SOC2-C1.1 C1.1 Identifying and maintaining confidential information
SOC2-C1.1 in SOC 2 (the AICPA 2017 Trust Services Criteria with the revised points of focus). All SOC 2 controls held. Open SOC 2 on the standards site.
The control as we hold it
C1.1 Identifying and maintaining confidential information. Confidential information is identified and kept in line with the organisation's confidentiality objectives. Points of focus: procedures define confidential information and identify and designate it when received or created, and set how long it is kept; it is protected from erasure or destruction during that period; and, added in 2022, it is kept no longer than the identified purpose needs unless a law or regulation requires otherwise.
Reviewed and closest counterparts in the other frameworks
Reviewed rows come from a released pair; a closest match is the nearest held text and is not a reviewed row.
HIPAA Security Rule
- 164.306 Security Standards: General Rules (closest match)
- 164.308(a)(1)(ii)(A) Risk Analysis (Required) (closest match)
- 164.308(a)(4)(ii)(A) Isolating Health Care Clearinghouse Functions (Required if applicable) (closest match)
- 164.308(a)(7)(ii)(E) Applications and Data Criticality Analysis (Addressable) (closest match)
- 164.310(b) Workstation Use (Standard) (closest match)
- 164.310(d)(1) Device and Media Controls (Standard) (closest match)
- 164.312(a)(1) Access Control (Standard) (closest match)
- 164.312(a)(2)(iv) Encryption and Decryption (Addressable) (closest match)
NIST SP 800-53 Rev 5
- NIST800-AC-16 AC-16 Security and Privacy Attributes (closest match)
- NIST800-AC-22 AC-22 Publicly Accessible Content (closest match)
- NIST800-CM-12 CM-12 Information Location (closest match)
- NIST800-MP-2 MP-2 Media Access (closest match)
- NIST800-MP-3 MP-3 Media Marking (closest match)
- NIST800-MP-4 MP-4 Media Storage (closest match)
- NIST800-MP-6 MP-6 Media Sanitization (closest match)
- NIST800-PE-22 PE-22 Component Marking (closest match)
What an auditor commonly asks for
General guidance for this control area (domain: C - Confidentiality), in our words, not a statement of the standard and not binding on an assessor.
- the classification and handling records
- the secure-disposal records
- the confidentiality agreements for the period