DecisionPack

Executive Summary

Severity-weighted score	0.0%
Total controls	100
Met	0
Partial	0
Gap	100

Key Gaps

C1.1 C1.1 Confidentiality Commitments readiness - gap - severity 5 - missing evidence 3
C1.3 C1.3 Confidentiality Commitments readiness - gap - severity 5 - missing evidence 3
C1.5 C1.5 Confidentiality Commitments readiness - gap - severity 5 - missing evidence 3
C2.1 C2.1 Confidential Data Lifecycle readiness - gap - severity 5 - missing evidence 3
C2.3 C2.3 Confidential Data Lifecycle readiness - gap - severity 5 - missing evidence 3
C2.5 C2.5 Confidential Data Lifecycle readiness - gap - severity 5 - missing evidence 3
CC1.2 CC1.2 Control Environment readiness - gap - severity 5 - missing evidence 3
CC1.4 CC1.4 Control Environment readiness - gap - severity 5 - missing evidence 3
CC2.2 CC2.2 Communication and Information readiness - gap - severity 5 - missing evidence 3
CC2.4 CC2.4 Communication and Information readiness - gap - severity 5 - missing evidence 3
CC3.2 CC3.2 Risk Assessment readiness - gap - severity 5 - missing evidence 3
CC3.4 CC3.4 Risk Assessment readiness - gap - severity 5 - missing evidence 3

Full Controls Table

control_id	title	objective	evidence expectations	status	severity
`CC1.1`	CC1.1 Control Environment readiness	Demonstrate that control environment is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for control environment.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	4
`CC1.2`	CC1.2 Control Environment readiness	Demonstrate that control environment is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for control environment.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	5
`CC1.3`	CC1.3 Control Environment readiness	Demonstrate that control environment is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for control environment.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	4
`CC1.4`	CC1.4 Control Environment readiness	Demonstrate that control environment is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for control environment.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	5
`CC1.5`	CC1.5 Control Environment readiness	Demonstrate that control environment is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for control environment.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	4
`CC2.1`	CC2.1 Communication and Information readiness	Demonstrate that communication and information is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for communication and information.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	4
`CC2.2`	CC2.2 Communication and Information readiness	Demonstrate that communication and information is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for communication and information.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	5
`CC2.3`	CC2.3 Communication and Information readiness	Demonstrate that communication and information is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for communication and information.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	4
`CC2.4`	CC2.4 Communication and Information readiness	Demonstrate that communication and information is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for communication and information.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	5
`CC2.5`	CC2.5 Communication and Information readiness	Demonstrate that communication and information is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for communication and information.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	4
`CC3.1`	CC3.1 Risk Assessment readiness	Demonstrate that risk assessment is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for risk assessment.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	4
`CC3.2`	CC3.2 Risk Assessment readiness	Demonstrate that risk assessment is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for risk assessment.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	5
`CC3.3`	CC3.3 Risk Assessment readiness	Demonstrate that risk assessment is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for risk assessment.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	4
`CC3.4`	CC3.4 Risk Assessment readiness	Demonstrate that risk assessment is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for risk assessment.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	5
`CC3.5`	CC3.5 Risk Assessment readiness	Demonstrate that risk assessment is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for risk assessment.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	4
`CC4.1`	CC4.1 Monitoring Activities readiness	Demonstrate that monitoring activities is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for monitoring activities.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	4
`CC4.2`	CC4.2 Monitoring Activities readiness	Demonstrate that monitoring activities is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for monitoring activities.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	5
`CC4.3`	CC4.3 Monitoring Activities readiness	Demonstrate that monitoring activities is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for monitoring activities.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	4
`CC4.4`	CC4.4 Monitoring Activities readiness	Demonstrate that monitoring activities is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for monitoring activities.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	5
`CC4.5`	CC4.5 Monitoring Activities readiness	Demonstrate that monitoring activities is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for monitoring activities.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	4
`CC5.1`	CC5.1 Control Activities readiness	Demonstrate that control activities is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for control activities.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	4
