monitoring and Managing System Capacity
• SOC 2 (2017 TSC) A1.2 — Management of Backup, Recovery, and Environmental Controls
• SOC 2 (2017 TSC) A1.3 — Testing of System Recovery Procedures

SOC 2 Trust Services Criteria (2017, with 2022 points of focus)

• SOC 2 (2017 TSC) CC2.1 — Information Quality
• SOC 2 (2017 TSC) CC2.2 — Internal Communications
• SOC 2 (2017 TSC) CC2.3 — External Communication on Internal Control Matters

SOC 2 Trust Services Criteria (2017, with 2022 points of focus)

• SOC 2 (2017 TSC) CC5.1 — Control Selection and Development
• SOC 2 (2017 TSC) CC5.2 — Technology Control Activities to Support Objectives
• SOC 2 (2017 TSC) CC5.3 — Control Deployment Through Policies

SOC 2 Trust Services Criteria (2017, with 2022 points of focus)

• SOC 2 (2017 TSC) P4.1 — Limitation of Personal Information Use to Defined Purposes
• SOC 2 (2017 TSC) P4.2 — Personal Information Retention Aligned with Privacy Objectives
• SOC 2 (2017 TSC) P4.3 — Secure Disposal of Personal Information

SOC 2 Trust Services Criteria (2017, with 2022 points of focus)

• SOC 2 (2017 TSC) CC4.1 — Control Monitoring
• SOC 2 (2017 TSC) CC4.2 — Control Deficiencies

SOC 2 Trust Services Criteria (2017, with 2022 points of focus)

• SOC 2 (2017 TSC) CC9.1 — Business Disruption Risk Mitigation
• SOC 2 (2017 TSC) CC9.2 — Vendor Risk Management

SOC 2 Trust Services Criteria (2017, with 2022 points of focus)

• SOC 2 (2017 TSC) C1.1 — Confidential Information Identification and Maintenance
• SOC 2 (2017 TSC) C1.2 — Confidential Information Disposal

SOC 2 Trust Services Criteria (2017, with 2022 points of focus)

• SOC 2 (2017 TSC) P3.1 — Personal Information Collection Aligned with Privacy Objectives
• SOC 2 (2017 TSC) P3.2 — Consent Management for Personal Information Collection

SOC 2 Trust Services Criteria (2017, with 2022 points of focus)

• SOC 2 (2017 TSC) P5.1 — Data Subject Access to Personal Information
• SOC 2 (2017 TSC) P5.2 — Correction and Amendment of Personal Information

SOC 2 Trust Services Criteria (2017, with 2022 points of focus)

• SOC 2 (2017 TSC) CC8.1 — Change Management

SOC 2 Trust Services Criteria (2017, with 2022 points of focus)

• SOC 2 (2017 TSC) P1.1 — Privacy Notice to Data Subjects

SOC 2 Trust Services Criteria (2017, with 2022 points of focus)

• SOC 2 (2017 TSC) P2.1 — Communication of Data Subject Choices and Consequences

SOC 2 Trust Services Criteria (2017, with 2022 points of focus)

• SOC 2 (2017 TSC) P7.1 — Maintenance of Accurate and Relevant Personal Information

SOC 2 Trust Services Criteria (2017, with 2022 points of focus)

• SOC 2 (2017 TSC) P8.1 — Inquiry and Complaint Management Process