SOC 2
ActiveCore framework
Best for: SOC reports are intended to examine services provided by a service organization so that end users can assess and address the risk associated with an outsourced service. SOC 2 covers security, availability, processing integrity, confidentiality, and privacy.
| Mandatory? | Voluntary — required by enterprise procurement |
|---|---|
| Who validates? | Licensed CPA firm (SSAE 18). No self-assessment. |
| Renewal | Typically annual |
| Observation period | Type II: 3–12 months |
| Governing body | American Institute of Certified Public Accountants (AICPA), 2017 TSC (2022 revised). Official source |
Controls by category
69 controls are Mapped to SOC 2.
A1.2 The entity authorizes, designs, develops or acquires, implements, operates, approves, maintains, and monitors environmental protections, software, data back-up processes, and recovery infrastructure to meet its objectives
| Control | Status |
|---|---|
| App Service apps should have 'HTTP logs' enabled | Mapped |
| Flow log resources should have flow logging enabled | Mapped |
C1.1 The entity identifies and maintains confidential information to meet the entity's objectives related to confidentiality
| Control | Status |
|---|---|
| Azure Blob Storage accounts should have soft delete enabled for containers | Mapped |
CC2.1 COSO Principle 13: The entity obtains or generates and uses relevant, quality information to support the functioning of internal control
CC3.2 COSO Principle 7: The entity identifies risks to the achievement of its objectives across the entity and analyzes risks as a basis for determining how the risks should be managed
CC4.2 COSO Principle 17: The entity evaluates and communicates internal control deficiencies in a timely manner to those parties responsible for taking corrective action, including senior management and the board of directors, as appropriate
CC5.2 COSO Principle 11: The entity also selects and develops general control activities over technology to support the achievement of objectives
CC6.1 The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives
CC6.3 The entity authorizes, modifies, or removes access to data, software, functions, and other protected information assets based on roles, responsibilities, or the system design and changes, giving consideration to the concepts of least privilege and segregation of duties, to meet the entity's objectives
CC6.6 The entity implements logical access security measures to protect against threats from sources outside its system boundaries
CC6.7 The entity restricts the transmission, movement, and removal of information to authorized internal and external users and processes, and protects it during transmission, movement, or removal to meet the entity's objectives
CC6.8 The entity implements controls to prevent or detect and act upon the introduction of unauthorized or malicious software to meet the entity's objectives
CC7.1 To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations that result in the introduction of new vulnerabilities, and (2) susceptibilities to newly discovered vulnerabilities
CC7.2 The entity monitors system components and the operation of those components for anomalies that are indicative of malicious acts, natural disasters, and errors affecting the entity's ability to meet its objectives; anomalies are analyzed to determine whether they represent security events
CC7.3 The entity evaluates security events to determine whether they could or have resulted in a failure of the entity to meet its objectives (security incidents) and, if so, takes actions to prevent or address such failures
CC7.4 The entity responds to identified security incidents by executing a defined incident response program to understand, contain, remediate, and communicate security incidents, as appropriate
CC8.1 The entity authorizes, designs, develops or acquires, configures, documents, tests, approves, and implements changes to infrastructure, data, software, and procedures to meet its objectives
PI1.2 System inputs are measured and recorded completely, accurately, and timely to meet the entity's processing integrity commitments and system requirements
| Control | Status |
|---|---|
| App Service apps should have 'HTTP logs' enabled | Mapped |
PI1.4 System outputs are complete, accurate, distributed only to intended parties, and retained to meet the entity's processing integrity commitments and system requirements
PI1.5 Stored data is maintained complete, accurate, and protected from unauthorized modification to meet the entity's processing integrity commitments and system requirements
Related frameworks
| Framework | Control overlap | Note |
|---|---|---|
| NIS2 Directive (EU 2022/2555) | High 97% | |
| BSI C5:2025 | High 96% | |
| CIS Azure Benchmark v2.0.0 | High 88% |