`CC5.2`	CC5.2 Control Activities readiness	Demonstrate that control activities is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for control activities.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	5
`CC5.3`	CC5.3 Control Activities readiness	Demonstrate that control activities is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for control activities.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	4
`CC5.4`	CC5.4 Control Activities readiness	Demonstrate that control activities is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for control activities.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	5
`CC5.5`	CC5.5 Control Activities readiness	Demonstrate that control activities is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for control activities.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	4
`CC6.1`	CC6.1 Logical and Physical Access readiness	Demonstrate that logical and physical access is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for logical and physical access.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	4
`CC6.2`	CC6.2 Logical and Physical Access readiness	Demonstrate that logical and physical access is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for logical and physical access.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	5
`CC6.3`	CC6.3 Logical and Physical Access readiness	Demonstrate that logical and physical access is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for logical and physical access.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	4
`CC6.4`	CC6.4 Logical and Physical Access readiness	Demonstrate that logical and physical access is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for logical and physical access.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	5
`CC6.5`	CC6.5 Logical and Physical Access readiness	Demonstrate that logical and physical access is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for logical and physical access.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	4
`CC7.1`	CC7.1 System Operations readiness	Demonstrate that system operations is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for system operations.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	4
`CC7.2`	CC7.2 System Operations readiness	Demonstrate that system operations is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for system operations.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	5
`CC7.3`	CC7.3 System Operations readiness	Demonstrate that system operations is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for system operations.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	4
`CC7.4`	CC7.4 System Operations readiness	Demonstrate that system operations is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for system operations.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	5
`CC7.5`	CC7.5 System Operations readiness	Demonstrate that system operations is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for system operations.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	4
`CC8.1`	CC8.1 Change Management readiness	Demonstrate that change management is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for change management.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	4
`CC8.2`	CC8.2 Change Management readiness	Demonstrate that change management is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for change management.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	5
`CC8.3`	CC8.3 Change Management readiness	Demonstrate that change management is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for change management.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	4
`CC8.4`	CC8.4 Change Management readiness	Demonstrate that change management is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for change management.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	5
`CC8.5`	CC8.5 Change Management readiness	Demonstrate that change management is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for change management.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	4
`CC9.1`	CC9.1 Risk Mitigation readiness	Demonstrate that risk mitigation is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for risk mitigation.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	4
`CC9.2`	CC9.2 Risk Mitigation readiness	Demonstrate that risk mitigation is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for risk mitigation.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	5
`CC9.3`	CC9.3 Risk Mitigation readiness	Demonstrate that risk mitigation is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for risk mitigation.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	4
`CC9.4`	CC9.4 Risk Mitigation readiness	Demonstrate that risk mitigation is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for risk mitigation.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	5
`CC9.5`	CC9.5 Risk Mitigation readiness	Demonstrate that risk mitigation is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for risk mitigation.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	4
`C1.1`	C1.1 Confidentiality Commitments readiness	Demonstrate that confidentiality commitments is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for confidentiality commitments.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	5
`C1.2`	C1.2 Confidentiality Commitments readiness	Demonstrate that confidentiality commitments is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for confidentiality commitments.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	4
`C1.3`	C1.3 Confidentiality Commitments readiness	Demonstrate that confidentiality commitments is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for confidentiality commitments.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	5
