Compliance FrameworksAmericas
SOC2 Type 2
AICPA Trust Services Criteria assessed for operating effectiveness across the observation window: recurring evidence snapshots, attestation history, and Availability, Confidentiality, and Processing Integrity in required scope alongside Security.
AICPA Trust Services Criteria assessed for operating effectiveness across the observation window: recurring evidence snapshots, attestation history, and Availability, Confidentiality, and Processing Integrity in required scope alongside Security.
| Region | Americas |
| Country or scope | United States |
| Sector | General |
| In your workspace | On unless you switch it off in Compliance › Manage. |
How Safeguard covers SOC2 Type 2
- Scan requirements: 61: 1 decided by a scan, 5 where a scan checks a prerequisite and evidence decides, 55 that need evidence or an attestation.
- Controls: the requirements below, under their published identifiers.
- Automated tests: 855 map to its controls, and 360 connectors provide automated evidence for them. See SOC2 and connectors.
- Policy templates: 26: 4 written for SOC2 Type 2 and 22 from the standard set.
How each kind of coverage works, and what the readiness score counts: Compliance frameworks.
What a scan checks
Each scan of a product checks these 61 requirements against what the scan found, including the product's software inventory (SBOM).
- Scan: the scan decides whether the requirement is met.
- Scan, then evidence: the scan checks a prerequisite and fails the requirement when it is missing. Only evidence or an attestation can pass it.
- Evidence: a scan cannot see what the requirement asks for. It passes when a person attests it with evidence.
| Requirement | What Safeguard checks | Decided by |
|---|---|---|
CC1.1 Commitment to Integrity and Ethical Values | The entity demonstrates a commitment to integrity and ethical values through established standards of conduct, evaluation of adherence, and timely remediation of deviations. | Evidence |
CC1.2 Board Oversight of Internal Control | The board of directors (or equivalent) demonstrates independence from management and exercises oversight of the development and performance of internal control. | Evidence |
CC1.3 Organizational Structure, Authority, and Responsibility | Management establishes, with board oversight, structures, reporting lines, and appropriate authorities and responsibilities in the pursuit of objectives. | Evidence |
CC1.4 Commitment to Competence | The entity demonstrates a commitment to attract, develop, and retain competent individuals in alignment with objectives, including background screening and security training. | Evidence |
CC1.5 Accountability for Internal Control Responsibilities | The entity holds individuals accountable for their internal control responsibilities in the pursuit of objectives. | Evidence |
CC2.1 Quality Information to Support Internal Control | The entity obtains or generates and uses relevant, quality information to support the functioning of internal control. | Evidence |
CC2.2 Internal Communication of Control Responsibilities | The entity internally communicates information, including objectives and responsibilities for internal control, necessary to support the functioning of internal control. | Evidence |
CC2.3 External Communication | The entity communicates with external parties regarding matters affecting the functioning of internal control, including security commitments, incident notifications, and service level terms. | Evidence |
CC3.1 Specification of Objectives for Risk Assessment | The entity specifies objectives with sufficient clarity to enable the identification and assessment of risks relating to objectives, including a stated risk appetite and tolerance. | Evidence |
CC3.2 Risk Identification and Analysis | The entity identifies risks to the achievement of its objectives across the entity and analyzes risks as a basis for determining how the risks should be managed, maintaining a risk register with owners. | Evidence |
CC3.3 Fraud Risk Assessment | The entity considers the potential for fraud in assessing risks to the achievement of objectives. | Evidence |
CC3.4 Assessment of Significant Change | The entity identifies and assesses changes, including changes in technology, that could significantly impact the system of internal control. | Evidence |
CC4.1 Ongoing and Separate Evaluations of Controls | The entity selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning, including continuous monitoring and internal audits. | Evidence |
CC4.2 Evaluation and Communication of Deficiencies | The entity evaluates and communicates internal control deficiencies in a timely manner to parties responsible for corrective action, tracking deficiencies to remediation. | Evidence |
CC5.1 Selection and Development of Control Activities | The entity selects and develops control activities that contribute to the mitigation of risks to the achievement of objectives to acceptable levels, mapped to the risk register. | Evidence |
CC5.2 Technology General Controls | The entity selects and develops general control activities over technology to support the achievement of objectives, including MFA, endpoint protection, and security tooling deployment. | Evidence |
CC5.3 Deployment Through Policies and Procedures | The entity deploys control activities through policies that establish what is expected and procedures that put policies into action. | Evidence |
