Skip to main content

⭐ Repository

💼 SOC 2

  • ID: /frameworks/soc-2

Description​

Empty...

Similar​

  • Internal
    • ID: dec-a-fa8b3635

Sub Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 A1 Additional Criteria for Availability3no data
　💼 A1.1 The entity maintains, monitors, and evaluates current processing capacity and use of system components to manage capacity demand and to enable the implementation of additional capacity to help meet its objectives.3no data
　　💼 A1.1-1 Measures Current Usageno data
　　💼 A1.1-2 Forecasts Capacityno data
　　💼 A1.1-3 Makes Changes Based on Forecastsno data
　💼 A1.2 The entity authorizes, designs, develops or acquires, implements, operates, approves, maintains, and monitors environmental protections, software, data backup processes, and recovery infrastructure to meet its objectives.10no data
　　💼 A1.2-1 Identifies Environmental Threatsno data
　　💼 A1.2-2 Designs Detection Measuresno data
　　💼 A1.2-3 Implements and Maintains Environmental Protection Mechanismsno data
　　💼 A1.2-4 Implements Alerts to Analyze Anomaliesno data
　　💼 A1.2-5 Responds to Environmental Threat Eventsno data
　　💼 A1.2-6 Communicates and Reviews Detected Environmental Threat Eventsno data
　　💼 A1.2-7 Determines Data Requiring Backupno data
　　💼 A1.2-8 Performs Data Backupno data
　　💼 A1.2-9 Addresses Offsite Storageno data
　　💼 A1.2-10 Implements Alternate Processing Infrastructureno data
　💼 A1.3 The entity tests recovery plan procedures supporting system recovery\ \ to meet its objectives.2no data
　　💼 A1.3-1 Implements Business Continuity Plan Testingno data
　　💼 A1.3-2 Tests Integrity and Completeness of Back-Up Datano data
💼 C1 Additional Criteria for Confidentiality2no data
　💼 C1.1 The entity identifies and maintains confidential information to meet\ \ the entity's objectives related to confidentiality.2no data
　　💼 C1.1-1 Identifies Confidential Informationno data
　　💼 C1.1-2 Protects Confidential Information from Destructionno data
　💼 C1.2 The entity disposes of confidential information to meet the entity's\ \ objectives related to confidentiality.2no data
　　💼 C1.2-1 Identifies Confidential Information for Destructionno data
　　💼 C1.2-2 Destroys Confidential Informationno data
💼 CC1 Control Environments5no data
　💼 CC1.1 The entity demonstrates a commitment to integrity and ethical values.5no data
　　💼 CC1.1-1 Considers Contractors and Vendor Employees in Demonstrating Its Commitmentno data
　　💼 CC1.1-2 Sets the Tone at the Topno data
　　💼 CC1.1-3 Evaluates Adherence to Standards of Conductno data
　　💼 CC1.1-4 Establishes Standards of Conductno data
　　💼 CC1.1-5 Addresses Deviations in a Timely Mannerno data
　💼 CC1.2 The board of directors demonstrates independence from management and\ \ exercises oversight of the development and performance of internal control.4no data
　　💼 CC1.2-1 Establishes Oversight Responsibilitiesno data
　　💼 CC1.2-2 Applies Relevant Expertiseno data
　　💼 CC1.2-3 Operates Independentlyno data
　　💼 CC1.2-4 Supplements Board Expertiseno data
　💼 CC1.3 Management establishes, with board oversight, structures, reporting lines,\ \ and appropriate authorities and responsibilities in the pursuit of objectives.5no data
　　💼 CC1.3-1 Considers All Structures of the Entityno data
　　💼 CC1.3-2 Establishes Reporting Linesno data
　　💼 CC1.3-3 Defines, Assigns, and Limits Authorities and Responsibilitiesno data
　　💼 CC1.3-4 Addresses Specific Requirements When Defining Authorities and Responsibilitiesno data
　　💼 CC1.3-5 Considers Interactions With External Parties When Establishing Structures, Reporting Lines, Authorities, and Responsibilitiesno data
　💼 CC1.4 The entity demonstrates a commitment to attract, develop, and retain\ \ competent individuals in alignment with objectives.7no data
　　💼 CC1.4-1 Establishes Policies and Practicesno data
　　💼 CC1.4-2 Evaluates Competence and Addresses Shortcomingsno data
　　💼 CC1.4-3 Attracts, Develops, and Retains Individualsno data
　　💼 CC1.4-4 Plans and Prepares for Successionno data
　　💼 CC1.4-5 Considers the Background of Individualsno data
　　💼 CC1.4-6 Considers the Technical Competency of Individualsno data
　　💼 CC1.4-7 Provides Training to Maintain Technical Competenciesno data
