SOC 2 Control Mapping

SOC 2 evaluates a service organisation against the AICPA Trust Services Criteria. The platform supplies technical controls aligned with the criteria; achieving an attestation is your administrator's project.

This mapping is organised by Trust Services Criterion and notes Platform (built-in), Administrator (administrator-configured), or Out of scope (organisational).

Common Criteria (CC)

CC1 - Control Environment

Administrator-owned. Documents your organisation's commitment to integrity, ethics, and oversight.

CC2 - Communication and Information

Administrator-owned. The platform provides clear technical documentation (this docs hub) you can reference.

CC3 - Risk Assessment

Administrator + Platform. The platform's compliance wizard supplies workflow-level risk assessment; the broader enterprise risk assessment is administrator-owned.

CC4 - Monitoring Activities

Administrator + Platform. Platform exposes metrics and audit trails. Administrator configures alerts and review cadence.

CC5 - Control Activities

Platform + Administrator. Platform enforces role-based access, validation, and versioning at the code level; administrator establishes review and change-approval procedures.

CC6 - Logical and Physical Access

Sub-criterion	Coverage	Notes
CC6.1 Logical access provisioning	Platform + Administrator	Identity provider; administrator manages users.
CC6.2 New users registration	Platform + Administrator	Self-service or manual via the identity provider; administrator policy.
CC6.3 Access removal	Platform + Administrator	Identity-provider deactivation cascades; administrator runs offboarding process.
CC6.6 Boundary protections	Platform + Administrator	Secure gateway; administrator configures TLS and firewall.
CC6.7 Restricted data flow	Platform	Local-first model inference; explicit external-provider opt-in.
CC6.8 Detection of unauthorised software	Administrator	Image scanning, runtime detection.

CC7 - System Operations

Sub-criterion	Coverage	Notes
CC7.1 Detection of system anomalies	Administrator	Configure monitoring alerts.
CC7.2 Monitoring of controls	Administrator	Your monitoring program.
CC7.3 Incident evaluation	Administrator	Your incident process; platform supplies forensics.
CC7.4 Incident response	Administrator	Runbook supplied as a template; administrator maintains.
CC7.5 Recovery from disruption	Administrator	Backup and restore are administrator-owned.

CC8 - Change Management

Platform + Administrator. Workflows are versioned with explicit publish. Application code follows a code-review and CI process. Administrator maintains the broader change-management policy.

CC9 - Risk Mitigation

Platform + Administrator. Compliance wizard captures workflow risk; administrator runs the enterprise risk register and vendor management.

Additional categories (when in scope)

Availability (A)

Sub-criterion	Coverage
A1.1 Capacity planning	Administrator
A1.2 Backup processes	Administrator
A1.3 Business continuity	Administrator

The platform supports availability through stateless application services, durable persistent stores, and async-job retry; the availability target is set and operated by the administrator.

Confidentiality (C)

Sub-criterion	Coverage
C1.1 Confidential information identification	Administrator
C1.2 Disposal of confidential information	Platform + Administrator

Encryption-at-rest support across the platform's data stores; TLS in transit. Disposal cascades through the platform's deletion paths.

Processing Integrity (PI)

Sub-criterion	Coverage
PI1.1 Processing integrity	Platform
PI1.4 Output accuracy	Platform
PI1.5 Output completeness	Platform

Workflow runs are recorded with status and result; failures are explicit; replay is possible from the run history.

Privacy (P)

For deployments that process personal data, the GDPR-aligned controls in GDPR cover the privacy criteria. Administrator maintains the privacy notice, consent records, and data subject request handling procedures.

Audit evidence

The platform's audit-evidence sources are documented in Audit evidence. Common SOC 2 evidence requests:

User access reviews - identity provider user/role exports.
Change management - version-control history, PR records, workflow version history.
Incident response - runbook, ticket history, postmortem records (administrator-owned).
System monitoring - monitoring dashboards and alert history.
Backup verification - administrator-maintained backup logs and restore-test records.

For an attestation, plan the evidence-collection workflow with your auditor and your administrator together; the platform supplies the data, but the administrator structures and presents it.