Frameworks · Global
SOC 2 Confidentiality
The Confidentiality category is an optional SOC 2 add-on to the Security criteria for protecting information designated as confidential, such as customer business data, intellectual property or contract terms. It covers identifying confidential information, protecting it while it is kept and disposing of it securely. Include it when you hold sensitive business information under confidentiality or non-disclosure commitments.
- Version
- 2017 Trust Services Criteria (revised points of focus 2022)
- Requirements
- 3, each mapped to ProofTrail’s controls
Requirements and controls
-
C1 Additional Criteria for Confidentiality
-
C1.1 Identification and protection of confidential information
Information designated as confidential is identified, classified and protected for as long as it is kept, in line with confidentiality commitments.
- New Hire Policy Acknowledgement
- Periodic Policy Acknowledgement
- Full Device Encryption
- Encryption of Data at Rest
- Security Governance Program
- Data Classification Labels
-
C1.2 Disposal of confidential information
Confidential information is securely destroyed once its retention period ends or it is no longer needed.
- Media Disposal Policy
- Data Retention Policy
-