　💼 CC1.5 The entity holds individuals accountable for their internal control\ \ responsibilities in the pursuit of objectives.5no data
　　💼 CC1.5-1 Enforces Accountability Through Structures, Authorities, and Responsibilitiesno data
　　💼 CC1.5-2 Establishes Performance Measures, Incentives, and Rewardsno data
　　💼 CC1.5-3 Evaluates Performance Measures, Incentives, and Rewards for Ongoing Relevanceno data
　　💼 CC1.5-4 Considers Excessive Pressuresno data
　　💼 CC1.5-5 Evaluates Performance and Rewards or Disciplines Individualsno data
💼 CC2 Communication and Information31no data
　💼 CC2.1 The entity obtains or generates and uses relevant, quality information to\ \ support the functioning of internal control.4no data
　　💼 CC2.1-1 Identifies Information Requirementsno data
　　💼 CC2.1-2 Captures Internal and External Sources of Datano data
　　💼 CC2.1-3 Processes Relevant Data Into Informationno data
　　💼 CC2.1-4 Maintains Quality Throughout Processingno data
　💼 CC2.2 The entity internally communicates information, including objectives and\ \ responsibilities for internal control, necessary to support the functioning\ \ of internal control.13no data
　　💼 CC2.2-1 Communicates Internal Control Informationno data
　　💼 CC2.2-2 Communicates With the Board of Directorsno data
　　💼 CC2.2-3 Provides Separate Communication Linesno data
　　💼 CC2.2-4 Selects Relevant Method of Communicationno data
　　💼 CC2.2-5 Communicates Responsibilitiesno data
　　💼 CC2.2-6 Communicates Information on Reporting Failures, Incidents, Concerns, and Other Mattersno data
　　💼 CC2.2-7 Communicates Objectives and Changes to Objectivesno data
　　💼 CC2.2-8 Communicates Information to Improve Security Knowledge and Awarenessno data
　　💼 CC2.2-9 Communicates Information to Improve Privacy Knowledge and Awarenessno data
　　💼 CC2.2-10 Communicates Incident Reporting Methodsno data
　　💼 CC2.2-11 Communicates Information About System Operation and Boundariesno data
　　💼 CC2.2-12 Communicates System Objectivesno data
　　💼 CC2.2-13 Communicates System Changesno data
　💼 CC2.3 The entity communicates with external parties regarding matters affecting\ \ the functioning of internal control.121no data
　　💼 CC2.3-1 Communicates to External Parties1no data
　　💼 CC2.3-2 Enables Inbound Communicationsno data
　　💼 CC2.3-3 Communicates With the Board of Directorsno data
　　💼 CC2.3-4 Provides Separate Communication Linesno data
　　💼 CC2.3-5 Selects Relevant Method of Communicationno data
　　💼 CC2.3-6 Communicates Objectives Related to Confidentiality and Changes to Those Objectivesno data
　　💼 CC2.3-7 Communicates Objectives Related to Privacy and Changes to Those Objectivesno data
　　💼 CC2.3-8 Communicates Incident Reporting Methodsno data
　　💼 CC2.3-9 Communicates Information About System Operation and Boundariesno data
　　💼 CC2.3-10 Communicates System Objectivesno data
　　💼 CC2.3-11 Communicates System Responsibilitiesno data
　　💼 CC2.3-12 Communicates Information on Reporting System Failures, Incidents, Concerns, and Other Mattersno data
💼 CC3 Risk Assessment41no data
　💼 CC3.1 The entity specifies objectives with sufficient clarity to enable\ \ the identification and assessment of risks relating to objectives.16no data
　　💼 CC3.1-1 Reflects Management's Choicesno data
　　💼 CC3.1-2 Considers Tolerances for Riskno data
　　💼 CC3.1-3 Includes Operations and Financial Performance Goalsno data
　　💼 CC3.1-4 Forms a Basis for Committing of Resourcesno data
　　💼 CC3.1-5 Complies With Applicable Accounting Standardsno data
　　💼 CC3.1-6 Considers Materialityno data
　　💼 CC3.1-7 Reflects Entity Activitiesno data
　　💼 CC3.1-8 Complies With Externally Established Frameworksno data
　　💼 CC3.1-9 Considers the Required Level of Precisionno data
　　💼 CC3.1-10 Reflects Entity Activitiesno data
　　💼 CC3.1-11 Reflects Management's Choicesno data
　　💼 CC3.1-12 Considers the Required Level of Precisionno data
　　💼 CC3.1-13 Reflects Entity Activitiesno data
　　💼 CC3.1-14 Reflects External Laws and Regulationsno data
　　💼 CC3.1-15 Considers Tolerances for Riskno data
　　💼 CC3.1-16 Establishes Sub-Objectives for Risk Assessmentno data
