Frameworks · Global
SOC 2 Processing Integrity
The Processing Integrity category is an optional SOC 2 add-on to the Security criteria that covers whether a system processes data completely, accurately, on time and as authorized. It looks at processing specifications, input validation, processing controls, outputs and stored data. Include it when customers rely on your system producing correct results, for example in payments, payroll, billing or data transformation services.
- Version
- 2017 Trust Services Criteria (revised points of focus 2022)
- Requirements
- 6, each mapped to ProofTrail’s controls
Requirements and controls
-
PI1 Additional Criteria for Processing integrity
-
PI1.1 Processing specifications and data definitions
The organization defines and communicates what its processing is meant to do, including data definitions and product or service specifications, so that processing can be done correctly.
- Data Classification Labels
- Input Range Validation
- Mandatory Field Validation
-
PI1.2 Complete and accurate system inputs
Inputs are checked for completeness and accuracy before or as they enter the system, and input errors are flagged and corrected.
- Data Classification Labels
- Input Range Validation
-
PI1.3 Complete, accurate and timely processing
Data is processed completely, accurately and on time according to specifications, and processing errors are detected and corrected.
- Approval of Changes
- Regression Testing
-
PI1.4 Complete and accurate outputs to intended recipients
System outputs are complete and accurate and are delivered on time only to the intended recipients.
- Identity Validation
- Approval of Changes
- Regression Testing
-
PI1.5 Protected storage of inputs and outputs
Inputs, data in process and outputs are stored completely and accurately and protected from unauthorized change or loss for as long as required.
- Access Control Policy & Procedure
- Encryption of Data at Rest
-