🔒
CC6–CC9
Security
SOC 2 Common Criteria CC6–CC9 govern logical and physical access controls, system operations, change management, and risk mitigation. Auditors assess whether controls prevent unauthorised access and system failures.
Q1 · Domain 1
Logical access controls implemented with principle of least privilege across all systems?
Q2 · Domain 1
Multi-factor authentication (MFA) enforced for all remote and privileged system access?
Q3 · Domain 1
Vulnerability scanning and penetration testing conducted at least annually?
Q4 · Domain 1
Security monitoring and alerting operational 24/7 with documented response procedures?
Q5 · Domain 1
Security awareness training delivered to all personnel upon hire and annually?
⚡
A1
Availability
SOC 2 Availability criteria require that systems are available for operation as committed or agreed. This includes uptime commitments, capacity planning, and disaster recovery capabilities.
Q1 · Domain 2
System availability SLAs defined, monitored, and reported against customer commitments?
Q2 · Domain 2
Redundancy and automated failover implemented for all critical system components?
Q3 · Domain 2
Capacity planning process in place to prevent performance degradation?
Q4 · Domain 2
Disaster recovery (DR) plan tested within the past 12 months with documented results?
Q5 · Domain 2
Backup procedures validated and recovery time objectives (RTOs) confirmed achievable?
🔐
C1
Confidentiality
SOC 2 Confidentiality criteria require that information designated as confidential is protected as committed or agreed. Controls cover identification, handling, and disposal of confidential data.
Q1 · Domain 3
Data classification policy implemented and communicated to all personnel?
Q2 · Domain 3
Encryption at rest and in transit applied to all confidential data?
Q3 · Domain 3
Non-disclosure agreements (NDAs) in place with all third parties handling confidential data?
Q4 · Domain 3
Data retention and secure disposal procedures documented and enforced?
Q5 · Domain 3
Access to confidential data logged, audited, and reviewed regularly?
⚙️
PI1
Processing Integrity
SOC 2 Processing Integrity criteria ensure that system processing is complete, valid, accurate, timely, and authorised. Controls address input validation, error handling, and output reconciliation.
Q1 · Domain 4
Input validation and error handling implemented across all critical transaction processing?
Q2 · Domain 4
System processing monitored for completeness, accuracy, and timeliness?
Q3 · Domain 4
Change management process requires testing and approval before production deployment?
Q4 · Domain 4
Quality assurance (QA) checks in place for all critical data processing pipelines?
Q5 · Domain 4
Reconciliation procedures verify data integrity across system boundaries?
🛡️
P1–P8
Privacy
SOC 2 Privacy criteria address the collection, use, retention, disclosure, and disposal of personal information. AICPA's Generally Accepted Privacy Principles (GAPP) form the basis of these controls.
Q1 · Domain 5
Privacy notice published, accurate, and updated to reflect actual data practices?
Q2 · Domain 5
Process exists to honor data subject access, correction, and deletion requests?
Q3 · Domain 5
Personal data collected limited to stated and consented purposes only?
Q4 · Domain 5
Third-party processors bound by data processing agreements (DPAs)?
Q5 · Domain 5
Privacy impact assessments (PIAs) conducted for new personal data processing activities?