　💼 CC3.2 The entity identifies risks to the achievement of its objectives\ \ across the entity and analyzes risks as a basis for determining how the\ \ risks should be managed.91no data
　　💼 CC3.2-1 Includes Entity, Subsidiary, Division, Operating Unit, and Functional Levelsno data
　　💼 CC3.2-2 Analyzes Internal and External Factorsno data
　　💼 CC3.2-3 Involves Appropriate Levels of Managementno data
　　💼 CC3.2-4 Estimates Significance of Risks Identifiedno data
　　💼 CC3.2-5 Determines How to Respond to Risksno data
　　💼 CC3.2-6 Identifies Threats to Objectives1no data
　　💼 CC3.2-7 Identifies Vulnerability of System Componentsno data
　　💼 CC3.2-8 Analyzes Threats and Vulnerabilities From Vendors, Business Partners, and Other Partiesno data
　　💼 CC3.2-9 Assesses the Significance of the Risksno data
　💼 CC3.3 The entity considers the potential for fraud in assessing risks to\ \ the achievement of objectives.5no data
　　💼 CC3.3-1 Considers Various Types of Fraudno data
　　💼 CC3.3-2 Assesses Incentives and Pressuresno data
　　💼 CC3.3-3 Assesses Opportunitiesno data
　　💼 CC3.3-4 Assesses Attitudes and Rationalizationsno data
　　💼 CC3.3-5 Considers the Risks Related to the Use of IT and Access to Informationno data
　💼 CC3.4 The entity identifies and assesses changes that could significantly\ \ impact the system of internal control.6no data
　　💼 CC3.4-1 Assesses Changes in the External Environmentno data
　　💼 CC3.4-2 Assesses Changes in the Business Modelno data
　　💼 CC3.4-3 Assesses Changes in Leadershipno data
　　💼 CC3.4-4 Assess Changes in Systems and Technologyno data
　　💼 CC3.4-5 Assess Changes in Vendor and Business Partner Relationshipsno data
　　💼 CC3.4-6 Assesses Changes in Threats and Vulnerabilitiesno data
💼 CC4 Monitoring Activities268no data
　💼 CC4.1 The entity selects, develops, and performs ongoing and/or separate\ \ evaluations to ascertain whether the components of internal control are\ \ present and functioning.82no data
　　💼 CC4.1-1 Considers a Mix of Ongoing and Separate Evaluations2no data
　　💼 CC4.1-2 Considers Rate of Change2no data
　　💼 CC4.1-3 Establishes Baseline Understanding2no data
　　💼 CC4.1-4 Uses Knowledgeable Personnel2no data
　　💼 CC4.1-5 Integrates With Business Processes2no data
　　💼 CC4.1-6 Adjusts Scope and Frequency2no data
　　💼 CC4.1-7 Objectively Evaluates2no data
　　💼 CC4.1-8 Considers Different Types of Ongoing and Separate Evaluations2no data
　💼 CC4.2 The entity evaluates and communicates internal control deficiencies\ \ in a timely manner to those parties responsible for taking corrective action,\ \ including senior management and the board of directors, as appropriate.366no data
　　💼 CC4.2-1 Assesses Resultsno data
　　💼 CC4.2-2 Communicates Deficienciesno data
　　💼 CC4.2-3 Monitors Corrective Action66no data
💼 CC5 Control Activities31540no data
　💼 CC5.1 The entity selects and develops control activities that contribute\ \ to the mitigation of risks to the achievement of objectives to acceptable levels.6no data
　　💼 CC5.1-1 Integrates With Risk Assessmentno data
　　💼 CC5.1-2 Considers Entity-Specific Factorsno data
　　💼 CC5.1-3 Determines Relevant Business Processesno data
　　💼 CC5.1-4 Evaluates a Mix of Control Activity Typesno data
　　💼 CC5.1-5 Considers at What Level Activities Are Appliedno data
　　💼 CC5.1-6 Addresses Segregation of Dutiesno data
　💼 CC5.2 The entity also selects and develops general control activities over\ \ technology to support the achievement of objectives.41540no data
　　💼 CC5.2-1 Determines Dependency Between the Use of Technology in Business Processes and Technology General Controls1no data
　　💼 CC5.2-2 Establishes Relevant Technology Infrastructure Control Activities7no data
　　💼 CC5.2-3 Establishes Relevant Security Management Process Controls Activities1535no data
　　💼 CC5.2-4 Establishes Relevant Technology Acquisition, Development, and Maintenance Process Control Activities1no data
　💼 CC5.3 The entity deploys control activities through policies that establish\ \ what is expected and in procedures that put policies into action.6no data
　　💼 CC5.3-1 Establishes Policies and Procedures to Support Deployment of\ \ Management's Directivesno data
　　💼 CC5.3-2 Establishes Responsibility and Accountability for Executing Policies and Proceduresno data
