Controls

89 controls from our SOC 2 Type II report, grouped into six areas.

Corporate security
26
Governance, people, risk and vendor management.
- CA-01Organizational Structure
- CA-02Code of Conduct
- CA-03Management Review Meetings
- CA-04Enterprise Risk Assessment
- CA-05Policy Review Cycle
Show 21 moreShow fewerCorporate security controls
- CA-06Roles and Responsibilities
- CA-07Background Screening
- CA-08Employee Onboarding
- CA-09Security Awareness Training
- CA-39Client Agreements and SOWs
- CA-40Client Change Communication
- CA-41Confidentiality Agreements
- CA-52Vendor Due Diligence
- CA-53Vendor Reassessment
- CA-54Subservice Organization Assurance
- CA-67Management Reporting
- CA-68KPI Monitoring
- CA-69Deficiency Remediation Tracking
- CA-70Internal Control Review
- CA-71Security Accountability
- CA-86Open Risk and Incident Review
- CA-90Control Effectiveness Monitoring
- CA-36Service Request Tracking
- CA-37Ticket Ageing Review
- CA-38Service Commitment Monitoring
- CA-66Software License Review
Data security
23
Access control, confidentiality, privacy and encryption.
- CA-10Separation Notification
- CA-11Access Provisioning Approval
- CA-12Privileged Access Restriction
- CA-13Periodic Access Review
- CA-14Timely Access Revocation
Show 18 moreShow fewerData security controls
- CA-15Password and MFA Enforcement
- CA-72Segregation of Duties
- CA-73Security Exception Approval
- CA-42Data Classification
- CA-43Confidential Data Access Restriction
- CA-44Secure External Transfer
- CA-45Data Loss Prevention
- CA-46Data Retention
- CA-47Secure Media Disposal
- CA-80Encryption at Rest and in Transit
- CA-48Privacy Notice
- CA-49Purpose Limitation
- CA-50Personal Data Access Restriction
- CA-51Data Subject Requests
- CA-88Privacy Terms in Agreements
- CA-89Personal Data Handling
- CA-64Asset Inventory
- CA-65Asset Assignment and Lifecycle
Product security
16
Monitoring, incident response, availability and processing integrity.
- CA-17Security Alert Review
- CA-19Security Log Retention
- CA-20Vulnerability Scanning
- CA-22Incident Management
- CA-23Incident Escalation
Show 11 moreShow fewerProduct security controls
- CA-30Processing Error Tracking
- CA-31Capacity and Performance Monitoring
- CA-32Backup Execution
- CA-33Recovery Testing
- CA-34Business Continuity and DR Plans
- CA-35Availability Incident Management
- CA-75Time Synchronization
- CA-81Output Review and Approval
- CA-82Data Reconciliation
- CA-83Exception Investigation
- CA-85Scheduled Job Monitoring
Network and endpoint security
6
Perimeter, remote access, device protection, hardening and patching.
- CA-18Network Perimeter and Firewall
- CA-79Secure Remote Access
- CA-16Endpoint Protection
- CA-76Configuration Baselines and Hardening
- CA-77Non-Compliant Device Remediation
Show 1 moreShow fewerNetwork and endpoint security controls
- CA-78Security Patch Management
App security
9
Secure development and change management.
- CA-24Change Approval Workflow
- CA-25Pre-Production Testing
- CA-26Emergency Change Review
- CA-27Source Code and Pipeline Access
- CA-28Development Task Tracking
Show 4 moreShow fewerApp security controls
- CA-29Release Review and Approval
- CA-74New Technology Security Review
- CA-84Automated Logic Review
- CA-87System Documentation
Physical and environmental security
9
Office access, surveillance and environmental safeguards.
- CA-55Physical Access Control
- CA-56Visitor Management
- CA-57CCTV Surveillance
- CA-58Fire Detection and Suppression
- CA-59Power and Environmental Controls
Show 4 moreShow fewerPhysical and environmental security controls
- CA-60Emergency Drills
- CA-61Facility Access Review
- CA-62Emergency Response Communication
- CA-63Preparedness Exercises

Each control's full description and Trust Services Criteria are in the SOC 2 Type II report, shared under NDA.

Controls

Corporate security

Data security

Product security

Network and endpoint security

App security

Physical and environmental security