`C1.4`	C1.4 Confidentiality Commitments readiness	Demonstrate that confidentiality commitments is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for confidentiality commitments.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	4
`C1.5`	C1.5 Confidentiality Commitments readiness	Demonstrate that confidentiality commitments is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for confidentiality commitments.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	5
`C1.6`	C1.6 Confidentiality Commitments readiness	Demonstrate that confidentiality commitments is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for confidentiality commitments.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	4
`C2.1`	C2.1 Confidential Data Lifecycle readiness	Demonstrate that confidential data lifecycle is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for confidential data lifecycle.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	5
`C2.2`	C2.2 Confidential Data Lifecycle readiness	Demonstrate that confidential data lifecycle is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for confidential data lifecycle.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	4
`C2.3`	C2.3 Confidential Data Lifecycle readiness	Demonstrate that confidential data lifecycle is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for confidential data lifecycle.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	5
`C2.4`	C2.4 Confidential Data Lifecycle readiness	Demonstrate that confidential data lifecycle is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for confidential data lifecycle.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	4
`C2.5`	C2.5 Confidential Data Lifecycle readiness	Demonstrate that confidential data lifecycle is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for confidential data lifecycle.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	5
`C2.6`	C2.6 Confidential Data Lifecycle readiness	Demonstrate that confidential data lifecycle is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for confidential data lifecycle.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	4
`A1.1`	A1.1 Availability Planning readiness	Demonstrate that availability planning is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for availability planning.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	4
`A1.2`	A1.2 Availability Planning readiness	Demonstrate that availability planning is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for availability planning.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	3
`A1.3`	A1.3 Availability Planning readiness	Demonstrate that availability planning is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for availability planning.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	4
`A1.4`	A1.4 Availability Planning readiness	Demonstrate that availability planning is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for availability planning.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	3
`A2.1`	A2.1 Backup and Recovery readiness	Demonstrate that backup and recovery is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for backup and recovery.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	4
`A2.2`	A2.2 Backup and Recovery readiness	Demonstrate that backup and recovery is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for backup and recovery.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	3
`A2.3`	A2.3 Backup and Recovery readiness	Demonstrate that backup and recovery is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for backup and recovery.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	4
`A2.4`	A2.4 Backup and Recovery readiness	Demonstrate that backup and recovery is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for backup and recovery.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	3
`A3.1`	A3.1 Resilience Testing readiness	Demonstrate that resilience testing is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for resilience testing.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	4
`A3.2`	A3.2 Resilience Testing readiness	Demonstrate that resilience testing is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for resilience testing.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	3
`A3.3`	A3.3 Resilience Testing readiness	Demonstrate that resilience testing is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for resilience testing.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	4
`A3.4`	A3.4 Resilience Testing readiness	Demonstrate that resilience testing is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for resilience testing.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	3
`PI1.1`	PI1.1 Input Integrity readiness	Demonstrate that input integrity is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for input integrity.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	3
`PI1.2`	PI1.2 Input Integrity readiness	Demonstrate that input integrity is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for input integrity.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	4
`PI1.3`	PI1.3 Input Integrity readiness	Demonstrate that input integrity is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for input integrity.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	3
`PI2.1`	PI2.1 Processing Accuracy readiness	Demonstrate that processing accuracy is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for processing accuracy.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	3
`PI2.2`	PI2.2 Processing Accuracy readiness	Demonstrate that processing accuracy is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for processing accuracy.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	4
