Everything you need to implement to achieve SOC 2 certification
SOC 2 is based on 5 Trust Service Criteria. Security is required; the other 4 are optional based on your business and customer needs.
Protection of system resources against unauthorized access
System is available for operation and use as committed
System processing is complete, valid, accurate, timely, and authorized
Confidential information is protected as committed
Personal information is collected, used, retained, and disclosed in conformity with commitments
Overarching policy defining your security program, roles, and responsibilities
User provisioning, deprovisioning, MFA, password requirements, access reviews
How to detect, respond to, and recover from security incidents
Procedures for maintaining operations during disruptions
Code review, testing, approval, deployment, and rollback procedures
How you identify, assess, and mitigate information security risks
Third-party risk assessment, contracts, ongoing monitoring
How you classify and protect different types of data
Rules for employee use of company systems and data
Data center access, badge controls, visitor management
Encryption standards for data at rest and in transit
Annual training for all employees on security best practices
We automate 30-50% of evidence collection by connecting to your AWS, Okta, GitHub, Jira, and 300+ other tools. Save 75+ hours per month and never miss critical evidence.
LowerPlane provides all policy templates, automates evidence collection, and guides you through every requirement