# SOC 2 Control Mapping

> Map your controls to the AICPA Trust Services Criteria – the artifact
> auditors test line by line. TSC 2017 (revised 2022) structure;
> original writing, criteria are referenced not reproduced.

| Field | Value |
|-------|-------|
| Doc ID | DOC-SOC2-NNN |
| System | [system description ref] |
| Owner | @name |
| Audit period | YYYY-MM-DD to YYYY-MM-DD |
| Status | Draft / Audit-ready |

## Categories in scope

- [ ] Security (CC – always required)
- [ ] Availability (A)
- [ ] Processing Integrity (PI)
- [ ] Confidentiality (C)
- [ ] Privacy (P)

## Common Criteria (CC) mapping

For each criterion: the control that satisfies it, evidence, owner,
test frequency. Gaps get a remediation row.

### CC – Control environment

| Criterion | Control | Evidence | Owner | Test freq | Status |
|-----------|---------|----------|-------|-----------|--------|
| CC1.x (integrity, competence) | [code of conduct, onboarding] | [artifact] | @name | Annual | |
| CC2.x (communication) | [policy distribution] | | | | |
| CC3.x (risk assessment) | [risk register ref] | | | | |
| CC4.x (monitoring) | [internal audit ref] | | | | |
| CC5.x (control activities) | [policy/procedure set] | | | | |

### CC6 – Logical access

| Criterion | Control | Evidence | Owner | Status |
|-----------|---------|----------|-------|--------|
| CC6.1 (access provisioning) | [joiner/mover/leaver process] | tickets + approval logs | @name | |
| CC6.2-6.3 (auth, deprovisioning) | [SSO + MFA + offboard SLA] | config export | | |
| CC6.6-6.8 (boundary, encryption) | [network controls] | | | |

### CC7 – System operations

| Criterion | Control | Evidence | Owner | Status |
|-----------|---------|----------|-------|--------|
| CC7.1-7.2 (monitoring, vuln mgmt) | [detection + patch SLA] | scan reports | | |
| CC7.3-7.4 (incident response) | [IR plan + postmortems] | | | |

### CC8 – Change management

| Criterion | Control | Evidence | Owner | Status |
|-----------|---------|----------|-------|--------|
| CC8.1 (changes authorized/tested) | [PR review + CI gates] | PR history | | |

### CC9 – Risk mitigation

| Criterion | Control | Evidence | Owner | Status |
|-----------|---------|----------|-------|--------|
| CC9.1-9.2 (vendor + continuity) | [vendor assessment + BCP] | | | |

## Availability / PI / Confidentiality / Privacy criteria

Map only the categories in scope:

| Criterion | Control | Evidence | Status |
|-----------|---------|----------|--------|
| A1.x | [backup, DR, capacity] | | |
| PI1.x | [processing integrity] | | |
| C1.x | [confidentiality] | | |
| P1.x | [notice, choice, collection, disposal] | | |

## Gap register

| Gap | Criterion | Remediation | Owner | Due |
|-----|-----------|-------------|-------|-----|
| | | | @name | YYYY-MM-DD |

## Evidence index

| Control | Evidence artifact | Location | Freshness rule |
|---------|-------------------|----------|----------------|
| | | | |