`PI2.3`	PI2.3 Processing Accuracy readiness	Demonstrate that processing accuracy is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for processing accuracy.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	3
`PI3.1`	PI3.1 Exception Handling readiness	Demonstrate that exception handling is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for exception handling.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	3
`PI3.2`	PI3.2 Exception Handling readiness	Demonstrate that exception handling is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for exception handling.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	4
`PI3.3`	PI3.3 Exception Handling readiness	Demonstrate that exception handling is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for exception handling.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	3
`PI4.1`	PI4.1 Job and Batch Control readiness	Demonstrate that job and batch control is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for job and batch control.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	3
`PI4.2`	PI4.2 Job and Batch Control readiness	Demonstrate that job and batch control is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for job and batch control.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	4
`PI4.3`	PI4.3 Job and Batch Control readiness	Demonstrate that job and batch control is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for job and batch control.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	3
`PI5.1`	PI5.1 Output Review readiness	Demonstrate that output review is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for output review.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	3
`PI5.2`	PI5.2 Output Review readiness	Demonstrate that output review is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for output review.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	4
`PI5.3`	PI5.3 Output Review readiness	Demonstrate that output review is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for output review.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	3
`P1.1`	P1.1 Notice and Transparency readiness	Demonstrate that notice and transparency is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for notice and transparency.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	4
`P1.2`	P1.2 Notice and Transparency readiness	Demonstrate that notice and transparency is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for notice and transparency.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	3
`P2.1`	P2.1 Collection and Use Limitation readiness	Demonstrate that collection and use limitation is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for collection and use limitation.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	4
`P2.2`	P2.2 Collection and Use Limitation readiness	Demonstrate that collection and use limitation is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for collection and use limitation.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	3
`P3.1`	P3.1 Data Subject Rights readiness	Demonstrate that data subject rights is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for data subject rights.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	4
`P3.2`	P3.2 Data Subject Rights readiness	Demonstrate that data subject rights is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for data subject rights.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	3
`P4.1`	P4.1 Privacy Safeguards readiness	Demonstrate that privacy safeguards is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for privacy safeguards.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	4
`P4.2`	P4.2 Privacy Safeguards readiness	Demonstrate that privacy safeguards is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for privacy safeguards.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	3
`P5.1`	P5.1 Third-Party Privacy Management readiness	Demonstrate that third-party privacy management is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for third-party privacy management.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	4
`P5.2`	P5.2 Third-Party Privacy Management readiness	Demonstrate that third-party privacy management is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for third-party privacy management.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	3
`P6.1`	P6.1 Privacy Monitoring readiness	Demonstrate that privacy monitoring is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for privacy monitoring.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	4
`P6.2`	P6.2 Privacy Monitoring readiness	Demonstrate that privacy monitoring is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for privacy monitoring.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	3
`P7.1`	P7.1 Privacy Incident Response readiness	Demonstrate that privacy incident response is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for privacy incident response.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	4
`P7.2`	P7.2 Privacy Incident Response readiness	Demonstrate that privacy incident response is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for privacy incident response.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	3
`P8.1`	P8.1 Retention and Disposal readiness	Demonstrate that retention and disposal is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for retention and disposal.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	4
`P8.2`	P8.2 Retention and Disposal readiness	Demonstrate that retention and disposal is defined, operated, and reviewable with reproducible local evidence.	Written policy or procedure showing ownership, approval, and review cadence for retention and disposal.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.	gap	3

