SOC 2 Security

CC1.1 Commitment to integrity and ethical values

Leadership sets the tone at the top with a code of conduct that staff and contractors accept, and breaches of expected behavior are identified and dealt with promptly.

• New Hire Policy Acknowledgement
• Code of Business Conduct
• Periodic Policy Acknowledgement
• Cybersecurity Responsibilities

CC1.2 Board independence and oversight

A board or equivalent governing body that is independent from management oversees how internal controls are designed and operated.

• Management Review of Policies
• Security & Privacy Program Review
• Management Review of Org Chart
• Management Review of Risks
• Management Review of Third-Party Risks

CC1.3 Organizational structure, reporting lines and authority

Management, overseen by the board, defines the org structure, reporting lines and who holds which authority and responsibility for meeting objectives.

• Organizational Structure
• Roles & Responsibilities
• Assigned Security & Privacy Responsibilities
• Asset Ownership Assignment
• People Operations Owner
• Compliance Program Manager
• Security & Privacy Program Review

CC1.4 Attracting, developing and retaining competent people

The organization hires, trains and keeps people with the skills needed to meet its objectives and checks that they remain competent.

• Competency Screening
• Personnel Screening

CC1.5 Accountability for internal control responsibilities

People are held accountable for their part in internal control through defined responsibilities, performance measures and consequences.

• Security & Privacy Awareness
• Performance Review
• New Hire Security & Privacy Training
• Periodic Security & Privacy Training
• Periodic Policy Acknowledgement

CC2.1 Relevant, quality information for internal control

The organization gathers or produces accurate, timely and relevant information so that internal controls can work as intended.

• Impact Analysis
• Publishing Security & Privacy Documentation
• Conspicuous Privacy Notice Link
• Data Classification Policy
• Data Retention Policy

CC2.2 Internal communication of control responsibilities

Objectives and responsibilities for internal control, including security policies, are communicated to staff, who also have a channel for raising concerns.

• New Hire Policy Acknowledgement
• New Hire Security & Privacy Training
• Periodic Security & Privacy Training
• Code of Business Conduct
• Periodic Policy Acknowledgement
• Publishing Security & Privacy Documentation
• Automated Incident Reporting

CC2.3 Communication with external parties

Customers, vendors, regulators and other outside parties are told what they need to know about the system and its controls and have a way to report issues back.

• Conspicuous Privacy Notice Link
• Incident Reporting Assistance

CC3.1 Clearly defined objectives

Business and security objectives are stated clearly enough that the risks threatening them can be identified and assessed.

• Risk Framing

CC3.2 Risk identification and analysis

Risks to objectives are identified across the organization, including those coming from vendors, and analyzed to decide how each should be managed.

• New Hire Policy Acknowledgement
• Risk Framing
• Risk Assessment
• Third-Party Criticality Assessments

CC3.3 Fraud risk assessment

The risk assessment explicitly considers how fraud, such as misuse of assets or manipulated reporting, could stop objectives from being met.

• Fraud Risk Assessment

CC3.4 Assessment of significant changes

Changes in the business, technology, leadership or external environment that could weaken internal control are identified and assessed.

• Risk Framing
• Risk Assessment
• Third-Party Criticality Assessments

CC4.1 Ongoing and separate control evaluations

Controls are evaluated through continuous monitoring and periodic assessments, such as internal audits, to confirm they are in place and working.

• Asset Ownership Assignment
• Asset Inventory Updates
• Assigned Security & Privacy Responsibilities
• Internal Audit
• Management Review of Policies
• Security & Privacy Program Review
• Management Review of Org Chart
• Management Review of Risks
• Management Review of Third-Party Risks
• Subservice Organization Evaluation

CC4.2 Reporting and remediating control deficiencies

Control weaknesses are evaluated and reported in a timely way to the people who must fix them, including senior management and the board when warranted.

• Automated Incident Reporting
• Internal Audit
• Management Review of Policies
• Security & Privacy Program Review

CC5.1 Control activities that mitigate risk

Controls are selected and designed to bring the risks found in the risk assessment down to an acceptable level.

• Rules of Behavior
• Information Security & Privacy Policies
• Segregation of Duties

CC5.2 General controls over technology

Technology-level controls over infrastructure, security management and system acquisition and development are selected and designed to support objectives.

• Internal Audit
• Management Review of Policies
• Security & Privacy Program Review
• Management Review of Org Chart
• Management Review of Risks
• Production System Access Review
• Management Review of Third-Party Risks
• Subservice Organization Evaluation
• Information Security & Privacy Policies

CC5.3 Controls deployed through policies and procedures

Controls are put into practice through documented policies that state what is expected and procedures that describe how staff carry them out.

