SOC 2 Control Mapping
Map your controls to the AICPA Trust Services Criteria – the artifact
auditors test line by line. TSC 2017 (revised 2022) structure;
original writing, criteria are referenced not reproduced.
| Field | Value |
|---|
| Doc ID | DOC-SOC2-NNN |
| System | [system description ref] |
| Owner | @name |
| Audit period | YYYY-MM-DD to YYYY-MM-DD |
| Status | Draft / Audit-ready |
Categories in scope
Common Criteria (CC) mapping
For each criterion: the control that satisfies it, evidence, owner,
test frequency. Gaps get a remediation row.
CC – Control environment
| Criterion | Control | Evidence | Owner | Test freq | Status |
|---|
| CC1.x (integrity, competence) | [code of conduct, onboarding] | [artifact] | @name | Annual | |
| CC2.x (communication) | [policy distribution] | | | | |
| CC3.x (risk assessment) | [risk register ref] | | | | |
| CC4.x (monitoring) | [internal audit ref] | | | | |
| CC5.x (control activities) | [policy/procedure set] | | | | |
CC6 – Logical access
| Criterion | Control | Evidence | Owner | Status |
|---|
| CC6.1 (access provisioning) | [joiner/mover/leaver process] | tickets + approval logs | @name | |
| CC6.2-6.3 (auth, deprovisioning) | [SSO + MFA + offboard SLA] | config export | | |
| CC6.6-6.8 (boundary, encryption) | [network controls] | | | |
CC7 – System operations
| Criterion | Control | Evidence | Owner | Status |
|---|
| CC7.1-7.2 (monitoring, vuln mgmt) | [detection + patch SLA] | scan reports | | |
| CC7.3-7.4 (incident response) | [IR plan + postmortems] | | | |
CC8 – Change management
| Criterion | Control | Evidence | Owner | Status |
|---|
| CC8.1 (changes authorized/tested) | [PR review + CI gates] | PR history | | |
CC9 – Risk mitigation
| Criterion | Control | Evidence | Owner | Status |
|---|
| CC9.1-9.2 (vendor + continuity) | [vendor assessment + BCP] | | | |
Availability / PI / Confidentiality / Privacy criteria
Map only the categories in scope:
| Criterion | Control | Evidence | Status |
|---|
| A1.x | [backup, DR, capacity] | | |
| PI1.x | [processing integrity] | | |
| C1.x | [confidentiality] | | |
| P1.x | [notice, choice, collection, disposal] | | |
Gap register
| Gap | Criterion | Remediation | Owner | Due |
|---|
| | | @name | YYYY-MM-DD |
Evidence index
| Control | Evidence artifact | Location | Freshness rule |
|---|
| | | |