SOC 2 control library

Each SOC 2 control ShipReady maps to engineering evidence has its own page: what an auditor asks for, the signals ShipReady collects, and common gaps. Controls the platform does not yet evidence are not listed.

CC1.4 — Personnel are trained and demonstrate the competence to meet security responsibilities
CC2.1 — Control decisions are based on documented, current information about the system and its data
CC2.3 — Security and availability commitments are published where customers and partners can review them
CC3.2 — Risks to the achievement of objectives are identified and analyzed
CC4.1 — Control operation is checked on a schedule and the evaluation results are retained
CC4.2 — Control gaps found in evaluations are logged, assigned an owner, and tracked to closure
CC5.3 — Staff acknowledge the policies and procedures that put controls into practice
CC6.1 — Logical access security protects information assets
CC6.2 — User access is provisioned, modified, and removed on a managed basis
CC6.3 — Access rights are granted on least-privilege and segregation-of-duties basis
CC6.6 — Boundary protections restrict access from outside the system
CC6.7 — Information in transit and at rest is protected with encryption
CC6.8 — Controls prevent or detect unauthorized or malicious software
CC7.1 — Vulnerabilities are detected and configuration changes are monitored
CC7.2 — The system is monitored to detect anomalies and security events
CC7.3 — Security events are evaluated and incidents are responded to
CC7.4 — An incident response plan defines containment, remediation, and communication steps
CC7.5 — Recovery procedures are exercised after incidents and lessons feed back into the plan
CC8.1 — Changes to infrastructure and software follow a managed change process
CC9.1 — Business disruption scenarios have documented mitigations and recovery options
CC9.2 — Risks arising from vendors and business partners are assessed and managed

Readiness is not certification. Not legal advice.