← Frameworks / SOC 2 TSC / Control Mappings

Machine-readable: JSON API guide

SOC 2 Trust Services Criteria

Trust Services Criteria for security, availability, processing integrity, confidentiality, and privacy. Used for SOC 2 attestation engagements.

Controls: 126
Total Mappings: 579
Publisher: AICPA Version: 2017
SOC 2 TSC → SP 800-53 SP 800-53 → SOC 2 TSC Coverage Analysis
AC (8) AT (2) AU (7) CA (6) CM (9) CP (8) IA (5) IR (5) MA (1) MP (3) PE (15) PL (4) PS (8) PT (3) RA (6) SA (8) SC (11) SI (9) SR (8)

AC Access Control

Control Name SOC 2 TSC References
AC-01 Policy and Procedures
CC1.2-POF1CC1.4-POF1CC2.2-POF1CC2.2-POF7CC5.3CC5.3-POF1CC5.3-POF6CC6.1CC6.1-POF3CC6.1-POF7CC6.1-POF8CC6.1-POF9CC6.6CC6.6-POF2CC6.6-POF3CC7.2-POF1P1.1-POF5
AC-02 Account Management
CC6.1CC6.6CC6.6-POF2
AC-03 Access Enforcement
CC6.1CC6.6CC6.6-POF2
AC-04 Information Flow Enforcement
CC6.1CC6.1-POF6CC6.6CC6.6-POF1
AC-05 Separation of Duties
CC5.1CC6.6CC6.6-POF2
AC-06 Least Privilege
CC6.1CC6.1-POF7
AC-17 Remote Access
CC6.6CC6.6-POF3
AC-20 Use of External Systems
CC6.7

AT Awareness and Training

Control Name SOC 2 TSC References
AT-01 Policy and Procedures
CC1.2-POF1CC1.4CC1.4-POF1CC1.4-POF3CC2.2-POF1CC2.2-POF7CC5.3CC5.3-POF1CC5.3-POF6CC7.2-POF1P1.1-POF5
AT-06 Training Feedback
CC1.4CC1.4-POF2

AU Audit and Accountability

Control Name SOC 2 TSC References
AU-01 Policy and Procedures
CC1.2-POF1CC1.4-POF1CC2.2-POF1CC2.2-POF7CC5.3CC5.3-POF1CC5.3-POF6CC7.2CC7.2-POF1P1.1-POF5
AU-02 Event Logging
CC6.1-POF7CC6.7-POF1CC7.1CC7.1-POF1CC7.2CC7.2-POF1CC7.3CC8.1PI1.4
AU-03 Content of Audit Records
PI1.4
AU-06 Audit Record Review, Analysis, and Reporting
CC7.2CC7.2-POF1CC7.3
AU-07 Audit Record Reduction and Report Generation
CC7.2CC7.3
AU-09 Protection of Audit Information
PI1.4PI1.5
AU-11 Audit Record Retention
C1.2

CA Security Assessment and Authorization

Control Name SOC 2 TSC References
CA-01 Policy and Procedures
CC1.2-POF1CC1.4-POF1CC2.2-POF1CC2.2-POF7CC4.1CC5.3CC5.3-POF1CC5.3-POF6CC6.1-POF2CC6.1-POF9CC7.2-POF1P1.1-POF5
CA-02 Control Assessments
CC1.1-POF3CC3.1CC4.1CC5.2CC6.1-POF2
CA-05 Plan of Action and Milestones
CC4.2
CA-06 Authorization
CC6.1-POF9
CA-07 Continuous Monitoring
CC1.1CC1.1-POF3CC2.2CC2.3CC4.2-POF1CC4.2-POF2
CA-09 Internal System Connections
CC6.1CC7.1

CM Configuration Management

Control Name SOC 2 TSC References
CM-01 Policy and Procedures
CC1.2-POF1CC1.4-POF1CC2.2-POF1CC2.2-POF7CC5.3CC5.3-POF1CC5.3-POF6CC7.1CC7.1-POF1CC7.2-POF1P1.1-POF5
CM-02 Baseline Configuration
CC6.1-POF7CC6.7-POF1CC7.1CC7.1-POF1CC8.1
CM-03 Configuration Change Control
CC3.4CC8.1CC8.1-POF1
CM-04 Impact Analyses
CC3.4
CM-06 Configuration Settings
CC6.1-POF7CC6.7-POF1CC7.1CC7.1-POF1CC8.1
CM-07 Least Functionality
CC6.1-POF7CC6.7-POF1
CM-08 System Component Inventory
CC6.1-POF1
CM-12 Information Location
C1.1CC6.1-POF1
CM-13 Data Action Mapping
CC6.7P1.3P1.4P1.5P1.6P1.7

