Comparison
SOC 2 vs Cyber Essentials
SOC 2 (Trust Services Criteria) · UK Cyber Essentials (NCSC) · data 2026-10-27
Requirement-level comparison of SOC 2 (Trust Services Criteria) and UK Cyber Essentials (NCSC), in both directions, derived from published crosswalks and ControlMapping's curated topics.
Of 5 UK Cyber Essentials (NCSC) requirements, 5 map to something in SOC 2, 0 are only loosely related, and 0 have no mapping in our data.
Cyber Essentials certifies five technical controls only; governance, risk assessment, incident response and backup are deliberately outside its scope. All links are editorial.
Mapped (5)
| Cyber Essentials | Requirement | Match | SOC 2 | Evidence |
|---|---|---|---|---|
| Technical controls · 5 | ||||
| CE 1 | Firewalls | Editorial | CC6.6 | Same topic: Firewall / Net Seg (editorial pick) |
| CE 2 | Secure Configuration | Editorial | CC5.2CC6.7CC7.1 | Same topic: Secure Config, Mobile Security (editorial pick) |
| CE 3 | Security Update Management | Editorial | CC6.1CC7.1 | Same topic: Asset Management, Vulnerability Mgmt, Patch Management (editorial pick) |
| CE 4 | User Access Control | Editorial | CC6.1CC6.2CC6.3+1 | Same topic: Access Control, Multi-Factor Auth, Privileged Access (editorial pick) |
| CE 5 | Malware protection | Editorial | CC6.8 | Same topic: Endpoint Protection (editorial pick) |
Of 61 SOC 2 (Trust Services Criteria) requirements, 9 map to something in Cyber Essentials, 1 are only loosely related, and 51 have no mapping in our data.
AICPA's SOC 2 mappings aren't openly licensed, so every SOC 2 link here is ControlMapping editorial: criteria we haven't mapped can't match. Processing-integrity (PI) criteria and most privacy (P) criteria have no equivalent in security frameworks.
Likely new work: SOC 2 requirements with no mapping to Cyber Essentials (51)
| SOC 2 | Requirement | Match | Cyber Essentials | Evidence |
|---|---|---|---|---|
| A1 Availability · 3 | ||||
| A1.1 | Capacity management to meet availability commitments | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| A1.2 | Environmental protections, backups and recovery infrastructure | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| A1.3 | Testing recovery plan procedures | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| C1 Confidentiality · 2 | ||||
| C1.1 | Identifying and protecting confidential information | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| C1.2 | Disposing of confidential information | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CC1 Control environment · 5 | ||||
| CC1.1 | Commitment to integrity and ethical values | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CC1.2 | Board independence and oversight of internal control | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CC1.3 | Structures, reporting lines, authorities and responsibilities | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CC1.4 | Commitment to attracting, developing and retaining competent people | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CC1.5 | Accountability for internal control responsibilities | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CC2 Communication and information · 3 | ||||
| CC2.1 | Quality information to support internal control | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CC2.2 | Internal communication of objectives and responsibilities | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CC2.3 | Communication with external parties | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CC3 Risk assessment · 4 | ||||
| CC3.1 | Objectives specified clearly enough to identify risks | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CC3.2 | Risk identification and analysis | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CC3.3 | Considering the potential for fraud | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CC3.4 | Identifying and assessing significant changes | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CC4 Monitoring activities · 2 | ||||
| CC4.1 | Ongoing and/or separate evaluations of controls | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CC4.2 | Communicating and remediating control deficiencies | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CC5 Control activities · 2 | ||||
| CC5.1 | Control activities that mitigate risks | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CC5.3 | Control activities deployed through policies and procedures | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CC6 Logical and physical access · 2 | ||||
| CC6.4 | Physical access restrictions | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CC6.5 | Protection of data when assets are disposed of | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CC7 System operations · 3 | ||||
| CC7.3 | Evaluating security events to determine if they are incidents | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CC7.4 | Responding to identified security incidents | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CC7.5 | Recovering from identified security incidents | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CC8 Change management · 1 | ||||
| CC8.1 | Change management for infrastructure, data and software | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CC9 Risk mitigation · 1 | ||||
