SOC 2 (TSC 2017, rev 2022)

The organisation sets the tone for ethical behaviour from the top down, with leadership demonstrating and communicating a commitment to integrity and ethical values. A code of conduct is documented, communicated to all personnel, and reinforced through accountability mechanisms. Deviations from expected behaviour are investigated and addressed consistently.

The board of directors (or equivalent oversight body) operates independently from management and maintains the expertise needed to oversee the design and operation of internal controls. The board's accountability for security, availability, and related trust-service objectives is documented and exercised through regular review of management reports and independent audit findings.

Management establishes organisational structures, reporting lines, and authorities to support the achievement of the organisation's objectives. Roles are defined with clear accountability, and the structure is reviewed periodically to ensure it remains fit for purpose as the business evolves.

The organisation attracts, develops, and retains personnel with the skills needed to achieve its objectives, including those related to security and availability. Competency requirements are defined per role, gaps are identified through performance reviews, and training plans address shortfalls.

Management holds individuals accountable for their internal control responsibilities as part of the normal performance cycle. Metrics and incentives reinforce the importance of security and trust-service objectives rather than undermining them, and actions taken when objectives are not met are documented.

The organisation identifies and uses relevant, quality information to support the functioning of internal controls. Data sources — internal and external — are reviewed for relevance and reliability, and information flows are designed so decision-makers receive what they need, when they need it.

The organisation communicates internally about objectives, responsibilities, and control expectations so that personnel understand their role in achieving security and related trust-service commitments. Communication channels allow information to flow up, down, and across the organisation and support reporting of concerns without fear of reprisal.

The organisation communicates with external parties — customers, regulators, suppliers, and others — about matters relevant to its security commitments and trust-service obligations. Communication channels are established for receiving complaints, inquiries, and regulatory requests, and responses are documented.

The organisation specifies objectives with sufficient clarity to allow risks to those objectives to be identified and assessed. Service commitments and system requirements are documented as the basis against which risks are evaluated.

The organisation identifies risks to achieving its objectives and analyses them to determine how they should be managed. The risk assessment covers internal and external sources, considers the likelihood and impact of events, and distinguishes between risks the organisation can control and those it can only monitor.

The organisation considers the potential for fraud — including misappropriation of assets, fraudulent reporting, and the circumvention of controls — when assessing risks to its objectives. Risk assessment results are used to design controls that reduce fraud risk to an acceptable level.

The organisation identifies and assesses changes that could significantly affect the system of internal controls, including changes in the external environment, business model, personnel, and technology. A process exists to evaluate how proposed changes alter risk and to update controls before the change takes effect.

The organisation selects, develops, and performs ongoing and separate evaluations to determine whether internal control components function as designed. The scope, frequency, and method of evaluation are chosen based on the risk associated with each component, and results are documented.

Control deficiencies identified through monitoring are evaluated for severity and communicated to those responsible for remediation, including senior management and the board where appropriate. A remediation tracking process ensures deficiencies are addressed in a timely manner.

The organisation selects and develops control activities that mitigate risks to trust-service objectives to an acceptable level. Controls are selected with consideration of the cost-benefit relationship and the degree of automation versus manual operation, and are embedded in business processes rather than treated as add-ons.

The organisation selects and develops general controls over technology to support the achievement of its objectives. Technology infrastructure, security software, and operational processes are governed so that the reliability and integrity of technology-enabled controls is maintained.

Policies that establish expectations and procedures that put controls into daily operation are deployed, documented, and communicated to personnel. Policies are reviewed and updated to reflect changes in risk, regulation, or business objectives, and responsibility for their execution is clearly assigned.

The organisation implements logical access security software, infrastructure, and architectures that protect its information assets, including identification and authentication of users, network segmentation, and encryption of protected information. The design is documented and reviewed periodically to confirm it remains adequate.

Before issuing credentials to new internal and external users, the organisation registers them and verifies that appropriate authorisation has been obtained. Credentials are removed when access is no longer valid, and the process leaves an auditable trail.

The organisation authorises, changes, and removes access to systems, applications, and data based on roles, least privilege, and segregation of duties. Role definitions are reviewed when responsibilities change, and access that is no longer needed is removed or downgraded.