　　💼 CC5.3-3 Performs in a Timely Mannerno data
　　💼 CC5.3-4 Takes Corrective Actionno data
　　💼 CC5.3-5 Performs Using Competent Personnelno data
　　💼 CC5.3-6 Reassesses Policies and Proceduresno data
💼 CC6 Logical and Physical Access Controls86093no data
　💼 CC6.1 The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives.135076no data
　　💼 CC6.1-1 Identifies and Manages the Inventory of Information Assets1no data
　　💼 CC6.1-2 Assesses New Architecturesno data
　　💼 CC6.1-3 Restricts Logical Access121no data
　　💼 CC6.1-4 Identifies and Authenticates Users46no data
　　💼 CC6.1-5 Considers Network Segmentation11no data
　　💼 CC6.1-6 Manages Points of Access57no data
　　💼 CC6.1-7 Restricts Access to Information Assets1326no data
　　💼 CC6.1-8 Manages Identification and Authentication1824no data
　　💼 CC6.1-9 Manages Credentials for Infrastructure and Software34no data
　　💼 CC6.1-10 Uses Encryption to Protect Data611no data
　　💼 CC6.1-11 Protects Encryption Keys69no data
　　💼 CC6.1-12 Restricts Access to and Use of Confidential Information for Identified Purposesno data
　　💼 CC6.1-13 Restricts Access to and the Use of Personal Informationno data
　💼 CC6.2 Prior to issuing system credentials and granting system access, the entity registers and authorizes new internal and external users whose access is administered by the entity.3no data
　　💼 CC6.2-1 Creates Access Credentials to Protected Information Assetsno data
　　💼 CC6.2-2 Reviews Appropriateness of Access Credentialsno data
　　💼 CC6.2-3 Prevents the Use of Credentials When No Longer Validno data
　💼 CC6.3 The entity authorizes, modifies, or removes access to data, software, functions, and other protected information assets based on roles, responsibilities, or the system design and changes, giving consideration to the concepts of least privilege and segregation of duties, to meet the entity's objectives.414no data
　　💼 CC6.3-1 Creates or Modifies Access to Protected Information Assets3no data
　　💼 CC6.3-2 Removes Access to Protected Information Assets3no data
　　💼 CC6.3-3 Uses Access Control Structures14no data
　　💼 CC6.3-4 Reviews Access Roles and Rulesno data
　💼 CC6.4 The entity restricts physical access to facilities and protected information assets (for example, data center facilities, backup media storage, and other sensitive locations) to authorized personnel to meet the entity's objectives.4no data
　　💼 CC6.4-1 Creates or Modifies Physical Accessno data
　　💼 CC6.4-2 Removes Physical Accessno data
　　💼 CC6.4-3 Recovers Physical Devicesno data
　　💼 CC6.4-4 Reviews Physical Accessno data
　💼 CC6.5 The entity discontinues logical and physical protections over physical assets only after the ability to read or recover data and software from those assets has been diminished and is no longer required to meet the entity's objectives.1no data
　　💼 CC6.5-1 Removes Data and Software From Entity Controlno data
　💼 CC6.6 The entity implements logical access security measures to protect against threats from sources outside its system boundaries.42023no data
　　💼 CC6.6-1 Restricts Access1619no data
　　💼 CC6.6-2 Protects Identification and Authentication Credentialsno data
　　💼 CC6.6-3 Requires Additional Authentication or Credentials46no data
　　💼 CC6.6-4 Implements Boundary Protection Systems4no data
　💼 CC6.7 The entity restricts the transmission, movement, and removal of information to authorized internal and external users and processes, and protects it during transmission, movement, or removal to meet the entity's objectives.468no data
　　💼 CC6.7-1 Restricts the Ability to Perform Transmissionno data
　　💼 CC6.7-2 Uses Encryption Technologies or Secure Communication Channels to Protect Data68no data
　　💼 CC6.7-3 Protects Removal Mediano data
　　💼 CC6.7-4 Protects Endpoint Devicesno data
　💼 CC6.8 The entity implements controls to prevent or detect and act upon the introduction of unauthorized or malicious software to meet the entity's objectives.5no data
　　💼 CC6.8-1 Restricts Installation and Modification of Application and Softwareno data
　　💼 CC6.8-2 Detects Unauthorized Changes to Software and Configuration Parametersno data
　　💼 CC6.8-3 Uses a Defined Change Control Processno data