| CC9.1 | Mitigating risks from business disruptions | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| P Privacy · 18 | ||||
| P1.1 | Privacy notice | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| P2.1 | Choice and consent | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| P3.1 | Collection limited to privacy objectives | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| P3.2 | Explicit consent where required | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| P4.1 | Use limited to privacy objectives | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| P4.2 | Retention of personal information | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| P4.3 | Disposal of personal information | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| P5.1 | Data subject access | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| P5.2 | Correction of personal information | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| P6.1 | Disclosure to third parties with consent | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| P6.2 | Record of authorized disclosures | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| P6.3 | Record of unauthorized disclosures | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| P6.4 | Privacy commitments from third parties | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| P6.5 | Notification by third parties of unauthorized disclosures | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| P6.6 | Breach notification to affected individuals | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| P6.7 | Accounting of disclosures to data subjects | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| P7.1 | Quality of personal information | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| P8.1 | Handling privacy inquiries, complaints and disputes | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| PI1 Processing integrity · 5 | ||||
| PI1.1 | Information about processing objectives | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| PI1.2 | Controls over system inputs | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| PI1.3 | Controls over system processing | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| PI1.4 | Controls over system outputs | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| PI1.5 | Storing inputs, items in processing and outputs | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
Check these: only loosely related (a shared CSF outcome, not a mapping) (1)
| SOC 2 | Requirement | Match | Cyber Essentials | Evidence |
|---|---|---|---|---|
| CC7 System operations · 1 | ||||
| CC7.2 | Monitoring system components for anomalies | CE 5 | Only shares CSF DE.CM-09: related, not a mapping | |
Mapped (9)
| SOC 2 | Requirement | Match | Cyber Essentials | Evidence |
|---|---|---|---|---|
| CC5 Control activities · 1 | ||||
| CC5.2 | General controls over technology | Editorial | CE 2 | Same topic: Secure Config (editorial pick) |
| CC6 Logical and physical access · 6 | ||||
| CC6.1 | Logical access security over information assets | Editorial | CE 3CE 4 | Same topic: Asset Management, Access Control, Multi-Factor Auth (editorial pick) |
| CC6.2 | User registration, authorization and removal | Editorial | CE 4 | Same topic: Access Control (editorial pick) |
| CC6.3 | Role-based access, least privilege and segregation of duties | Editorial | CE 4 | Same topic: Access Control, Privileged Access (editorial pick) |
| CC6.6 | Protection against threats from outside system boundaries | Editorial | CE 1 | Same topic: Firewall / Net Seg (editorial pick) |
| CC6.7 | Restricting transmission, movement and removal of information | Editorial | CE 2 | Same topic: Mobile Security (editorial pick) |
| CC6.8 | Preventing or detecting unauthorized or malicious software | Editorial | CE 5 | Same topic: Endpoint Protection (editorial pick) |
| CC7 System operations · 1 | ||||
| CC7.1 | Detecting configuration changes and new vulnerabilities | Editorial | CE 2CE 3 | Same topic: Secure Config, Vulnerability Mgmt, Patch Management (editorial pick) |
| CC9 Risk mitigation · 1 | ||||
| CC9.2 | Managing vendor and business partner risk | Editorial | CE 4 | Same topic: Cloud Security (editorial pick) |
By topic
Both cover (11):
Asset ManagementVulnerability MgmtAccess ControlMulti-Factor AuthPrivileged AccessFirewall / Net SegEndpoint ProtectionPatch ManagementSecure ConfigMobile SecurityCloud Security
Only SOC 2 (35):
Governance PolicyAwareness & TrainingRisk ManagementSupply Chain RiskRoles & ResponsibilitiesComplianceRisk AssessmentBusiness EnvironmentData ClassificationEncryptionData ProtectionBackup & RecoverySecure DevelopmentEmail SecurityWeb SecurityZero TrustWAFDLPCont. MonitoringLogging & AuditIntrusion DetectionAnomaly DetectionSIEM / SOCIncident ResponseForensicsCommunicationMitigationReportingRecovery PlanningBusiness ContinuityLessons LearnedComms & RestoreDisaster RecoveryVendor Risk MgmtPhysical Security
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Mapped = curated together in a ControlMapping topic, or linked directly. Crosswalks don't prove compliance. Methodology · Download the data · Report a mistake.