CP Contingency Planning

Control Name SOC 2 TSC References
CP-01 Policy and Procedures
A1.2A1.2-POF1A1.2-POF2A1.2-POF3CC1.2-POF1CC1.4-POF1CC2.2-POF1CC2.2-POF7CC5.3CC5.3-POF1CC5.3-POF6CC7.2-POF1CC7.4-POF5CC7.5CC9.1CC9.1-POF1P1.1-POF5
CP-02 Contingency Plan
A1.2A1.2-POF1A1.2-POF2A1.2-POF3CC7.4-POF5CC7.5CC9.1CC9.1-POF1
CP-04 Contingency Plan Testing
A1.3CC7.4-POF10CC7.5
CP-06 Alternate Storage Site
A1.2
CP-07 Alternate Processing Site
A1.2
CP-08 Telecommunications Services
A1.2
CP-09 System Backup
A1.2CC7.5
CP-10 System Recovery and Reconstitution
A1.2A1.2-POF1A1.2-POF2A1.2-POF3CC7.4-POF5CC7.5CC9.1CC9.1-POF1

IA Identification and Authentication

Control Name SOC 2 TSC References
IA-01 Policy and Procedures
CC1.2-POF1CC1.4-POF1CC2.2-POF1CC2.2-POF7CC5.3CC5.3-POF1CC5.3-POF6CC6.1CC6.1-POF3CC6.1-POF7CC6.1-POF8CC6.1-POF9CC6.6CC6.6-POF2CC6.6-POF3CC7.2-POF1P1.1-POF5
IA-02 Identification and Authentication (Organizational Users)
CC6.1CC6.1-POF3CC6.1-POF4CC6.1-POF8
IA-03 Device Identification and Authentication
CC6.1CC6.1-POF3CC6.1-POF8
IA-04 Identifier Management
CC6.1CC6.1-POF3CC6.1-POF4CC6.6CC6.6-POF2CC6.6-POF3
IA-05 Authenticator Management
CC6.1

IR Incident Response

Control Name SOC 2 TSC References
IR-01 Policy and Procedures
CC1.2-POF1CC1.4-POF1CC2.2-POF1CC2.2-POF3CC2.2-POF7CC2.2-POF10CC5.3CC5.3-POF1CC5.3-POF6CC7.2-POF1CC7.3CC7.3-POF1CC7.4CC7.4-POF1CC7.4-POF2CC7.4-POF3CC7.4-POF4CC7.4-POF5CC7.4-POF6CC7.4-POF10CC7.4-POF11CC7.4-POF12CC7.4-POF13P1.1-POF5
IR-04 Incident Handling
CC2.2-POF3CC2.2-POF10CC7.3CC7.3-POF1CC7.4CC7.4-POF1CC7.4-POF2CC7.4-POF3CC7.4-POF4CC7.4-POF5CC7.4-POF6CC7.4-POF10CC7.4-POF11CC7.4-POF12CC7.4-POF13
IR-05 Incident Monitoring
CC7.4CC7.4-POF6
IR-06 Incident Reporting
CC2.3CC2.3-POF1CC7.4CC7.4-POF6CC7.4-POF13
IR-09 Information Spillage Response
CC7.4

MA Maintenance

Control Name SOC 2 TSC References
MA-01 Policy and Procedures
CC1.2-POF1CC1.4-POF1CC2.2-POF1CC2.2-POF7CC5.3CC5.3-POF1CC5.3-POF6CC7.2-POF1P1.1-POF5

MP Media Protection

Control Name SOC 2 TSC References
MP-01 Policy and Procedures
C1.1CC1.2-POF1CC1.4-POF1CC2.1CC2.2-POF1CC2.2-POF7CC5.3CC5.3-POF1CC5.3-POF6CC6.5CC6.7CC7.2-POF1P1.1-POF5PI1.5
MP-02 Media Access
C1.1
MP-06 Media Sanitization
CC6.5