　　💼 CC6.8-4 Uses Antivirus and Anti-Malware Softwareno data
　　💼 CC6.8-5 Scans Information Assets from Outside the Entity for Malware and Other Unauthorized Softwareno data
💼 CC7 System Operations52136no data
　💼 CC7.1 To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations that result in the introduction of new vulnerabilities, and (2) susceptibilities to newly discovered vulnerabilities.51216no data
　　💼 CC7.1-1 Uses Defined Configuration Standards45no data
　　💼 CC7.1-2 Monitors Infrastructure and Software811no data
　　💼 CC7.1-3 Implements Change-Detection Mechanisms3no data
　　💼 CC7.1-4 Detects Unknown or Unauthorized Components3no data
　　💼 CC7.1-5 Conducts Vulnerability Scansno data
　💼 CC7.2 The entity monitors system components and the operation of those components for anomalies that are indicative of malicious acts, natural disasters, and errors affecting the entity's ability to meet its objectives; anomalies are analyzed to determine whether they represent security events.4918no data
　　💼 CC7.2-1 Implements Detection Policies, Procedures, and Tools7no data
　　💼 CC7.2-2 Designs Detection Measures7no data
　　💼 CC7.2-3 Implements Filters to Analyze Anomalies918no data
　　💼 CC7.2-4 Monitors Detection Tools for Effective Operation1no data
　💼 CC7.3 The entity evaluates security events to determine whether they could or have resulted in a failure of the entity to meet its objectives (security incidents) and, if so, takes actions to prevent or address such failures.72no data
　　💼 CC7.3-1 Responds to Security Incidents2no data
　　💼 CC7.3-2 Communicates and Reviews Detected Security Events2no data
　　💼 CC7.3-3 Develops and Implements Procedures to Analyze Security Incidents2no data
　　💼 CC7.3-4 Assesses the Impact on Confidential Information2no data
　　💼 CC7.3-5 Determines Confidential Information Used or Disclosed2no data
　　💼 CC7.3-6 Assesses the Impact on Personal Informationno data
　　💼 CC7.3-7 Determines Personal Information Used or Disclosedno data
　💼 CC7.4 The entity responds to identified security incidents by executing a defined incident-response program to understand, contain, remediate, and communicate security incidents, as appropriate.14no data
　　💼 CC7.4-1 Assigns Roles and Responsibilitiesno data
　　💼 CC7.4-2 Contains and Responds to Security Incidentsno data
　　💼 CC7.4-3 Mitigates Ongoing Security Incidentsno data
　　💼 CC7.4-4 Resolves Security Incidentsno data
　　💼 CC7.4-5 Restores Operationsno data
　　💼 CC7.4-6 Develops and Implements Communication Protocols for Security Incidentsno data
　　💼 CC7.4-7 Obtains Understanding of Nature of Incident and Determines Containment Strategyno data
　　💼 CC7.4-8 Remediates Identified Vulnerabilitiesno data
　　💼 CC7.4-9 Communicates Remediation Activitiesno data
　　💼 CC7.4-10 Evaluates the Effectiveness of Incident Responseno data
　　💼 CC7.4-11 Periodically Evaluates Incidentsno data
　　💼 CC7.4-12 Applies Breach Response Proceduresno data
　　💼 CC7.4-13 Communicates Unauthorized Use and Disclosureno data
　　💼 CC7.4-14 Application of Sanctionsno data
　💼 CC7.5 The entity identifies, develops, and implements activities to recover from identified security incidents.6no data
　　💼 CC7.5-1 Restores the Affected Environmentno data
　　💼 CC7.5-2 Communicates Information About the Incidentno data
　　💼 CC7.5-3 Determines Root Cause of the Incidentno data
　　💼 CC7.5-4 Implements Changes to Prevent and Detect Recurrencesno data
　　💼 CC7.5-5 Improves Response and Recovery Proceduresno data
　　💼 CC7.5-6 Implements Incident Recovery Plan Testingno data
💼 CC8 Change Management13no data
　💼 CC8.1 The entity authorizes, designs, develops or acquires, configures, documents, tests, approves, and implements changes to infrastructure, data, software, and procedures to meet its objectives.183no data
　　💼 CC8.1-1 Manages Changes Throughout the System Lifecycle3no data
　　💼 CC8.1-2 Authorizes Changes3no data
　　💼 CC8.1-3 Designs and Develops Changes3no data
　　💼 CC8.1-4 Documents Changes3no data
　　💼 CC8.1-5 Tracks System Changes3no data
　　💼 CC8.1-6 Configures Software3no data
　　💼 CC8.1-7 Tests System Changes3no data
　　💼 CC8.1-8 Approves System Changes3no data
　　💼 CC8.1-9 Deploys System Changes3no data
