SOC 2 crosswalk
AICPA Trust Services Criteria used in SOC 2 reports
In short: SOC 2 reports test controls against the AICPA Trust Services Criteria. The criteria document sits behind a free AICPA account, and the public page we opened does not show criteria text. We therefore map no register control to a specific criterion and will add mappings once confirmed.
What does SOC 2 cover?
Attestation framework. Criteria text requires an AICPA account.
Which register controls map to SOC 2?
No register control is mapped to a specific part of SOC 2 yet, because we could not confirm the text.
What did we leave out, and why?
All criterion mappings, such as CC6 and CC7, were dropped, because we could not open the criteria text.
If you can point to the official text that supports a mapping, write to the desk.
Reviewed by The Register desk