PE Physical and Environmental Protection

Control Name SOC 2 TSC References
PE-01 Policy and Procedures
A1.2A1.2-POF1A1.2-POF2A1.2-POF3CC1.2-POF1CC1.4-POF1CC2.2-POF1CC2.2-POF7CC5.3CC5.3-POF1CC5.3-POF6CC6.4CC7.2-POF1P1.1-POF5
PE-02 Physical Access Authorizations
CC6.4
PE-03 Physical Access Control
CC6.4
PE-05 Access Control for Output Devices
PI1.4
PE-09 Power Equipment and Cabling
A1.2
PE-10 Emergency Shutoff
A1.2
PE-11 Emergency Power
A1.2
PE-12 Emergency Lighting
A1.2
PE-13 Fire Protection
A1.2
PE-14 Environmental Controls
A1.2A1.2-POF2
PE-15 Water Damage Protection
A1.2
PE-16 Delivery and Removal
A1.2
PE-17 Alternate Work Site
A1.2
PE-18 Location of System Components
A1.2
PE-19 Information Leakage
A1.2

PL Planning

Control Name SOC 2 TSC References
PL-01 Policy and Procedures
CC1.2-POF1CC1.4-POF1CC1.5CC2.2CC2.2-POF1CC2.2-POF7CC2.3CC3.1CC3.4CC5.2CC5.3CC5.3-POF1CC5.3-POF6CC7.2-POF1P1.1-POF5PI1.2PI1.3
PL-02 System Security and Privacy Plans
C1.1-POF1CC2.1CC4.1
PL-04 Rules of Behavior
CC1.1
PL-09 Central Management
CC1.1CC5.3

PS Personnel Security

Control Name SOC 2 TSC References
PS-01 Policy and Procedures
CC1.1CC1.1-POF1CC1.1-POF3CC1.2-POF1CC1.4CC1.4-POF1CC1.4-POF2CC1.4-POF3CC2.2-POF1CC2.2-POF3CC2.2-POF7CC3.3-POF1CC5.3CC5.3-POF1CC5.3-POF6CC7.2-POF1P1.1-POF5
PS-02 Position Risk Designation
CC1.2CC1.2-POF1CC1.3CC1.4-POF2CC1.5CC5.3
PS-04 Personnel Termination
CC1.5
PS-05 Personnel Transfer
CC1.5
PS-06 Access Agreements
CC1.5
PS-07 External Personnel Security
CC5.3
PS-08 Personnel Sanctions
CC1.1-POF4CC1.5
PS-09 Position Descriptions
CC1.4CC1.5

PT Personally Identifiable Information Processing and Transparency

Control Name SOC 2 TSC References
PT-01 Policy and Procedures
CC1.2-POF1CC1.4-POF1CC2.2CC2.2-POF1CC2.2-POF7CC3.2CC5.1CC5.2CC5.3CC5.3-POF1CC5.3-POF6CC6.1-POF2CC7.2-POF1P1.0P1.1-POF5
PT-03 Personally Identifiable Information Processing Purposes
P1.1-POF1
PT-05 Privacy Notice
P1.1P1.1-POF1P1.1-POF5

RA Risk Assessment

Control Name SOC 2 TSC References
RA-01 Policy and Procedures
A1.2-POF1CC1.2-POF1CC1.4-POF1CC2.2-POF1CC2.2-POF7CC3.1CC3.2-POF1CC3.4-POF1CC3.4-POF2CC3.4-POF3CC4.1CC5.1CC5.3CC5.3-POF1CC5.3-POF6CC7.2-POF1CC9.1P1.1-POF5
RA-02 Security Categorization
CC3.2
RA-03 Risk Assessment
A1.2CC3.2-POF1CC3.4-POF1CC3.4-POF2CC3.4-POF3CC4.1CC7.3
RA-05 Vulnerability Monitoring and Scanning
CC7.1CC9.2-POF13
RA-07 Risk Response
CC3.2CC9.1
RA-09 Criticality Analysis
CC3.1CC9.1

