حوكمة ومخاطر وامتثال الأمن السيبراني (GRC) 22 بند
SOC 2 Trust Services Criteria Readiness Assessment
قائمة التحقق هذه باللغة الإنجليزية.
Evaluates readiness for a SOC 2 Type II examination across the AICPA Common Criteria and the Availability and Confidentiality categories.
SOC 2AICPA TSC
PDF أو Word مجانًا · أدخل بريدك الإلكتروني للتنزيل.
Control Environment (CC1)
- Is there a documented code of conduct that all personnel acknowledge? *
- Does the board or an equivalent oversight body operate independently of management and review security matters? *
- Are organizational structures, reporting lines, and authorities documented? *
- Are background checks performed on new hires prior to granting system access? *
- Are individuals held accountable for internal control responsibilities through performance evaluations? *
Communication & Information (CC2)
- Are security commitments and system requirements communicated to internal users? *
- Are security responsibilities communicated to external users, vendors, and partners? *
- Is there a defined channel for personnel to report security issues or control failures? *
Risk Assessment (CC3)
- Are specific, measurable security objectives defined for the system? *
- Is a formal risk assessment performed at least annually to identify threats to objectives? *
- Is the potential for fraud considered when assessing risks? *
- Are changes that could significantly affect the system of internal control identified and assessed? *
Monitoring Activities (CC4)
- Are ongoing and separate evaluations performed to verify controls are operating? *
- Are identified control deficiencies communicated to parties responsible for corrective action? *
- When was the most recent internal control self-assessment completed?
Control Activities & Availability (CC5, A1)
- Are control activities selected and developed to mitigate risks to acceptable levels? *
- Are technology general controls over infrastructure implemented? *
- Is capacity monitored and forecast to meet availability commitments? *
- Are environmental protections, backups, and recovery infrastructure maintained and tested? *
- Are recovery plan procedures tested to meet availability objectives? *
Confidentiality (C1)
- Is confidential information identified and maintained per commitments and requirements? *
- Is confidential information disposed of securely when no longer required? *
نزّل قائمة تحقق SOC 2 Trust Services Criteria Readiness Assessment كاملة
احصل عليها مجانًا بصيغة PDF أنيقة قابلة للطباعة أو مستند Word قابل للتعديل.