simpl.
로그인
사이버보안 GRC 22개 항목

SOC 2 Trust Services Criteria Readiness Assessment

이 체크리스트는 영어로 제공됩니다.

Evaluates readiness for a SOC 2 Type II examination across the AICPA Common Criteria and the Availability and Confidentiality categories.

SOC 2AICPA TSC

무료 PDF 또는 Word · 이메일을 입력하면 다운로드할 수 있습니다.

Control Environment (CC1)

  • Is there a documented code of conduct that all personnel acknowledge? *
  • Does the board or an equivalent oversight body operate independently of management and review security matters? *
  • Are organizational structures, reporting lines, and authorities documented? *
  • Are background checks performed on new hires prior to granting system access? *
  • Are individuals held accountable for internal control responsibilities through performance evaluations? *

Communication & Information (CC2)

  • Are security commitments and system requirements communicated to internal users? *
  • Are security responsibilities communicated to external users, vendors, and partners? *
  • Is there a defined channel for personnel to report security issues or control failures? *

Risk Assessment (CC3)

  • Are specific, measurable security objectives defined for the system? *
  • Is a formal risk assessment performed at least annually to identify threats to objectives? *
  • Is the potential for fraud considered when assessing risks? *
  • Are changes that could significantly affect the system of internal control identified and assessed? *

Monitoring Activities (CC4)

  • Are ongoing and separate evaluations performed to verify controls are operating? *
  • Are identified control deficiencies communicated to parties responsible for corrective action? *
  • When was the most recent internal control self-assessment completed?

Control Activities & Availability (CC5, A1)

  • Are control activities selected and developed to mitigate risks to acceptable levels? *
  • Are technology general controls over infrastructure implemented? *
  • Is capacity monitored and forecast to meet availability commitments? *
  • Are environmental protections, backups, and recovery infrastructure maintained and tested? *
  • Are recovery plan procedures tested to meet availability objectives? *

Confidentiality (C1)

  • Is confidential information identified and maintained per commitments and requirements? *
  • Is confidential information disposed of securely when no longer required? *

SOC 2 Trust Services Criteria Readiness Assessment 체크리스트 전체 다운로드

인쇄하기 좋은 PDF 또는 편집 가능한 Word 문서로 무료로 받으세요.