框架
SOC 2 (Trust Services Criteria)
概述
这是 AICPA 制定的框架，用于就服务机构的控制措施是否符合信任服务标准出具报告。信任服务标准包括：安全性（必含），以及可选的可用性、保密性、处理完整性和隐私。
适用人群
服务机构，尤其是软件和云服务公司，其客户需要在托付数据之前获得保证。这是一种市场期望，主要来自美国客户，并非法律要求。
评估方式
由持牌注册会计师事务所对控制措施进行审查并出具报告：Type I 涵盖某一时点的设计情况，Type II 涵盖通常为 3 至 12 个月期间的运行有效性。该认证不颁发证书。参见如何获取 SOC 2 报告。
61
标准
41
映射到其他框架
92%
已覆盖主题（46/50）
AICPA 的 SOC 2 映射未采用开放许可，因此此处所有 SOC 2 链接均为 ControlMapping 编辑判断：我们未映射的标准条款无法匹配。处理完整性（PI）标准条款以及大多数隐私（P）标准条款在安全框架中没有对应内容。
对比分析
要求
要求编号和标题均按各框架官方发布的英文原文显示。
| ID | 要求 | 主题 | 映射于 |
|---|---|---|---|
| A1 Availability · 3 | |||
| A1.1 | Capacity management to meet availability commitments | 业务连续性 | 8 / 13 |
| A1.2 | Environmental protections, backups and recovery infrastructure | 备份与恢复, 业务连续性, 灾难恢复 | 11 / 13 |
| A1.3 | Testing recovery plan procedures | 恢复规划, 灾难恢复 | 10 / 13 |
| C1 Confidentiality · 2 | |||
| C1.1 | Identifying and protecting confidential information | 数据分类 | 9 / 13 |
| C1.2 | Disposing of confidential information | 数据保护 | 11 / 13 |
| CC1 Control environment · 5 | |||
| CC1.1 | Commitment to integrity and ethical values | 治理政策 | 9 / 13 |
| CC1.2 | Board independence and oversight of internal control | 角色与职责 | 9 / 13 |
| CC1.3 | Structures, reporting lines, authorities and responsibilities | 角色与职责 | 9 / 13 |
| CC1.4 | Commitment to attracting, developing and retaining competent people | 意识与培训 | 10 / 13 |
| CC1.5 | Accountability for internal control responsibilities | 角色与职责 | 9 / 13 |
| CC2 Communication and information · 3 | |||
| CC2.1 | Quality information to support internal control | — | 1 / 13 |
| CC2.2 | Internal communication of objectives and responsibilities | 意识与培训 | 10 / 13 |
| CC2.3 | Communication with external parties | 沟通, 报告, 沟通与恢复 | 12 / 13 |
| CC3 Risk assessment · 4 | |||
| CC3.1 | Objectives specified clearly enough to identify risks | 风险管理, 业务环境 | 10 / 13 |
| CC3.2 | Risk identification and analysis | 风险评估 | 10 / 13 |
| CC3.3 | Considering the potential for fraud | 风险评估 | 10 / 13 |
| CC3.4 | Identifying and assessing significant changes | 风险评估 | 10 / 13 |
| CC4 Monitoring activities · 2 | |||
| CC4.1 | Ongoing and/or separate evaluations of controls | 合规 | 10 / 13 |
| CC4.2 | Communicating and remediating control deficiencies | 合规 | 10 / 13 |
| CC5 Control activities · 3 | |||
| CC5.1 | Control activities that mitigate risks | 风险管理 | 10 / 13 |
| CC5.2 | General controls over technology | 安全配置 | 9 / 13 |
| CC5.3 | Control activities deployed through policies and procedures | 治理政策 | 9 / 13 |
| CC6 Logical and physical access · 8 | |||
| CC6.1 | Logical access security over information assets | 资产管理, 访问控制, 多因素认证, 加密 | 13 / 13 |
| CC6.2 | User registration, authorization and removal | 访问控制 | 11 / 13 |
| CC6.3 | Role-based access, least privilege and segregation of duties | 访问控制, 特权访问 | 12 / 13 |
