SOC 2 readiness

Leadership shows integrity and ethical values in how it acts, writes them into a code of conduct, and deals with breaches consistently.

A governing body independent of management oversees how internal control and security are designed and run.

Management sets up the structure, reporting lines and authority needed to meet security objectives, under board oversight.

The organisation attracts, develops and keeps competent people, with background checks and training in line with its objectives.

People are held accountable for their internal control responsibilities, through objectives, reviews and consequences.

The organisation gets or produces relevant, good-quality information so that controls can operate and be checked.

Objectives and responsibilities for internal control are communicated inside the organisation, with a way to raise concerns.

The organisation communicates with outside parties about matters that affect how internal control works, including commitments and incidents.

Objectives are specified with enough clarity that risks to achieving them can be identified and assessed.

Risks to objectives are identified and analysed across the organisation, and a response is chosen for each.

The risk assessment considers how fraud could happen, including incentives, opportunities and misuse of access.

Significant changes that could affect internal control are identified and assessed.

Ongoing and separate evaluations confirm that internal control components are present and working.

Control deficiencies are evaluated and communicated in good time to those responsible for fixing them, including senior management and the board.

Control activities are selected and developed to reduce risks to achieving objectives to acceptable levels.

General controls over technology (infrastructure, access, change and operations) are selected and developed.

Control activities are put in place through policies that set expectations and procedures that put them into action.

Software, infrastructure and architecture protect information assets from unauthorised logical access, including authentication and encryption.

Users are registered and authorised before access is issued, and access is removed when it is no longer required.

Access is granted, changed and removed by role, applying least privilege and separation of duties, with periodic review.

Physical access to facilities and protected assets is restricted to authorised people.

Protection over assets ends only after data is made unrecoverable when they are retired.

Logical access measures protect against threats from sources outside the system boundary.

Transmission, movement and removal of information is limited to authorised users and processes and protected in transit.

Controls prevent or detect unauthorised or malicious software and act on it.

Detection and monitoring find configuration changes that introduce weaknesses and newly discovered vulnerabilities.

System components are monitored for anomalies that could indicate malicious acts, disasters or errors.

Security events are evaluated to decide whether they are incidents needing a response.

Identified incidents are handled through a defined programme to understand, contain, fix and communicate.

Recovery activities are identified, developed and carried out after incidents, with lessons applied.

Changes to infrastructure, data, software and procedures are authorised, designed, tested, approved and implemented in a controlled way.

Risk mitigation activities address potential business disruptions, including insurance where appropriate.

Risks from vendors and business partners are assessed and managed, including contract terms and ongoing review.

Current processing capacity and use are maintained, monitored and evaluated so that capacity can be added in time to meet commitments.

Environmental protections, software, data backup processes and recovery infrastructure are designed, run and monitored to meet availability commitments.

Recovery plan procedures that support system recovery are tested to show they meet objectives.

Confidential information is identified and kept protected in line with confidentiality commitments.

Confidential information is disposed of in line with commitments when retention ends.

Quality information is held about processing objectives, including definitions of the data processed and the product and service specifications.

Policies and procedures over system inputs result in complete and accurate inputs.

Processing produces products, services and reports that meet specifications.

Output is delivered completely, accurately and on time, to intended parties only.

Inputs, items in processing and outputs are stored completely, accurately and on time.

A privacy notice explains what personal information is collected, why, and how it is used, kept and shared, and is kept up to date.

Choices about collection, use and sharing are communicated, and consent is obtained and recorded where needed.

Collection of personal information is limited to what the stated objectives need.

Where collection needs explicit consent, people are told the consequences of refusing and their consent is captured.

Use of personal information is limited to the purposes described in the notice.

Personal information is retained in line with stated objectives and retention rules.

Personal information is securely disposed of when retention ends.

Identified individuals can review their personal information on request, after their identity is confirmed.

Requests to correct or amend personal information are handled, and refusals are explained.

Disclosure to third parties happens only for disclosed purposes and with consent where needed.

Complete and accurate records are kept of authorised disclosures of personal information.

Complete and accurate records are kept of detected or reported unauthorised disclosures, including breaches.

Privacy commitments are obtained from vendors and others with access to personal information, and their compliance is assessed.

Vendors and others with access must notify the organisation of actual or suspected unauthorised disclosures.

Breaches and incidents involving personal information are notified to affected individuals, regulators and others as required.

On request, individuals receive an account of the personal information held and disclosures made about them.

Personal information is collected and kept accurate, up to date, complete and relevant for its purposes.

There is a process to receive, address and resolve privacy enquiries, complaints and disputes, with compliance monitored and fixes made.