CC6.1 Logical Access Security: Protected Information Assets | The entity implements logical access security software, infrastructure, and architectures over protected information assets. A complete, current inventory of system components is the foundational prerequisite; full satisfaction additionally requires access management evidence (SSO/MFA, least privilege). | Scan, then evidence |
CC6.2 User Registration and Authorization | Prior to issuing system credentials and granting system access, the entity registers and authorizes new internal and external users; access requests require documented approval. | Evidence |
CC6.3 Access Modification and Removal | The entity authorizes, modifies, or removes access based on roles and responsibilities; terminated users are de-provisioned in a timely manner (within 24 hours is the auditor benchmark). | Evidence |
CC6.4 Restriction of Physical Access | The entity restricts physical access to facilities and protected information assets to authorized personnel. | Evidence |
CC6.5 Disposal of Assets and Data | The entity discontinues logical and physical protections over physical assets only after the ability to read or recover data from those assets has been diminished. | Evidence |
CC6.6 Protection Against External Threats | The entity implements logical access security measures to protect against threats from sources outside its system boundaries, including firewalls, IDS/IPS, and network segmentation. | Evidence |
CC6.7 Protection of Data in Transmission and Movement | The entity restricts the transmission, movement, and removal of information to authorized users and processes, and protects it during transmission (TLS enforcement, encrypted transfer). | Evidence |
CC6.8 Prevention and Detection of Unauthorized Software | The entity implements controls to prevent or detect and act upon the introduction of unauthorized or malicious software. Verifiable component provenance (integrity hashes, known licenses) evidences detection capability for third-party software. | Scan, then evidence |
CC7.1 Vulnerability Detection and Monitoring | The entity uses detection and monitoring procedures to identify changes to configurations that introduce vulnerabilities, and susceptibilities to newly discovered vulnerabilities, including recurring vulnerability scanning of system components. | Scan |
CC7.2 Monitoring of System Components for Anomalies | The entity monitors system components and the operation of those components for anomalies indicative of malicious acts, natural disasters, and errors. Version identification of every component is the prerequisite for change and anomaly detection. | Scan, then evidence |
CC7.3 Evaluation of Security Events | The entity evaluates security events to determine whether they could or have resulted in a failure to meet objectives (security incidents) and, if so, takes action to prevent or address such failures. | Evidence |
CC7.4 Incident Response and Containment | The entity responds to identified security incidents by executing a defined incident response program to understand, contain, remediate, and communicate security incidents. | Evidence |
CC7.5 Recovery from Identified Security Incidents | The entity identifies, develops, and implements activities to recover from identified security incidents, including post-incident review and remediation of identified vulnerabilities within defined SLAs. | Evidence |
CC8.1 Authorized, Tested, and Approved Changes | The entity authorizes, designs, develops or acquires, configures, documents, tests, approves, and implements changes to infrastructure, data, software, and procedures; production changes require prior approval and testing. | Evidence |
CC9.1 Business Disruption Risk Mitigation | The entity identifies, selects, and develops risk mitigation activities for risks arising from potential business disruptions, including business continuity planning and testing. | Evidence |
CC9.2 Vendor and Business Partner Risk Management | The entity assesses and manages risks associated with vendors and business partners. A complete third-party software supplier inventory is the foundational evidence; full satisfaction additionally requires vendor assessments and agreements. | Scan, then evidence |
A1.1 Capacity Management | The entity maintains, monitors, and evaluates current processing capacity and use of system components to manage capacity demand and enable the implementation of additional capacity. | Evidence |
A1.2 Environmental Protections, Backup, and Recovery Infrastructure | The entity authorizes, designs, develops or acquires, implements, operates, approves, maintains, and monitors environmental protections, software, data backup processes, and recovery infrastructure; backups are performed and restore-tested. | Evidence |
A1.3 Recovery Plan Testing | The entity tests recovery plan procedures supporting system recovery to meet its objectives, with defined RTO/RPO and documented test results. | Evidence |
C1.1 Identification and Protection of Confidential Information | The entity identifies and maintains confidential information to meet the entity's objectives related to confidentiality, including data classification and inventory. | Evidence |
C1.2 Disposal of Confidential Information | The entity disposes of confidential information to meet the entity's objectives related to confidentiality, per a retention and disposal policy with evidence of destruction. | Evidence |
PI1.1 Processing Integrity Objectives and Specifications | The entity obtains or generates, uses, and communicates relevant, quality information regarding the objectives related to processing, including definitions of data processed and product and service specifications. | Evidence |