| CC6.4 | Physical access restrictions | 物理安全 | 8 / 13 |
| CC6.5 | Protection of data when assets are disposed of | 数据保护 | 11 / 13 |
| CC6.6 | Protection against threats from outside system boundaries | 防火墙 / 网络分段, Web 安全, 零信任, WAF | 9 / 13 |
| CC6.7 | Restricting transmission, movement and removal of information | 加密, 移动安全, DLP | 11 / 13 |
| CC6.8 | Preventing or detecting unauthorized or malicious software | 终端防护, 邮件安全 | 10 / 13 |
| CC7 System operations · 5 | |||
| CC7.1 | Detecting configuration changes and new vulnerabilities | 漏洞管理, 补丁管理, 安全配置 | 13 / 13 |
| CC7.2 | Monitoring system components for anomalies | 持续监控, 日志与审计, 入侵检测, 异常检测 | 11 / 13 |
| CC7.3 | Evaluating security events to determine if they are incidents | SIEM / SOC, 事件响应 | 12 / 13 |
| CC7.4 | Responding to identified security incidents | 事件响应, 取证分析, 缓解 | 12 / 13 |
| CC7.5 | Recovering from identified security incidents | 恢复规划, 经验教训, 沟通与恢复 | 11 / 13 |
| CC8 Change management · 1 | |||
| CC8.1 | Change management for infrastructure, data and software | 安全开发 | 8 / 13 |
| CC9 Risk mitigation · 2 | |||
| CC9.1 | Mitigating risks from business disruptions | 风险管理, 业务连续性 | 10 / 13 |
| CC9.2 | Managing vendor and business partner risk | 供应链风险, 云安全, 供应商风险管理 | 12 / 13 |
| P Privacy · 18 | |||
| P1.1 | Privacy notice | — | 无 |
| P2.1 | Choice and consent | — | 无 |
| P3.1 | Collection limited to privacy objectives | — | 无 |
| P3.2 | Explicit consent where required | — | 无 |
| P4.1 | Use limited to privacy objectives | — | 无 |
| P4.2 | Retention of personal information | — | 1 / 13 |
| P4.3 | Disposal of personal information | — | 1 / 13 |
| P5.1 | Data subject access | — | 无 |
| P5.2 | Correction of personal information | — | 无 |
| P6.1 | Disclosure to third parties with consent | — | 无 |
| P6.2 | Record of authorized disclosures | — | 无 |
| P6.3 | Record of unauthorized disclosures | — | 无 |
| P6.4 | Privacy commitments from third parties | — | 无 |
| P6.5 | Notification by third parties of unauthorized disclosures | — | 无 |
| P6.6 | Breach notification to affected individuals | — | 1 / 13 |
| P6.7 | Accounting of disclosures to data subjects | — | 无 |
| P7.1 | Quality of personal information | — | 无 |
| P8.1 | Handling privacy inquiries, complaints and disputes | — | 无 |
| PI1 Processing integrity · 5 | |||
| PI1.1 | Information about processing objectives | — | 无 |
| PI1.2 | Controls over system inputs | — | 无 |
| PI1.3 | Controls over system processing | — | 无 |
| PI1.4 | Controls over system outputs | — | 无 |
| PI1.5 | Storing inputs, items in processing and outputs | — | 无 |
主题覆盖情况
已映射 SOC 2 要求的主题（46）：
治理政策意识与培训风险管理供应链风险角色与职责合规资产管理风险评估业务环境数据分类漏洞管理访问控制多因素认证加密数据保护备份与恢复特权访问防火墙 / 网络分段终端防护补丁管理安全配置安全开发邮件安全Web 安全零信任移动安全云安全WAFDLP持续监控日志与审计入侵检测异常检测SIEM / SOC事件响应取证分析沟通缓解报告恢复规划业务连续性经验教训沟通与恢复灾难恢复供应商风险管理物理安全
本站数据中无映射 无 SOC 2 要求（4）：