Analyze/catalog/frameworks/soc-2.json
|
{
"key": "SOC 2", "order": 8, "name": "SOC 2 Trust Services Criteria", "shortName": "SOC 2", "version": "2017 Trust Services Criteria (points of focus revised 2022)", "publisher": "AICPA", "type": "criteria", "url": "https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022", "retrieved": "2026-09-24", "mapping": "jsolve", "note": "Mapping by JSolve B.V.: which tests evidence a control is JSolve's assessment, not the publisher's. A control with tests is fully assessed only when they check everything about it that Azure configuration can show. Controls that do not concern the Azure environment (people, physical security, organization-wide governance, end-user devices, software development) are not applicable; the other controls without a test need evidence outside configuration. Criteria are listed by id with the heading of their series; the criteria text is not reproduced.", "controls": { "CC1.1": {"title":"Control Environment","applicability":"notApplicable"}, "CC1.2": {"title":"Control Environment","applicability":"notApplicable"}, "CC1.3": {"title":"Control Environment","applicability":"notApplicable"}, "CC1.4": {"title":"Control Environment","applicability":"notApplicable"}, "CC1.5": {"title":"Control Environment","applicability":"notApplicable"}, "CC2.1": {"title":"Communication and Information","applicability":"notApplicable"}, "CC2.2": {"title":"Communication and Information","applicability":"notApplicable"}, "CC2.3": {"title":"Communication and Information","applicability":"notApplicable"}, "CC3.1": {"title":"Risk Assessment","applicability":"notApplicable"}, "CC3.2": {"title":"Risk Assessment","applicability":"notApplicable"}, "CC3.3": {"title":"Risk Assessment","applicability":"notApplicable"}, "CC3.4": {"title":"Risk Assessment","applicability":"notApplicable"}, "CC4.1": {"title":"Monitoring Activities","coverage":"partial","tests":["AZ-GOV-001","AZ-GOV-002","AZ-GOV-009"]}, "CC4.2": {"title":"Monitoring Activities","applicability":"notApplicable"}, "CC5.1": {"title":"Control Activities","applicability":"notApplicable"}, "CC5.2": {"title":"Control Activities","applicability":"notApplicable"}, "CC5.3": {"title":"Control Activities","applicability":"notApplicable"}, "CC6.1": {"title":"Logical and Physical Access Controls","coverage":"partial","tests":["AZ-ACR-001","AZ-ACR-002","AZ-ACR-004","AZ-ACR-005","AZ-ADF-001","AZ-ADX-002","AZ-ADX-003","AZ-AI-001","AZ-AI-007","AZ-AKS-001","AZ-AKS-002","AZ-AKS-008","AZ-AKS-009","AZ-APIM-003","AZ-APP-004","AZ-APP-006","AZ-APP-009","AZ-APP-014","AZ-AUTO-001","AZ-AUTO-002","AZ-BOT-002","AZ-COS-001","AZ-FUNC-002","AZ-FUNC-004","AZ-IAM-013","AZ-IAM-014","AZ-IAM-022","AZ-IAM-024","AZ-IAM-026","AZ-IAM-027","AZ-IAM-029","AZ-IAM-030","AZ-KV-001","AZ-KV-005","AZ-KV-006","AZ-KV-007","AZ-KV-010","AZ-KV-011","AZ-LOGIC-001","AZ-LOGIC-003","AZ-LOGIC-004","AZ-LOGIC-005","AZ-LOGIC-006","AZ-MSG-001","AZ-MY-003","AZ-PAAS-002","AZ-PG-004","AZ-RED-002","AZ-SEC-001","AZ-SEC-002","AZ-SEC-003","AZ-SEC-004","AZ-SQL-003","AZ-SQL-004","AZ-SQL-007","AZ-SQL-008","AZ-STG-003","AZ-STG-004","AZ-STG-005","AZ-STG-011","AZ-STG-012","AZ-STG-013","AZ-STG-020","AZ-STG-021","AZ-STG-023","AZ-STG-024","AZ-VM-001","AZ-VM-002","AZ-VM-004"]}, "CC6.2": {"title":"Logical and Physical Access Controls","coverage":"partial","tests":["AZ-IAM-004","AZ-IAM-005","AZ-IAM-006","AZ-IAM-007","AZ-IAM-020"]}, "CC6.3": {"title":"Logical