SA System and Services Acquisition

Control Name SOC 2 TSC References
SA-01 Policy and Procedures
CC1.2-POF1CC1.4-POF1CC2.2-POF1CC2.2-POF7CC5.2CC5.3CC5.3-POF1CC5.3-POF6CC7.2-POF1P1.1-POF5PI1.1PI1.2PI1.3PI1.4PI1.5
SA-02 Allocation of Resources
CC1.4CC4.1
SA-03 System Development Life Cycle
CC5.2CC8.1CC8.1-POF1
SA-04 Acquisition Process
CC1.4-POF2CC1.4-POF3CC2.3-POF12CC3.3CC3.4CC5.2CC9.1CC9.2CC9.2-POF1PI1.2PI1.3
SA-05 System Documentation
CC6.1-POF1
SA-08 Security and Privacy Engineering Principles
CC2.2CC3.2CC5.1CC5.2CC6.1-POF2CC6.1-POF7CC6.7-POF1CC7.1CC7.1-POF1CC8.1
SA-09 External System Services
CC3.3
SA-11 Developer Testing and Evaluation
CC4.1-POF1

SC System and Communications Protection

Control Name SOC 2 TSC References
SC-01 Policy and Procedures
CC1.2-POF1CC1.4-POF1CC2.2CC2.2-POF1CC2.2-POF7CC3.2CC5.1CC5.2CC5.3CC5.3-POF1CC5.3-POF6CC6.1CC6.1-POF2CC6.1-POF5CC6.6CC6.6-POF1CC6.6-POF2CC6.6-POF3CC7.2-POF1P1.1-POF5
SC-05 Denial-of-service Protection
A1.1A1.1-POF1
SC-06 Resource Availability
A1.1
SC-07 Boundary Protection
CC6.1CC6.1-POF5CC6.6CC6.6-POF1CC6.6-POF3CC6.8
SC-08 Transmission Confidentiality and Integrity
CC6.1CC6.7
SC-12 Cryptographic Key Establishment and Management
CC6.1
SC-13 Cryptographic Protection
CC6.1CC6.6-POF2CC6.7
SC-17 Public Key Infrastructure Certificates
CC6.1
SC-24 Fail in Known State
A1.2CC7.4-POF5
SC-42 Sensor Capability and Data
P1.0P1.3
SC-45 System Time Synchronization
CC7.1CC7.2

SI System and Information Integrity

Control Name SOC 2 TSC References
SI-01 Policy and Procedures
CC1.2-POF1CC1.4-POF1CC2.2CC2.2-POF1CC2.2-POF7CC3.2CC5.1CC5.2CC5.3CC5.3-POF1CC5.3-POF6CC6.1-POF2CC7.2-POF1P1.1-POF5
SI-02 Flaw Remediation
CC9.2-POF13
SI-03 Malicious Code Protection
CC6.6CC6.6-POF2CC6.8CC9.2-POF13
SI-04 System Monitoring
CC6.6CC6.6-POF2CC7.2CC7.2-POF1CC7.3
SI-05 Security Alerts, Advisories, and Directives
CC6.6CC6.6-POF2CC9.2-POF13
SI-07 Software, Firmware, and Information Integrity
CC6.6CC6.6-POF2CC6.8
SI-10 Information Input Validation
CC6.6CC6.6-POF2
SI-12 Information Management and Retention
C1.2CC6.5PI1.5
SI-18 Personally Identifiable Information Quality Operations
P1.8P1.9

SR Supply Chain Risk Management

Control Name SOC 2 TSC References
SR-01 Policy and Procedures
CC1.2-POF1CC1.4-POF1CC1.4-POF2CC1.4-POF3CC2.2-POF1CC2.2-POF7CC2.3-POF12CC3.3CC5.3CC5.3-POF1CC5.3-POF6CC7.2-POF1CC9.1CC9.2CC9.2-POF1P1.1-POF5
SR-02 Supply Chain Risk Management Plan
CC3.1CC3.2CC4.1CC9.1CC9.2CC9.2-POF1
SR-03 Supply Chain Controls and Processes
CC9.1
SR-05 Acquisition Strategies, Tools, and Methods
CC3.3CC9.1
SR-06 Supplier Assessments and Reviews
CC1.4-POF2CC1.4-POF3CC3.4CC9.1CC9.2-POF13
SR-07 Supply Chain Operations Security
CC2.2CC3.1CC3.2CC4.1CC9.2CC9.2-POF1
SR-08 Notification Agreements
CC2.3-POF12CC9.2-POF13
SR-12 Component Disposal
CC6.5