　　💼 CC8.1-10 Identifies and Evaluates System Changes3no data
　　💼 CC8.1-11 Identifies Changes in Infrastructure, Data, Software, and Procedures Required to Remediate Incidents3no data
　　💼 CC8.1-12 Creates Baseline Configuration of IT Technology3no data
　　💼 CC8.1-13 Provides for Changes Necessary in Emergency Situations3no data
　　💼 CC8.1-14 Manages Patch Changes3no data
　　💼 CC8.1-15 Considers System Resilience3no data
　　💼 CC8.1-16 Protects Confidential Informationno data
　　💼 CC8.1-17 Protects Personal Informationno data
　　💼 CC8.1-18 Privacy by Designno data
💼 CC9 Risk Mitigation2no data
　💼 CC9.1 The entity identifies, selects, and develops risk mitigation activities for risks arising from potential business disruptions.2no data
　　💼 CC9.1-1 Considers Mitigation of Risks of Business Disruptionno data
　　💼 CC9.1-2 Considers the Use of Insurance to Mitigate Financial Impact Risksno data
　💼 CC9.2 The entity assesses and manages risks associated with vendors and business partners.13no data
　　💼 CC9.2-1 Establishes Requirements for Vendor and Business Partner Engagementsno data
　　💼 CC9.2-2 Identifies Vulnerabilitiesno data
　　💼 CC9.2-3 Assesses Vendor and Business Partner Risksno data
　　💼 CC9.2-4 Assigns Responsibility and Accountability for Managing Vendors and Business Partnersno data
　　💼 CC9.2-5 Establishes Communication Protocols for Vendors and Business Partnersno data
　　💼 CC9.2-6 Establishes Exception Handling Procedures From Vendors and Business Partnersno data
　　💼 CC9.2-7 Assesses Vendor and Business Partner Performanceno data
　　💼 CC9.2-8 Implements Procedures for Addressing Issues Identified During Vendor and Business Partner Assessmentsno data
　　💼 CC9.2-9 Implements Procedures for Terminating Vendor and Business Partner Relationshipsno data
　　💼 CC9.2-10 Obtains Confidentiality Commitments from Vendors and Business Partnersno data
　　💼 CC9.2-11 Assesses Compliance With Confidentiality Commitments of Vendors and Business Partnersno data
　　💼 CC9.2-12 Obtains Privacy Commitments from Vendors and Business Partnersno data
　　💼 CC9.2-13 Assesses Compliance with Privacy Commitments of Vendors and Business Partnersno data
💼 P1.0 Privacy Criteria Related to Notice and Communication of Objectives Related to Privacy1no data
　💼 P1.1 The entity provides notice to data subjects about its privacy practices to meet the entity's objectives related to privacy.7no data
　　💼 P1.1-1 Communicates to Data Subjectsno data
　　💼 P1.1-2 Provides Notice to Data Subjectsno data
　　💼 P1.1-3 Covers Entities and Activities in Noticeno data
　　💼 P1.1-4 Uses Clear Language and Presents a Current Privacy Notice in a Location Easily Found by Data Subjectsno data
　　💼 P1.1-5 Reviews the Privacy Noticeno data
　　💼 P1.1-6 Communicates Changes to Noticeno data
　　💼 P1.1-7 Retains Prior Noticesno data
💼 P2.0 Privacy Criteria Related to Choice and Consent1no data
　💼 P2.1 The entity communicates choices available regarding the collection, use, retention, disclosure, and disposal of personal information to the data subjects and the consequences, if any, of each choice.6no data
　　💼 P2.1-1 Communicates to Data Subjectsno data
　　💼 P2.1-2 Communicates Consequences of Denying or Withdrawing Consentno data
　　💼 P2.1-3 Obtains Implicit or Explicit Consentno data
　　💼 P2.1-4 Documents and Obtains Consent for New Purposes and Usesno data
　　💼 P2.1-5 Obtains Explicit Consent for Sensitive Informationno data
　　💼 P2.1-6 Obtains Consent for Data Transfersno data
💼 P3.0 Privacy Criteria Related to Collection2no data
　💼 P3.1 Personal information is collected consistent with the entity's objectives related to privacy.4no data
　　💼 P3.1-1 Limits the Collection of Personal Informationno data
　　💼 P3.1-2 Collects Information by Fair and Lawful Meansno data
　　💼 P3.1-3 Collects Information From Reliable Sourcesno data
　　💼 P3.1-4 Informs Data Subjects When Additional Information Is Acquiredno data
　💼 P3.2 For information requiring explicit consent, the entity communicates the need for such consent as well as the consequences of a failure to provide consent for the request for personal information and obtains the consent prior to the collection of the information to meet the entity's objectives related to privacy.2no data