Gap Register

control_id	title	status	severity	missing_evidence	evidence expectations
`CC1.1`	CC1.1 Control Environment readiness	gap	4	3	Written policy or procedure showing ownership, approval, and review cadence for control environment.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`CC1.2`	CC1.2 Control Environment readiness	gap	5	3	Written policy or procedure showing ownership, approval, and review cadence for control environment.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`CC1.3`	CC1.3 Control Environment readiness	gap	4	3	Written policy or procedure showing ownership, approval, and review cadence for control environment.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`CC1.4`	CC1.4 Control Environment readiness	gap	5	3	Written policy or procedure showing ownership, approval, and review cadence for control environment.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`CC1.5`	CC1.5 Control Environment readiness	gap	4	3	Written policy or procedure showing ownership, approval, and review cadence for control environment.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`CC2.1`	CC2.1 Communication and Information readiness	gap	4	3	Written policy or procedure showing ownership, approval, and review cadence for communication and information.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`CC2.2`	CC2.2 Communication and Information readiness	gap	5	3	Written policy or procedure showing ownership, approval, and review cadence for communication and information.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`CC2.3`	CC2.3 Communication and Information readiness	gap	4	3	Written policy or procedure showing ownership, approval, and review cadence for communication and information.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`CC2.4`	CC2.4 Communication and Information readiness	gap	5	3	Written policy or procedure showing ownership, approval, and review cadence for communication and information.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`CC2.5`	CC2.5 Communication and Information readiness	gap	4	3	Written policy or procedure showing ownership, approval, and review cadence for communication and information.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`CC3.1`	CC3.1 Risk Assessment readiness	gap	4	3	Written policy or procedure showing ownership, approval, and review cadence for risk assessment.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`CC3.2`	CC3.2 Risk Assessment readiness	gap	5	3	Written policy or procedure showing ownership, approval, and review cadence for risk assessment.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`CC3.3`	CC3.3 Risk Assessment readiness	gap	4	3	Written policy or procedure showing ownership, approval, and review cadence for risk assessment.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`CC3.4`	CC3.4 Risk Assessment readiness	gap	5	3	Written policy or procedure showing ownership, approval, and review cadence for risk assessment.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`CC3.5`	CC3.5 Risk Assessment readiness	gap	4	3	Written policy or procedure showing ownership, approval, and review cadence for risk assessment.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`CC4.1`	CC4.1 Monitoring Activities readiness	gap	4	3	Written policy or procedure showing ownership, approval, and review cadence for monitoring activities.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`CC4.2`	CC4.2 Monitoring Activities readiness	gap	5	3	Written policy or procedure showing ownership, approval, and review cadence for monitoring activities.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`CC4.3`	CC4.3 Monitoring Activities readiness	gap	4	3	Written policy or procedure showing ownership, approval, and review cadence for monitoring activities.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`CC4.4`	CC4.4 Monitoring Activities readiness	gap	5	3	Written policy or procedure showing ownership, approval, and review cadence for monitoring activities.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`CC4.5`	CC4.5 Monitoring Activities readiness	gap	4	3	Written policy or procedure showing ownership, approval, and review cadence for monitoring activities.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`CC5.1`	CC5.1 Control Activities readiness	gap	4	3	Written policy or procedure showing ownership, approval, and review cadence for control activities.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`CC5.2`	CC5.2 Control Activities readiness	gap	5	3	Written policy or procedure showing ownership, approval, and review cadence for control activities.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`CC5.3`	CC5.3 Control Activities readiness	gap	4	3	Written policy or procedure showing ownership, approval, and review cadence for control activities.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`CC5.4`	CC5.4 Control Activities readiness	gap	5	3	Written policy or procedure showing ownership, approval, and review cadence for control activities.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`CC5.5`	CC5.5 Control Activities readiness	gap	4	3	Written policy or procedure showing ownership, approval, and review cadence for control activities.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`CC6.1`	CC6.1 Logical and Physical Access readiness	gap	4	3	Written policy or procedure showing ownership, approval, and review cadence for logical and physical access.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`CC6.2`	CC6.2 Logical and Physical Access readiness	gap	5	3	Written policy or procedure showing ownership, approval, and review cadence for logical and physical access.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`CC6.3`	CC6.3 Logical and Physical Access readiness	gap	4	3	Written policy or procedure showing ownership, approval, and review cadence for logical and physical access.