Framework

SOC 2 (Trust Services Criteria): what it anchors in a questionnaire

The attestation US customers ask for by name. A question that names SOC 2 reaches past an ISO 27001 certificate even where the topic is the same.

The criteria text is not held in full here, so it is not quoted: each criterion is named by its code and title, with the evidence an assessor usually asks for. Ticked by default for bank, hospital or health plan, card merchant or payment processor, software company and other customer customers.

Families anchored here

16 families, 12 clauses cited

Family	Clause
Information security policy	CC5.3
Risk assessment	CC3.2
Independent audit and certification	CC4.1
Multi-factor authentication	CC6.1
Password policy	CC6.1
Access provisioning and review	CC6.2
Encryption at rest	CC6.1
Logging and monitoring	CC7.2
Vulnerability and patch management	CC7.1
Secure development and change	CC8.1
Incident response plan	CC7.4
Notifying the customer of an incident	CC7.4
Business continuity plan	A1.3
Backup and disaster recovery	A1.2
Subcontractors and subprocessors	CC9.2
Assessing your own suppliers	CC9.2

Every SOC 2 clause the register cites, with its text and evidence