Free SOC 2 Checklist 2025 — 117 Controls Organized by Domain

Logical access security software, infrastructure, and architectures are implemented to protect against threats from sources outside the system boundaries.

Prior to issuing system credentials and granting system access, the entity registers and authorizes new internal and external users.

The entity authorizes, modifies, or removes access to data, software, functions, and other protected information assets based on approved roles and need-to-know.

Logical access security measures restrict access to information assets, including hardware, data, software, administrative authorities, mobile devices, and remote access points.

The entity restricts the transmission, movement, and removal of information to authorized internal and external users and processes, and protects it during transmission.

The entity implements controls to prevent or detect and act upon the introduction of unauthorized or malicious software to meet the entity's objectives.

Current processing capacity and usage are maintained, monitored, and evaluated to manage capacity demand and enable the implementation of additional capacity to help meet the entity's availability commitments.

Environmental protections, software, data backup processes, and recovery infrastructure are designed, developed, implemented, operated, approved, maintained, and monitored to meet the entity's availability commitments.

Recovery plan procedures supporting system recovery are tested to meet the entity's availability commitments and system requirements.

Procedures exist to prevent, detect, and correct processing errors to meet the entity's processing integrity commitments and system requirements.

System processing is complete, valid, accurate, timely, and authorized to meet the entity's processing integrity commitments and system requirements.

System inputs are tested for completeness, accuracy, and validity. Output is complete, accurate, and distributed according to system requirements.

Confidential information is identified and classified according to the entity's commitments and system requirements. Encryption is applied as required.

Confidential information is protected during the system design, development, testing, implementation, and change management processes to meet the entity's objectives.

The entity provides notice to data subjects about its privacy practices to meet the entity's objectives related to privacy, including: the types of personal information collected.

Personal information is collected consistent with the entity's objectives related to privacy. Choices are available to individuals for collection, use, and retention of personal information.

Personal information is used, retained, and disposed of to meet the entity's objectives. Access to personal information is restricted to authorized users.