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`CC6.4`	CC6.4 Logical and Physical Access readiness	gap	5	3	Written policy or procedure showing ownership, approval, and review cadence for logical and physical access.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`CC6.5`	CC6.5 Logical and Physical Access readiness	gap	4	3	Written policy or procedure showing ownership, approval, and review cadence for logical and physical access.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`CC7.1`	CC7.1 System Operations readiness	gap	4	3	Written policy or procedure showing ownership, approval, and review cadence for system operations.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`CC7.2`	CC7.2 System Operations readiness	gap	5	3	Written policy or procedure showing ownership, approval, and review cadence for system operations.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`CC7.3`	CC7.3 System Operations readiness	gap	4	3	Written policy or procedure showing ownership, approval, and review cadence for system operations.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`CC7.4`	CC7.4 System Operations readiness	gap	5	3	Written policy or procedure showing ownership, approval, and review cadence for system operations.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`CC7.5`	CC7.5 System Operations readiness	gap	4	3	Written policy or procedure showing ownership, approval, and review cadence for system operations.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`CC8.1`	CC8.1 Change Management readiness	gap	4	3	Written policy or procedure showing ownership, approval, and review cadence for change management.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`CC8.2`	CC8.2 Change Management readiness	gap	5	3	Written policy or procedure showing ownership, approval, and review cadence for change management.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`CC8.3`	CC8.3 Change Management readiness	gap	4	3	Written policy or procedure showing ownership, approval, and review cadence for change management.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`CC8.4`	CC8.4 Change Management readiness	gap	5	3	Written policy or procedure showing ownership, approval, and review cadence for change management.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`CC8.5`	CC8.5 Change Management readiness	gap	4	3	Written policy or procedure showing ownership, approval, and review cadence for change management.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`CC9.1`	CC9.1 Risk Mitigation readiness	gap	4	3	Written policy or procedure showing ownership, approval, and review cadence for risk mitigation.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`CC9.2`	CC9.2 Risk Mitigation readiness	gap	5	3	Written policy or procedure showing ownership, approval, and review cadence for risk mitigation.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`CC9.3`	CC9.3 Risk Mitigation readiness	gap	4	3	Written policy or procedure showing ownership, approval, and review cadence for risk mitigation.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`CC9.4`	CC9.4 Risk Mitigation readiness	gap	5	3	Written policy or procedure showing ownership, approval, and review cadence for risk mitigation.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`CC9.5`	CC9.5 Risk Mitigation readiness	gap	4	3	Written policy or procedure showing ownership, approval, and review cadence for risk mitigation.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`C1.1`	C1.1 Confidentiality Commitments readiness	gap	5	3	Written policy or procedure showing ownership, approval, and review cadence for confidentiality commitments.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`C1.2`	C1.2 Confidentiality Commitments readiness	gap	4	3	Written policy or procedure showing ownership, approval, and review cadence for confidentiality commitments.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`C1.3`	C1.3 Confidentiality Commitments readiness	gap	5	3	Written policy or procedure showing ownership, approval, and review cadence for confidentiality commitments.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`C1.4`	C1.4 Confidentiality Commitments readiness	gap	4	3	Written policy or procedure showing ownership, approval, and review cadence for confidentiality commitments.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`C1.5`	C1.5 Confidentiality Commitments readiness	gap	5	3	Written policy or procedure showing ownership, approval, and review cadence for confidentiality commitments.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`C1.6`	C1.6 Confidentiality Commitments readiness	gap	4	3	Written policy or procedure showing ownership, approval, and review cadence for confidentiality commitments.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`C2.1`	C2.1 Confidential Data Lifecycle readiness	gap	5	3	Written policy or procedure showing ownership, approval, and review cadence for confidential data lifecycle.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`C2.2`	C2.2 Confidential Data Lifecycle readiness	gap	4	3	Written policy or procedure showing ownership, approval, and review cadence for confidential data lifecycle.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`C2.3`	C2.3 Confidential Data Lifecycle readiness	gap	5	3	Written policy or procedure showing ownership, approval, and review cadence for confidential data lifecycle.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`C2.4`	C2.4 Confidential Data Lifecycle readiness	gap	4	3	Written policy or procedure showing ownership, approval, and review cadence for confidential data lifecycle.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`C2.5`	C2.5 Confidential Data Lifecycle readiness	gap	5	3	Written policy or procedure showing ownership, approval, and review cadence for confidential data lifecycle.