and Physical Access Controls","coverage":"partial","tests":["AZ-AKS-002","AZ-AKS-005","AZ-APIM-004","AZ-COS-003","AZ-GOV-005","AZ-IAM-001","AZ-IAM-002","AZ-IAM-003","AZ-IAM-004","AZ-IAM-005","AZ-IAM-008","AZ-IAM-009","AZ-IAM-010","AZ-IAM-011","AZ-IAM-012","AZ-IAM-015","AZ-IAM-016","AZ-IAM-017","AZ-IAM-018","AZ-IAM-019","AZ-IAM-021","AZ-IAM-023","AZ-KV-002","AZ-KV-009","AZ-MSG-001"]}, "CC6.4": {"title":"Logical and Physical Access Controls","applicability":"notApplicable"}, "CC6.5": {"title":"Logical and Physical Access Controls","applicability":"notApplicable"}, "CC6.6": {"title":"Logical and Physical Access Controls","coverage":"partial","tests":["AZ-ACI-001","AZ-ACR-003","AZ-ADX-001","AZ-AI-002","AZ-AI-003","AZ-AI-005","AZ-AI-006","AZ-AI-007","AZ-AKS-003","AZ-AKS-007","AZ-APIM-001","AZ-APP-005","AZ-APP-008","AZ-AVD-001","AZ-BOT-001","AZ-CAPP-002","AZ-COS-002","AZ-DB-001","AZ-DB-002","AZ-DBX-001","AZ-DBX-002","AZ-DBX-003","AZ-DBX-004","AZ-DBX-006","AZ-IAM-027","AZ-IAM-030","AZ-KV-003","AZ-KV-004","AZ-NET-001","AZ-NET-002","AZ-NET-003","AZ-NET-004","AZ-NET-005","AZ-NET-006","AZ-NET-007","AZ-NET-008","AZ-NET-009","AZ-NET-010","AZ-NET-011","AZ-NET-012","AZ-NET-015","AZ-NET-016","AZ-NET-017","AZ-NET-018","AZ-NET-019","AZ-NET-020","AZ-NET-021","AZ-NET-022","AZ-NET-023","AZ-PAAS-001","AZ-SQL-005","AZ-STG-006","AZ-STG-007","AZ-STG-008","AZ-STG-009","AZ-SYN-001","AZ-VM-011","AZ-VM-012"]}, "CC6.7": {"title":"Logical and Physical Access Controls","coverage":"partial","tests":["AZ-AI-003","AZ-AI-006","AZ-APIM-002","AZ-APIM-005","AZ-APIM-006","AZ-APP-001","AZ-APP-002","AZ-APP-003","AZ-BCK-005","AZ-BOT-003","AZ-CAPP-001","AZ-KV-008","AZ-MY-001","AZ-NET-007","AZ-NET-013","AZ-PAAS-003","AZ-PG-001","AZ-RED-001","AZ-SQL-006","AZ-STG-001","AZ-STG-002","AZ-STG-010","AZ-STG-018","AZ-STG-019","AZ-SYN-001"]}, "CC6.8": {"title":"Logical and Physical Access Controls","coverage":"partial","tests":["AZ-DEF-002","AZ-DEF-014","AZ-DEF-025","AZ-DFA-001","AZ-VM-003","AZ-VM-006"]}, "CC7.1": {"title":"System Operations","coverage":"partial","tests":["AZ-AKS-004","AZ-AKS-006","AZ-APIM-007","AZ-APP-012","AZ-DEF-001","AZ-DEF-003","AZ-DEF-008","AZ-DEF-009","AZ-DEF-015","AZ-DEF-016","AZ-DEF-017","AZ-DFA-002","AZ-DFA-003","AZ-DFA-004","AZ-GOV-001","AZ-GOV-002","AZ-GOV-008","AZ-GOV-009","AZ-GOV-010","AZ-SQL-009","AZ-VM-005","AZ-VM-007","AZ-VM-009","AZ-VM-013"]}, "CC7.2": {"title":"System Operations","coverage":"partial","tests":["AZ-BCK-006","AZ-DBX-005","AZ-DEF-002","AZ-DEF-003","AZ-DEF-004","AZ-DEF-005","AZ-DEF-006","AZ-DEF-007","AZ-DEF-008","AZ-DEF-009","AZ-DEF-010","AZ-DEF-011","AZ-DEF-012","AZ-DEF-013","AZ-DEF-023","AZ-LOG-001","AZ-LOG-002","AZ-LOG-003","AZ-LOG-004","AZ-LOG-005","AZ-LOG-006","AZ-LOG-007","AZ-LOG-008","AZ-LOG-009","AZ-LOG-010","AZ-LOG-011","AZ-LOG-012","AZ-LOG-013","AZ-LOG-014","AZ-LOG-015","AZ-LOG-017","AZ-LOG-018","AZ-LOG-020","AZ-LOG-021","AZ-LOG-023","AZ-LOG-025","AZ-MY-002","AZ-NET-019","AZ-NET-020","AZ-NET-024","AZ-NET-025","AZ-PG-002","AZ-PG-003","AZ-SQL-001","AZ-VM-008"]}, "CC7.3": {"title":"System Operations","coverage":"partial","tests":["AZ-DEF-018","AZ-DEF-019","AZ-DEF-020","AZ-DEF-021","AZ-DEF-022","AZ-DEF-023"]}, "CC7.4": {"title":"System Operations","coverage":"partial","tests":["AZ-DEF-022"]}, "CC7.5": {"title":"System Operations","applicability":"manual"}, "CC8.1": {"title":"Change