Customer data deleted upon leaving
Data retention procedures established
Data classification policy established
Vulnerabilities scanned and remediated
Vendor management program established
Service description communicated
Third-party agreements established
Risk management program established
Risks assessments performed
Risk assessment objectives specified
External support resources available
Company commitments externally communicated
Data center access reviewed
Physical access processes established
Incident management procedures followed
Incident response policies established
System changes communicated
Incident response plan tested
Security policies established and reviewed
Roles and responsibilities specified
Organization structure documented
Management roles and responsibilities defined
System changes externally communicated
Backup processes established
Board expertise developed
SOC 2 - System Description
Board oversight briefings conducted
Whistleblower policy established
Development lifecycle established
Production deployment access restricted
Change management procedures enforced
Cybersecurity insurance maintained
Configuration management system established
Continuity and disaster recovery plans tested
Control self-assessments conducted
Penetration testing performed
Data transmission encrypted
Continuity and Disaster Recovery plans established
Vulnerability and system monitoring procedures established
Security awareness training implemented
Visitor procedures enforced
Confidentiality Agreement acknowledged by employees
Code of Conduct acknowledged by employees and enforced
Confidentiality Agreement acknowledged by contractors
Performance evaluations conducted
Asset disposal procedures utilized
Production inventory maintained
Code of Conduct acknowledged by contractors
Employee background checks performed
Anti-malware technology utilized
Production OS access restricted
Service infrastructure maintained
Network and system hardening standards maintained
Network firewalls utilized
Network firewalls reviewed
Network segmentation implemented
Infrastructure performance monitored
Remote access encrypted enforced
Remote access MFA enforced
Intrusion detection system utilized
Unique network system authentication enforced
Access revoked upon termination
Production database access restricted
Production network access restricted
Firewall access restricted
Access control procedures established
Production application access restricted
Unique account authentication enforced
Encryption key access restricted
Unique production database authentication enforced
Development lifecycle established
Continuity and disaster recovery plans tested
Role-Based Access Control
.png)
.png)
.png)
