SOC 2

The entity demonstrates a commitment to integrity and ethical values.

The board of directors demonstrates independence from management and exercises oversight of the development and performance of internal control.

Management establishes, with board oversight, structures, reporting lines, and appropriate authorities and responsibilities in the pursuit of objectives.

The entity demonstrates a commitment to attract, develop, and retain competent individuals in alignment with objectives.

The entity holds individuals accountable for their internal control responsibilities in the pursuit of objectives.

The entity obtains or generates and uses relevant, quality information to support the functioning of internal control.

The entity internally communicates information, including objectives and responsibilities for internal control, necessary to support the functioning of internal control.

The entity communicates with external parties regarding matters affecting the functioning of internal control.

The entity specifies objectives with sufficient clarity to enable the identification and assessment of risks relating to objectives.

The entity identifies risks to the achievement of its objectives across the entity and analyses risks as a basis for determining how the risks should be managed.

The entity considers the potential for fraud in assessing risks to the achievement of objectives.

The entity identifies and assesses changes that could significantly impact the system of internal control.

The entity selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning.

The entity evaluates and communicates internal control deficiencies in a timely manner to those responsible for taking corrective action.

The entity selects and develops control activities that contribute to the mitigation of risks to the achievement of objectives to acceptable levels.

The entity also selects and develops general control activities over technology to support the achievement of objectives.

The entity deploys control activities through policies that establish what is expected and procedures that put policies into action.

The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events.

Prior to issuing system credentials and granting system access, the entity registers and authorises new internal and external users, and removes access when it is no longer required.

The entity authorises, modifies, or removes access to data, software, functions, and other protected information assets based on roles, responsibilities, and the principle of least privilege.

The entity restricts physical access to facilities and protected information assets to authorised personnel.

The entity discontinues logical and physical protections over physical assets only after the ability to read or recover data has been diminished, and is no longer required to meet objectives.

The entity implements logical access security measures to protect against threats from sources outside its system boundaries.

The entity restricts the transmission, movement, and removal of information to authorised internal and external users and processes, and protects it during transmission, movement, or removal.

The entity implements controls to prevent or detect and act upon the introduction of unauthorised or malicious software.

The entity uses detection and monitoring procedures to identify changes to configurations that result in the introduction of new vulnerabilities, and susceptibilities to newly discovered vulnerabilities.

The entity monitors system components and the operation of controls to detect anomalies that are indicative of malicious acts, natural disasters, or errors affecting the entity's ability to meet its objectives.

The entity evaluates security events to determine whether they could or did result in a failure to meet objectives, and, if so, takes actions to prevent or address such failures.

The entity responds to identified security incidents by executing a defined incident response programme to understand, contain, remediate, and communicate security incidents, as appropriate.

The entity identifies, develops, and implements activities to recover from identified security incidents.

The entity authorises, designs, develops or acquires, configures, documents, tests, approves, and implements changes to infrastructure, data, software, and procedures to meet its objectives.

The entity identifies, develops, and implements activities to mitigate risk arising from potential business disruptions.

The entity assesses and manages risks associated with vendors and business partners.

The entity maintains, monitors, and evaluates current processing capacity and use of system components to manage capacity demand and to enable the implementation of additional capacity to help meet its objectives.

The entity authorises, designs, develops or acquires, implements, operates, approves, maintains, and monitors environmental protections, software, data backup processes, and recovery infrastructure to meet its objectives.

The entity tests recovery plan procedures supporting system recovery to meet its objectives.

The entity identifies and maintains confidential information to meet its objectives related to confidentiality.

The entity disposes of confidential information to meet its objectives related to confidentiality.

The entity obtains or generates, uses, and communicates relevant, quality information regarding the objectives related to processing integrity to support the use of the entity's products and services.

The entity implements policies and procedures over system inputs, including controls over completeness and accuracy, to result in products, services, and reporting to meet the entity's objectives.

The entity implements policies and procedures over system processing to result in products, services, and reporting to meet the entity's objectives.

The entity implements policies and procedures to make available or deliver output completely, accurately, and timely in accordance with specifications to meet the entity's objectives.

The entity implements policies and procedures to store inputs, items in processing, and outputs completely, accurately, and timely in accordance with system specifications to meet the entity's objectives.