# SOC 2 Controls: Complete List, Examples, and Requirements for Compliance SOC 2 is often the gateway to compliance for most SaaS companies. Teams quickly learn that implementing SOC 2 controls cannot be done by following a checklist. It requires transparent processes, defined ownership, and diligent evidence of controls. For many SMBs, the challenge is not intention but interpretation. Documentation can feel abstract, the terminology can be confusing, and mapping the Trust Services Criteria to real-world operations can feel like guesswork. In this blog, we aim to provide a detailed breakdown of SOC 2 controls, explain what each one means in practice, and provide tips for building a control foundation that is clean, defensible, and easy to maintain. ## What are SOC 2 controls? SOC 2 controls are the policies, procedures, and technical safeguards an organization puts in place to protect customer data. They are mapped to the AICPA’s five Trust Services Criteria (TSCs), namely Security, Availability, Processing Integrity, Confidentiality, and Privacy. ### SOC 2 controls vs. requirements vs. criteria The terms controls, requirements, and criteria are often confused because they appear together throughout the SOC 2 journey. Many teams, especially those going through SOC 2 for the first time, use them interchangeably, leading to confusion about what auditors actually evaluate and what companies must implement. But in practice, this is how they differ: - **Criteria** define what you must achieve - **Requirements** define what you must prove - **Controls** define how you prove it through real and operational safeguards Below is a table that distinguishes these terms in the simplest way. | | | | | --- | --- | --- | | **Term** | **Meaning** | **Example** | | **Trust Services Criteria (TSC)** | High-level objectives defined by AICPA | “The system is protected against unauthorized access.” | | **SOC 2 Requirements** | What you must demonstrate to meet the criteria | Show how you enforce logical access controls. | | **SOC 2 Controls** | The specific actions/policies used to meet the requirement | MFA, RBAC, password rotation, and access reviews. | ## Full SOC 2 control list There are 5 SOC 2 criteria, namely the TSCs. The control groups fall under each TSC and have separate counts. Security is mandatory for every SOC 2 audit; the others are optional and added based on customer commitments, industry needs, or risk profile. ## Security controls Security controls form the foundation of SOC 2 as they address how your organization protects systems, people, and data. These nine common criteria (CC) series controls work together to ensure governance, risk awareness, effective monitoring, and operational stability. Let’s discuss them one by one. ### 1. Control environment It establishes the organizational culture, expectations, and governance needed to support a strong security posture. Common controls: - Code of conduct and ethics policy - Board/management oversight - Defined roles and responsibilities - Accountability mechanisms ### 2. Risk assessment These controls ensure you regularly identify, analyze, and prioritize risks that could impact systems or data. Common controls: - Formal risk register - Annual risk assessment - Threat and vulnerability identification - Risk treatment plans ### 3. Monitoring activities It validates the fact that the controls continue to operate effectively through ongoing reviews and automated oversight. Common controls: - Continuous monitoring tools - Internal audits - Automated alerts - Regular compliance reviews ### 4. Logical access controls These controls are known to prevent unauthorized system and data access through authentication, authorization, and lifecycle management. Common controls: - MFA everywhere - RBAC (Role-Based Access Control) - Password policies - User onboarding/offboarding workflows - Permission reviews ### 5. Physical access controls Physical access controls protect physical locations, devices, and on‑premise assets from unauthorized access or tampering. Common controls: - Restricted office entry - ID badges - CCTV - Secure server rooms ### 6. Change management controls These controls ensure that system, infrastructure, and software changes are reviewed, tested, and approved to prevent unintended risks. Common controls: - Pull request reviews - Configuration management - Patch management - Change approval workflows ### 7. System operations controls System operations controls monitor system performance, availability, and incidents to maintain operational stability and timely issue resolution. Common controls: - Logging and monitoring - Incident detection and response program - Root cause analysis - Uptime monitoring ### 8. Risk mitigation controls These controls implement safeguards and activities to minimize the likelihood and impact of identified risks. Common controls: - Vendor risk assessments - Business impact analysis - Documented risk treatment plans ### 9. Control activities Control activities define the procedures and policies that ensure your broader security program is consistently applied across the organization. Common controls: - Information security policy - Acceptable use policy - Data handling standards ## Availability controls Availability controls ensure your systems stay reliable and resilient during both normal operations and unexpected disruptions. ### 1. Infrastructure and capacity monitoring These controls ensure systems have adequate health, performance, and resource availability. It also helps in identifying performance issues early. Common controls mapped to this criteria are: - CPU, memory, and disk utilization monitoring - Automated performance alerts - Capacity planning reviews - Infrastructure scaling procedures ### 2. Backup and replication controls This control protects critical data by creating recoverable copies and ensuring integrity during restoration. Common controls mapped to this criteria are: - Automated backups with defined frequency - Data replication across availability zones - Backup integrity checks - Scheduled restore tests ### 3. Business continuity and disaster recovery These controls ensure operations can resume quickly after disruptions through the use of documented