• New Hire Policy Acknowledgement
• Periodic Policy Acknowledgement
• Publishing Security & Privacy Documentation
• Information Security & Privacy Policies

CC6.1 Logical access security over protected assets

Information assets are protected with access control software, network architecture, authentication and encryption so only authorized users and systems can reach them.

• Unauthorized Activity Monitoring
• Password Management Guidelines
• Access Control Policy & Procedure
• Identity Validation
• Limit Network Connections
• User Privilege Reviews
• User Access Reviews
• Physical Protection Policy & Procedure
• External System Connections

CC6.2 User registration and access provisioning

Internal and external users are registered and approved before they receive credentials, and their access is removed when it is no longer needed.

• Access Control Policy & Procedure
• Identity Validation
• Termination of Employment

CC6.3 Role-based and least-privilege access

Access to data and systems is granted, changed and revoked based on job role, least privilege and segregation of duties, with periodic access reviews.

• Identity Validation
• Termination of Employment
• Production Database Access Restriction
• Access Control Policy & Procedure
• User Privilege Reviews
• User Access Reviews

CC6.4 Physical access restrictions

Physical access to offices, data centers, backup media and other sensitive locations is limited to authorized people.

CC6.5 Secure disposal of physical assets

Data and software are wiped or destroyed before hardware and media are disposed of, so the information cannot be recovered.

• Media Disposal Policy

CC6.6 Protection against threats from outside the system

Boundary protections such as firewalls, VPNs and multi-factor authentication guard the system against access attempts from outside its boundaries.

• Endpoint Encryption
• Endpoint Security Policy
• Inventory of Endpoint Assets
• Limit Network Connections
• Multi-Factor Authentication
• Malware Protection
• Full Device Encryption
• Endpoint Security Validation
• Session Lock
• External System Connections
• Network Security Policy & Procedure

CC6.7 Protection of data in transit and on removable media

Moving or transmitting information is limited to authorized users and processes, and data is protected, for example by encryption, while in transit or on removable media.

• Test Data Protection
• Encryption Policy & Procedure
• Endpoint Encryption
• Full Device Encryption
• Encryption of Data at Rest
• Transmission Confidentiality
• Inventory of Infrastructure Assets

CC6.8 Prevention of unauthorized or malicious software

Measures such as anti-malware tools and restrictions on software installation stop or detect unauthorized and malicious software.

• Endpoint Security Validation
• External System Connections

CC7.1 Detection of vulnerabilities and configuration changes

Configuration monitoring and vulnerability scanning detect changes and newly discovered weaknesses that could expose the system.

• Anomalous Behavior Detection
• Capacity & Performance Management
• Vulnerability Management Policy & Procedure
• Centralized Security Logging
• Vulnerability Remediation Process
• Centralized Flaw Remediation

CC7.2 Monitoring for anomalies and security events

System components are monitored and logged so that unusual activity pointing to attacks, errors or failures is spotted and analyzed.

• Anomalous Behavior Detection
• Capacity & Performance Management
• Vulnerability Management Policy & Procedure
• Centralized Security Logging
• Vulnerability Remediation Process
• Centralized Flaw Remediation

CC7.3 Evaluation of security events

Detected security events are evaluated to decide whether they are incidents that need a response.

• Anomalous Behavior Detection
• Capacity & Performance Management
• Penetration Testing
• Vulnerability Management Policy & Procedure
• Centralized Security Logging
• Internal Audit
• Endpoint Security Validation
• Incident Tracking
• Vulnerability Remediation Process
• Centralized Flaw Remediation
• Data Breach Notification Policy

CC7.4 Security incident response

A documented incident response program is used to contain, remediate and communicate confirmed security incidents.

• Internal Audit
• Incident Management Policy & Procedure
• Incident Tracking

CC7.5 Recovery from security incidents

Affected systems and data are restored after an incident, and lessons learned are applied to prevent it from happening again.

• Data Backup Policy
• Disaster Recovery Policy
• Business Continuity Policy & Procedure

CC8.1 Change management for systems and software

Changes to infrastructure, data, software and procedures go through a controlled process of authorization, testing, approval and documentation before release.

• Change Management Policy & Procedure
• Secure System Modification
• Approval of Changes
• Inventory of Infrastructure Assets

CC9.1 Business disruption risk mitigation

Risks from possible business disruptions are identified and addressed with measures such as continuity planning and insurance.

• Risk Assessment Policy & Procedure
• Risk Framing
• Risk Assessment

CC9.2 Vendor and business partner risk management

Risks from vendors and business partners are assessed before onboarding and monitored throughout the relationship.

• Risk Assessment Policy & Procedure
• Vendor Management Policy & Procedure
• Third-Party Criticality Assessments