　　💼 P3.2-1 Informs Data Subjects of Consequences of Failure to Provide Consentno data
　　💼 P3.2-2 Documents Explicit Consent to Retain Informationno data
💼 P4.0 Privacy Criteria Related to Use, Retention, and Disposal3no data
　💼 P4.1 The entity limits the use of personal information to the purposes identified in the entity's objectives related to privacy.1no data
　　💼 P4.1-1 Uses Personal Information for Intended Purposesno data
　💼 P4.2 The entity retains personal information consistent with the entity's objectives related to privacy.2no data
　　💼 P4.2-1 Retains Personal Informationno data
　　💼 P4.2-2 Protects Personal Informationno data
　💼 P4.3 The entity securely disposes of personal information to meet the entity's objectives related to privacy.3no data
　　💼 P4.3-1 Captures, Identifies, and Flags Requests for Deletionno data
　　💼 P4.3-2 Disposes of, Destroys, and Redacts Personal Informationno data
　　💼 P4.3-3 Destroys Personal Informationno data
💼 P5.0 Privacy Criteria Related to Access2no data
　💼 P5.1 The entity grants identified and authenticated data subjects the ability to access their stored personal information for review and, upon request, provides physical or electronic copies of that information to data subjects to meet the entity's objectives related to privacy.5no data
　　💼 P5.1-1 Responds to Data Controller Requestsno data
　　💼 P5.1-2 Authenticates Data Subjects' Identityno data
　　💼 P5.1-3 Permits Data Subjects Access to Their Personal Informationno data
　　💼 P5.1-4 Provides Understandable Personal Information Within Reasonable Timeno data
　　💼 P5.1-5 Informs Data Subjects If Access Is Deniedno data
　💼 P5.2 The entity corrects, amends, or appends personal information based on information provided by data subjects and communicates such information to third parties, as committed or required, to meet the entity's objectives related to privacy.4no data
　　💼 P5.2-1 Responds to Data Controller Requestsno data
　　💼 P5.2-2 Communicates Denial of Access Requestsno data
　　💼 P5.2-3 Permits Data Subjects to Update or Correct Personal Informationno data
　　💼 P5.2-4 Communicates Denial of Correction Requestsno data
💼 P6.0 Privacy Criteria Related to Disclosure and Notification7no data
　💼 P6.1 The entity discloses personal information to third parties with the explicit consent of data subjects and such consent is obtained prior to disclosure to meet the entity's objectives related to privacy.4no data
　　💼 P6.1-1 Communicates Privacy Policies to Third Partiesno data
　　💼 P6.1-2 Discloses Personal Information Only When Appropriateno data
　　💼 P6.1-3 Discloses Personal Information Only to Appropriate Third Partiesno data
　　💼 P6.1-4 Discloses Information to Third Parties for New Purposes and Usesno data
　💼 P6.2 The entity creates and retains a complete, accurate, and timely record of authorized disclosures of personal information to meet the entity's objectives related to privacy.1no data
　　💼 P6.2-1 Creates and Retains Record of Authorized Disclosuresno data
　💼 P6.3 The entity creates and retains a complete, accurate, and timely record of detected or reported unauthorized disclosures (including breaches) of personal information to meet the entity's objectives related to privacy.1no data
　　💼 P6.3-1 Creates and Retains Record of Detected or Reported Unauthorized Disclosuresno data
　💼 P6.4 The entity obtains privacy commitments from vendors and other third parties who have access to personal information to meet the entity's objectives related to privacy.3no data
　　💼 P6.4-1 Evaluates Third-Party Compliance With Privacy Commitmentsno data
　　💼 P6.4-2 Remediates Misuse of Personal Information by a Third Partyno data
　　💼 P6.4-3 Obtains Commitments to Report Unauthorized Disclosuresno data
　💼 P6.5 The entity obtains commitments from vendors and other third parties with access to personal information to notify the entity in the event of actual or suspected unauthorized disclosures of personal information.2no data
　　💼 P6.5-1 Remediates Misuse of Personal Information by a Third Partyno data
　　💼 P6.5-2 Reports Actual or Suspected Unauthorized Disclosuresno data