Physical access to facilities and protected information assets, such as offices, data centres, and equipment rooms, is restricted to authorised personnel. Access is granted, reviewed, and removed through a documented process, and entry to sensitive areas is controlled and recorded.

The organisation discontinues logical and physical protections over physical assets and media only after the data and software on them can no longer be read or recovered. Wiping, destruction, and re-use of equipment follow a documented procedure that leaves a record.

The organisation protects its systems from threats originating outside the boundaries of its network through firewalls, intrusion detection, and other boundary-protection controls. Configurations are reviewed periodically and updated as the threat landscape evolves.

The organisation restricts the transmission, movement, and removal of information to authorised users and processes, and protects it while it is in transit. Cryptographic standards are documented, keys are managed securely, and removable media are controlled.

Controls are in place to detect and prevent the introduction of malicious code into the environment, including endpoint protection, email filtering, and restrictions on software installation. Alerts are reviewed promptly and responses are documented.

The organisation maintains baseline configurations for infrastructure and applications and monitors for deviations. Vulnerability scans are performed on a regular schedule, findings are prioritised by risk, and remediation timelines are tracked to closure.

The organisation monitors system components for anomalous activity that could indicate a security event — including unusual login patterns, unexpected data transfers, and configuration changes. Monitoring output is reviewed on a defined schedule and escalated when thresholds are breached.

Suspected security events identified through monitoring are assessed to determine their nature, scope, and potential impact. A defined triage process distinguishes genuine incidents from false positives, and the outcome of each evaluation is documented.

The organisation responds to confirmed security incidents according to a documented incident response plan that covers containment, communication, evidence preservation, and recovery. Post-incident reviews identify root causes and drive improvements to controls and procedures.

The organisation identifies, develops, and implements activities to recover from identified security incidents. Recovery plans that restore affected systems and data are documented, tested periodically, and updated after each incident.

Changes to infrastructure, data, software, and procedures follow a formal change management process that includes authorisation, testing, approval, and documentation before deployment to production. Emergency changes are subject to expedited review and retrospective documentation to maintain the audit trail.

The organisation identifies scenarios that could disrupt its ability to meet its trust-service commitments and puts mitigation strategies in place to reduce the likelihood and impact of disruption. Business continuity and disaster recovery plans are documented, tested, and updated to reflect changes in the business and its dependencies.

The organisation identifies and manages the risks posed by vendors, business partners, and other third parties who interact with its systems or handle its data. Third-party risk assessments are performed before onboarding and reviewed periodically, and contractual obligations address the organisation's security and trust-service expectations.

The organisation monitors and manages current processing capacity to ensure it can meet availability commitments and system requirements. Capacity metrics are tracked and compared against established thresholds, and planning processes account for expected demand growth and peak-load scenarios.

The organisation addresses environmental threats and operational risks — power failures, hardware faults, natural disasters — that could affect system availability. Redundancy, failover mechanisms, and recovery procedures are designed and tested to ensure commitments can be met even when individual components fail.

The organisation tests recovery procedures to verify that systems can be restored within the timeframes required by its availability commitments. Recovery tests are documented, results are reviewed against defined recovery time and recovery point objectives, and shortfalls are addressed through remediation plans.

The organisation identifies confidential information throughout its lifecycle — collection, processing, storage, and disposal — and applies appropriate protections based on its classification. A data inventory records where confidential information resides and who is responsible for its protection.

Confidential information is disposed of securely when it is no longer needed, using methods appropriate to the medium and sensitivity of the data. Disposal records are retained as evidence that information was destroyed in accordance with the organisation's retention and disposal policy.

The organisation obtains or generates, uses, and communicates relevant, quality information about its processing objectives. This includes the definitions of the data processed and the specifications of the products and services that depend on them, so that everyone involved works from the same meaning.

The organisation implements policies and procedures over system inputs, including controls over completeness and accuracy, so that products, services, and reporting meet its objectives. Input validation controls detect and reject malformed or duplicate data, and exceptions are logged, investigated, and resolved.