Management","coverage":"partial","tests":["AZ-ADF-002"]}, "CC9.1": {"title":"Risk Mitigation","applicability":"notApplicable"}, "CC9.2": {"title":"Risk Mitigation","coverage":"partial","tests":["AZ-IAM-021","AZ-IAM-025"]}, "A1.1": {"title":"Additional Criteria for Availability","coverage":"partial","tests":["AZ-GOV-012"]}, "A1.2": {"title":"Additional Criteria for Availability","coverage":"partial","tests":["AZ-BCK-001","AZ-BCK-002","AZ-BCK-003","AZ-BCK-004","AZ-BCK-005","AZ-BCK-006","AZ-BCK-007","AZ-BCK-008","AZ-BCK-009","AZ-BCK-011","AZ-BCK-012","AZ-GOV-004","AZ-STG-014","AZ-STG-015","AZ-STG-016","AZ-STG-017","AZ-STG-022","AZ-VM-010"]}, "A1.3": {"title":"Additional Criteria for Availability","coverage":"partial","tests":["AZ-BCK-010"]}, "C1.1": {"title":"Additional Criteria for Confidentiality","coverage":"partial","tests":["AZ-DEF-024","AZ-SQL-010"]}, "C1.2": {"title":"Additional Criteria for Confidentiality","applicability":"manual"}, "PI1.1": {"title":"Additional Criteria for Processing Integrity","applicability":"notApplicable"}, "PI1.2": {"title":"Additional Criteria for Processing Integrity","applicability":"notApplicable"}, "PI1.3": {"title":"Additional Criteria for Processing Integrity","applicability":"notApplicable"}, "PI1.4": {"title":"Additional Criteria for Processing Integrity","applicability":"notApplicable"}, "PI1.5": {"title":"Additional Criteria for Processing Integrity","applicability":"notApplicable"}, "P1.1": {"title":"Privacy Criteria Related to Notice and Communication of Objectives Related to Privacy","applicability":"notApplicable"}, "P2.1": {"title":"Privacy Criteria Related to Choice and Consent","applicability":"notApplicable"}, "P3.1": {"title":"Privacy Criteria Related to Collection","applicability":"notApplicable"}, "P3.2": {"title":"Privacy Criteria Related to Collection","applicability":"notApplicable"}, "P4.1": {"title":"Privacy Criteria Related to Use, Retention, and Disposal","applicability":"notApplicable"}, "P4.2": {"title":"Privacy Criteria Related to Use, Retention, and Disposal","applicability":"notApplicable"}, "P4.3": {"title":"Privacy Criteria Related to Use, Retention, and Disposal","applicability":"notApplicable"}, "P5.1": {"title":"Privacy Criteria Related to Access","applicability":"notApplicable"}, "P5.2": {"title":"Privacy Criteria Related to Access","applicability":"notApplicable"}, "P6.1": {"title":"Privacy Criteria Related to Disclosure and Notification","applicability":"notApplicable"}, "P6.2": {"title":"Privacy Criteria Related to Disclosure and Notification","applicability":"notApplicable"}, "P6.3": {"title":"Privacy Criteria Related to Disclosure and Notification","applicability":"notApplicable"}, "P6.4": {"title":"Privacy Criteria Related to Disclosure and Notification","applicability":"notApplicable"}, "P6.5": {"title":"Privacy Criteria Related to Disclosure and Notification","applicability":"notApplicable"}, "P6.6": {"title":"Privacy Criteria Related to Disclosure and Notification","applicability":"notApplicable"}, "P6.7": {"title":"Privacy Criteria Related to Disclosure and Notification","applicability":"notApplicable"}, "P7.1": {"title":"Privacy Criteria Related to Quality","applicability":"notApplicable"}, "P8.1": {"title":"Privacy Criteria Related to Monitoring and Enforcement","applicability":"notApplicable"} } } |