PI1.2 System Input Completeness and Accuracy | The entity implements policies and procedures over system inputs, including controls over completeness and accuracy, to result in products, services, and reporting that meet the entity's objectives. | Evidence |
PI1.3 System Processing Completeness and Accuracy | The entity implements policies and procedures over system processing to result in products, services, and reporting that meet the entity's objectives. | Evidence |
PI1.4 System Output Completeness and Accuracy | The entity implements policies and procedures to make available or deliver output completely, accurately, and timely in accordance with specifications to meet the entity's objectives. | Evidence |
PI1.5 Storage Integrity of Inputs, Items in Processing, and Outputs | The entity implements policies and procedures to store inputs, items in processing, and outputs completely, accurately, and timely in accordance with system specifications. Integrity hashes on stored software components evidence tamper detection. | Scan, then evidence |
P1.1 Privacy Notice | The entity provides notice to data subjects about its privacy practices to meet the entity's objectives related to privacy, and the notice is current, complete, and consistent with actual practice. | Evidence |
P2.1 Choice and Consent | The entity communicates choices available regarding the collection, use, retention, disclosure, and disposal of personal information, and obtains consent where required. | Evidence |
P3.1 Collection Limited to Identified Purposes | Personal information is collected consistent with the entity's objectives related to privacy and limited to the purposes identified in the privacy notice. | Evidence |
P3.2 Explicit Consent for Sensitive Information | For information requiring explicit consent, the entity communicates the need for such consent and obtains it prior to collection. | Evidence |
P4.1 Use of Personal Information Limited to Identified Purposes | The entity limits the use of personal information to the purposes identified in the entity's objectives related to privacy. | Evidence |
P4.2 Retention of Personal Information | The entity retains personal information consistent with the entity's objectives related to privacy, per a documented retention schedule. | Evidence |
P4.3 Disposal of Personal Information | The entity securely disposes of personal information when retention is no longer required, with evidence of disposal. | Evidence |
P5.1 Data Subject Access | The entity grants identified and authenticated data subjects the ability to access their stored personal information for review and, upon request, provides physical or electronic copies. | Evidence |
P5.2 Data Subject Correction | The entity corrects, amends, or appends personal information based on information provided by data subjects and communicates such information to third parties, as committed or required. | Evidence |
P6.1 Disclosure Limited to Identified Purposes with Consent | The entity discloses personal information to third parties with the explicit consent of data subjects, and such consent is obtained prior to disclosure. | Evidence |
P6.2 Record of Authorized Disclosures | The entity creates and retains a complete, accurate, and timely record of authorized disclosures of personal information. | Evidence |
P6.3 Record of Unauthorized Disclosures | The entity creates and retains a complete, accurate, and timely record of detected or reported unauthorized disclosures (including breaches) of personal information. | Evidence |
P6.4 Third-Party Privacy Commitments | The entity obtains privacy commitments from vendors and other third parties who have access to personal information, consistent with the entity's privacy commitments. | Evidence |
P6.5 Third-Party Compliance Assessment | The entity obtains commitments from vendors and other third parties with access to personal information to notify the entity in the event of actual or suspected unauthorized disclosures, and assesses compliance as needed. | Evidence |
P6.6 Breach Notification to Data Subjects | The entity provides notification of breaches and incidents to affected data subjects, regulators, and others to meet the entity's objectives related to privacy. | Evidence |
P6.7 Accounting of Personal Information Held | The entity provides data subjects with an accounting of the personal information held and disclosure of the data subjects' personal information, upon request. | Evidence |
P7.1 Quality of Personal Information | The entity collects and maintains accurate, up-to-date, complete, and relevant personal information to meet the entity's objectives related to privacy. | Evidence |
P8.1 Privacy Inquiry, Complaint, and Dispute Resolution | The entity implements a process for receiving, addressing, resolving, and communicating the resolution of inquiries, complaints, and disputes from data subjects, with defined escalation and monitoring of unresolved matters. | Evidence |
Policy templates
Written for SOC2 Type 2:
- SOC2 Type 2 Continuous Monitoring and Control Testing Policy
- SOC2 Type 2 Availability and Business Continuity Policy
- SOC2 Type 2 Incident Detection and Response Policy
- SOC2 Type 2 Vendor Risk Periodic Assessment Policy
And 22 from the standard set, adapted to SOC2 Type 2.
SOC2 Type 1
AICPA Trust Services Criteria (2017, 2022 Points of Focus), point-in-time assessment of control design: full CC1-CC9 Common Criteria, with Availability, Confidentiality, Processing Integrity, and Privacy visible as optional scope.
SOX ITGC
Sarbanes-Oxley IT General Controls: change management, software inventory, supplier accountability.