The organisation implements policies and procedures over system processing so that products, services, and reporting meet its objectives. Controls detect incomplete or erroneous processing runs, and errors are captured in logs reviewed by accountable personnel who investigate and resolve discrepancies.

The organisation implements policies and procedures to make output available or deliver it completely, accurately, and in a timely manner, in accordance with specifications. Output reconciliation procedures verify that what was produced matches what was expected, and distribution logs provide an audit trail.

Data retained in storage is protected against unauthorised modification and remains complete and accurate over time. Integrity checks, access controls, and audit trails are applied to persistent data stores to detect and prevent corruption or tampering.

The organisation notifies individuals about its personal information collection, use, retention, and disclosure practices prior to or at the time of collection. Privacy notices are written in plain language, kept current, and made readily accessible to the individuals they describe.

The organisation offers individuals choices about how their personal information is collected, used, and disclosed, and obtains consent where required. Consent records are maintained, mechanisms exist to withdraw consent, and the organisation honours choices within the timeframes specified in its privacy commitments.

Personal information is collected only for the purposes identified in the organisation's privacy notice and with the knowledge of the affected individual. Collection is limited to what is adequate and relevant for those purposes, and collection methods are designed to avoid gathering unnecessary personal data.

Where personal information is sensitive — health data, financial data, government identifiers, and similar categories — the organisation obtains explicit consent before collection and applies heightened protective measures proportional to the sensitivity of the data.

Personal information is used only for the purposes identified at collection or subsequently consented to by the individual. Processes and technical controls prevent secondary use of personal data without appropriate authorisation, and any new uses are evaluated against privacy commitments before implementation.

Personal information is retained only as long as necessary to fulfil the identified purpose or to satisfy legal and regulatory obligations. A retention schedule defines periods per data type, automated or manual deletion processes enforce the schedule, and disposal is documented.

When personal information has reached the end of its retention period or is no longer needed, it is disposed of securely using methods that prevent reconstruction. Disposal procedures apply to all media — digital storage, paper records, and backup copies — and completion is recorded.

The organisation provides individuals with the ability to access their own personal information held by the organisation, within the timeframes and scope described in privacy commitments. Requests are verified for identity before data is disclosed, and responses are logged.

When an individual identifies inaccurate personal information held by the organisation, a process exists to correct, amend, or append the record. Corrections are applied across all systems where the data is stored, and the individual is informed of the outcome.

Personal information is disclosed to third parties only with the individual's consent or where permitted by applicable law, and only for the purposes described in the organisation's privacy notice. Disclosure events are logged so the organisation can demonstrate it has honoured its commitments.

The organisation keeps a complete, accurate, and timely record of the disclosures of personal information it has authorised, including what was disclosed, to whom, and for what purpose. The record is retained so the organisation can show that disclosures stayed within its commitments.

The organisation keeps a complete, accurate, and timely record of the unauthorised disclosures of personal information it detects or that are reported to it, including what was disclosed, to whom, and how it came to light. The record supports investigation and follow-up and shows how the organisation responded.

The organisation obtains privacy commitments from vendors and other third parties who have access to personal information, and those commitments are consistent with its own. The commitments are agreed before access is given and are reviewed over time.

The organisation obtains commitments from vendors and other third parties with access to personal information to notify it of breaches and incidents. The commitments set when and how the third party must report, so the organisation can respond in time.

The organisation notifies affected data subjects, regulators, and others of breaches and incidents involving personal information, in line with applicable law and its privacy commitments. A documented procedure governs who is notified, when, and how.

On request, the organisation provides data subjects with an accounting of the personal information it holds about them and has disclosed. The accounting is accurate and complete, and a documented process governs how such requests are received and answered.

The organisation maintains personal information that is accurate, complete, and current for the purposes for which it is used. Processes exist for individuals to update their information, for the organisation to validate data received from third parties, and for periodic reviews of data quality within critical systems.

The organisation monitors compliance with its privacy commitments and practices, and provides a mechanism for individuals to raise complaints or inquiries. Privacy-related complaints are tracked, investigated, and resolved within stated timeframes, and systemic issues identified through complaints feed back into policy and control improvements.