Policies & Standards — SOC 2

What this set does

A SOC 2 auditor tests the controls you say you have. This set gives you the policies and standards that define those controls across all five trust categories, with a criteria-to-control matrix you can hand to your auditor as the starting point for the system description.

What's inside

• Policies and standards for the Common Criteria (CC1–CC9)
• Additional criteria standards: Availability, Confidentiality, Processing Integrity, Privacy
• Criteria-to-control matrix
• System description outline (Section 3) template
• Control ownership and evidence schedule
• Mapping workbook: TSC to ISO 27002 and CSF 2.0

Who it is for

SaaS and service organisations preparing for a Type I or Type II examination.

How the documents are structured

Every document opens with its purpose, scope and owner, then the substantive content, then a control cross-reference showing which framework requirements it satisfies. Standards state requirements in testable language ("must", with the parameter). Procedures follow one format: trigger, roles, steps, frequency, records produced. Placeholders are limited to things only you can know: organisation name (which we fill in), system names, role titles, tool names and timelines. There are no "[insert policy here]" sections.

Tailoring effort

Expect to spend a few hours on a policies-and-standards set and longer on procedures, because procedures describe how your team actually works. The document register in each set lists every file with a suggested owner so you can split the work.

Licence

One purchase covers one organisation for internal use, with unlimited users and unlimited edits. Consultancies and MSPs tailoring documents for clients need the multi-client licence; see the terms or ask us.