　💼 P6.6 The entity provides notification of breaches and incidents to affected data subjects, regulators, and others to meet the entity's objectives related to privacy.2no data
　　💼 P6.6-1 Identifies Reporting Requirementsno data
　　💼 P6.6-2 Provides Notice of Breaches and Incidentsno data
　💼 P6.7 The entity provides data subjects with an accounting of the personal information held and disclosure of the data subjects' personal information, upon the data subjects' request, to meet the entity's objectives related to privacy.3no data
　　💼 P6.7-1 Responds to Data Controller Requestsno data
　　💼 P6.7-2 Identifies Types of Personal Information and Handling Processno data
　　💼 P6.7-3 Captures, Identifies, and Communicates Requests for Informationno data
💼 P7.0 Privacy Criteria Related to Quality1no data
　💼 P7.1 The entity collects and maintains accurate, up-to-date, complete, and relevant personal information to meet the entity's objectives related to privacy.2no data
　　💼 P7.1-1 Ensures Accuracy and Completeness of Personal Informationno data
　　💼 P7.1-2 Ensures Relevance of Personal Informationno data
💼 P8.0 Privacy Criteria Related to Monitoring and Enforcement1no data
　💼 P8.1 The entity implements a process for receiving, addressing, resolving, and communicating the resolution of inquiries, complaints, and disputes from data subjects and others and periodically monitors compliance to meet the entity's objectives related to privacy.6no data
　　💼 P8.1-1 Communicates to Data Subjects or Data Controllersno data
　　💼 P8.1-2 Addresses Inquiries, Complaints, and Disputesno data
　　💼 P8.1-3 Documents and Communicates Dispute Resolution and Recourseno data
　　💼 P8.1-4 Documents and Reports Compliance Review Resultsno data
　　💼 P8.1-5 Documents and Reports Instances of Noncomplianceno data
　　💼 P8.1-6 Performs Ongoing Monitoringno data
💼 PI1 Additional Criteria for Processing Intergrity5no data
　💼 PI1.1 The entity obtains or generates, uses, and communicates relevant, quality information regarding the objectives related to processing, including definitions of data processed and product and service specifications, to support the use of products and services.3no data
　　💼 PI1.1-1 Identifies Functional and Nonfunctional Requirements and Information Specificationsno data
　　💼 PI1.1-2 Defines Data Necessary to Support a Product or Serviceno data
　　💼 PI1.1-3 Defines Information Necessary to Support the Use of a Good or Productno data
　💼 PI1.2 The entity implements policies and procedures over system inputs, including controls over completeness and accuracy, to result in products, services, and reporting to meet the entity's objectives.3no data
　　💼 PI1.2-1 Defines Characteristics of Processing Inputsno data
　　💼 PI1.2-2 Evaluates Processing Inputsno data
　　💼 PI1.2-3 Creates and Maintains Records of System Inputsno data
　💼 PI1.3 The entity implements policies and procedures over system processing to result in products, services, and reporting to meet the entity's objectives.5no data
　　💼 PI1.3-1 Defines Processing Specificationsno data
　　💼 PI1.3-2 Defines Processing Activitiesno data
　　💼 PI1.3-3 Detects and Corrects Processing or Production Activity Errorsno data
　　💼 PI1.3-4 Records System Processing Activitiesno data
　　💼 PI1.3-5 Processes Inputsno data
　💼 PI1.4 The entity implements policies and procedures to make available or deliver output completely, accurately, and timely in accordance with specifications to meet the entity's objectives.4no data
　　💼 PI1.4-1 Protects Outputno data
　　💼 PI1.4-2 Distributes Output Only to Intended Partiesno data
　　💼 PI1.4-3 Distributes Output Completely and Accuratelyno data
　　💼 PI1.4-4 Creates and Maintains Records of System Output Activitiesno data
　💼 PI1.5 The entity implements policies and procedures to store inputs, items in processing, and outputs completely, accurately, and timely in accordance with system specifications to meet the entity's objectives.4no data
　　💼 PI1.5-1 Protects Stored Itemsno data
　　💼 PI1.5-2 Archives and Protects System Recordsno data
　　💼 PI1.5-3 Stores Data Completely and Accuratelyno data
　　💼 PI1.5-4 Creates and Maintains Records of System Storage Activitiesno data