plans and regular testing. Common controls mapped to this criteria are: - Documented business continuity/disaster recovery plan - Annual DR simulation exercises - Recovery Time Objective (RTO) alignment - Vendor continuity evaluation ## Confidentiality controls Confidentiality controls safeguard sensitive information throughout its lifecycle and ensure access is tightly governed. ### 1. Restricting access to confidential data These controls ensure that only authorized individuals view or handle confidential information. Common controls mapped to this criteria are: - Role-Based Access Controls (RBAC) with least‑privilege permissions - Encryption at rest and in transit - Access approval workflows - Monitoring of privileged activity ### 2. Secure data deletion processes These controls ensure that confidential data is securely destroyed only when it is no longer required. Common controls mapped to this criteria are: - Secure wipe or cryptographic erasure - Data retention schedules - Decommissioning procedures - Vendor‑verified data deletion ## Processing Integrity controls Processing Integrity controls ensure that systems process data accurately, completely, and within expected timelines. ### 1. Data accuracy These controls ensure that information processed and stored is correct and free from errors. Common controls mapped to this criteria are: - Validation rules at data entry - Automated data quality checks - Reconciliation procedures ### 2. Data completeness These controls ensure that all required data is captured, stored, and processed accurately and without omission. Common controls mapped to this criteria are: - Workflow completeness checks - Logging of incomplete transactions - Source-to-destination verification ### 3. Data validity This control set ensures that data is reliable, complete, accurate, and collected with integrity for its intended purpose. Common controls mapped to this criteria are: - Input validation controls - Authorization workflows - Audit trails for data changes ### 4. Timeliness These controls ensure data is processed and delivered within defined time requirements. Common controls mapped to this criteria are: - SLA monitoring - Batch processing schedules - Alerts for processing delays ### 5. System monitoring These controls ensure issues affecting processing quality are detected and resolved quickly. Common controls mapped to this criteria are: - Error logging and triage - Automated anomaly detection - Incident escalation workflows ## Privacy controls Privacy controls govern how personally identifiable data (PII) is collected, used, stored, disclosed, and deleted while upholding user rights. These controls ensure transparency, accountability, and lawful data practices. ### 1. Consent and notice These controls ensure individuals understand what data is collected and how it will be used. Common controls mapped to this criteria are: - Public privacy notices - Consent banners or checkboxes - Version tracking for notices ### 2. Collection and use These controls ensure personal data is gathered lawfully and used only for stated purposes. Common controls mapped to this criteria are: - Data minimization procedures - Purpose-based access controls - PII classification guidelines ### 3. Access and disclosure These controls determine who can view, modify, or share personal information. Common controls mapped to this criteria are: - Access request workflows - Disclosure approval logs - Encryption controls ### 4. Data retention and deletion These controls ensure personal data is stored only as long as needed and securely removed afterward. Common controls mapped to this criteria are: - Retention schedule enforcement - Automated data deletion mechanisms - Secure wipe or anonymization ### 5. Quality assurance These controls ensure personal data remains accurate, relevant, and up to date. Common controls mapped to this criteria are: - Periodic accuracy reviews - Customer data correction workflows ### 6. Monitoring and incident response These controls ensure privacy breaches are detected, investigated, and resolved quickly. Common controls mapped to this criteria are: - Privacy incident reporting workflows - Breach notification procedures - Continuous monitoring tools ### 7. Privacy training These controls ensure employees understand their responsibilities when handling PII. Common controls mapped to this criteria are: - Mandatory privacy training - Annual refresher modules ### 8. Handling complaints or requests These controls ensure individuals can exercise rights such as access, correction, or deletion. Common controls mapped to this criteria are: - Data subject request (DSR) workflows - Identity verification procedures - Response time tracking ## SOC 2 common criteria The SOC 2 Common Criteria (CC-series) represent the foundational pillars auditors use to evaluate whether your organization’s security program is structured, governed, monitored, and maintained effectively. ### CC1.0: Control environment Establishes the governance, ethics, accountability, and leadership oversight that define your organization’s security culture. ### CC2.0: Communication and information Ensures important security information flows consistently across teams so members understand their responsibilities. ### CC3.0: Risk assessment Identifies and analyzes internal and external risks that may prevent the organization from achieving its security objectives. ### CC4.0: Monitoring activities Evaluates how well controls operate over time through reviews, automated monitoring, and audits. ### CC5.0: Control activities Implements policies and procedures that enforce security practices and ensure consistent operational behavior. ### CC6.0: Logical and physical access Controls who can access systems, data, facilities, and infrastructure to prevent unauthorized use. ### CC7.0: System operations Ensures systems are monitored, maintained, and supported to detect issues and resolve incidents efficiently. ### CC8.0: Change management Manages updates to systems and applications in a controlled, reviewed, and approved manner to avoid unintended risks. ### CC9.0: Risk mitigation Implements mechanisms that reduce the likelihood and impact of identified risks, ensuring resilience.