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`C2.6`	C2.6 Confidential Data Lifecycle readiness	gap	4	3	Written policy or procedure showing ownership, approval, and review cadence for confidential data lifecycle.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`A1.1`	A1.1 Availability Planning readiness	gap	4	2	Written policy or procedure showing ownership, approval, and review cadence for availability planning.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`A1.2`	A1.2 Availability Planning readiness	gap	3	2	Written policy or procedure showing ownership, approval, and review cadence for availability planning.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`A1.3`	A1.3 Availability Planning readiness	gap	4	2	Written policy or procedure showing ownership, approval, and review cadence for availability planning.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`A1.4`	A1.4 Availability Planning readiness	gap	3	2	Written policy or procedure showing ownership, approval, and review cadence for availability planning.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`A2.1`	A2.1 Backup and Recovery readiness	gap	4	2	Written policy or procedure showing ownership, approval, and review cadence for backup and recovery.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`A2.2`	A2.2 Backup and Recovery readiness	gap	3	2	Written policy or procedure showing ownership, approval, and review cadence for backup and recovery.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`A2.3`	A2.3 Backup and Recovery readiness	gap	4	2	Written policy or procedure showing ownership, approval, and review cadence for backup and recovery.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`A2.4`	A2.4 Backup and Recovery readiness	gap	3	2	Written policy or procedure showing ownership, approval, and review cadence for backup and recovery.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`A3.1`	A3.1 Resilience Testing readiness	gap	4	2	Written policy or procedure showing ownership, approval, and review cadence for resilience testing.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`A3.2`	A3.2 Resilience Testing readiness	gap	3	2	Written policy or procedure showing ownership, approval, and review cadence for resilience testing.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`A3.3`	A3.3 Resilience Testing readiness	gap	4	2	Written policy or procedure showing ownership, approval, and review cadence for resilience testing.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`A3.4`	A3.4 Resilience Testing readiness	gap	3	2	Written policy or procedure showing ownership, approval, and review cadence for resilience testing.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`PI1.1`	PI1.1 Input Integrity readiness	gap	3	2	Written policy or procedure showing ownership, approval, and review cadence for input integrity.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`PI1.2`	PI1.2 Input Integrity readiness	gap	4	2	Written policy or procedure showing ownership, approval, and review cadence for input integrity.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`PI1.3`	PI1.3 Input Integrity readiness	gap	3	2	Written policy or procedure showing ownership, approval, and review cadence for input integrity.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`PI2.1`	PI2.1 Processing Accuracy readiness	gap	3	2	Written policy or procedure showing ownership, approval, and review cadence for processing accuracy.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`PI2.2`	PI2.2 Processing Accuracy readiness	gap	4	2	Written policy or procedure showing ownership, approval, and review cadence for processing accuracy.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`PI2.3`	PI2.3 Processing Accuracy readiness	gap	3	2	Written policy or procedure showing ownership, approval, and review cadence for processing accuracy.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`PI3.1`	PI3.1 Exception Handling readiness	gap	3	2	Written policy or procedure showing ownership, approval, and review cadence for exception handling.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`PI3.2`	PI3.2 Exception Handling readiness	gap	4	2	Written policy or procedure showing ownership, approval, and review cadence for exception handling.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`PI3.3`	PI3.3 Exception Handling readiness	gap	3	2	Written policy or procedure showing ownership, approval, and review cadence for exception handling.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`PI4.1`	PI4.1 Job and Batch Control readiness	gap	3	2	Written policy or procedure showing ownership, approval, and review cadence for job and batch control.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`PI4.2`	PI4.2 Job and Batch Control readiness	gap	4	2	Written policy or procedure showing ownership, approval, and review cadence for job and batch control.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`PI4.3`	PI4.3 Job and Batch Control readiness	gap	3	2	Written policy or procedure showing ownership, approval, and review cadence for job and batch control.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`PI5.1`	PI5.1 Output Review readiness	gap	3	2	Written policy or procedure showing ownership, approval, and review cadence for output review.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`PI5.2`	PI5.2 Output Review readiness	gap	4	2	Written policy or procedure showing ownership, approval, and review cadence for output review.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`PI5.3`	PI5.3 Output Review readiness	gap	3	2	Written policy or procedure showing ownership, approval, and review cadence for output review.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`P1.1`	P1.1 Notice and Transparency readiness	gap	4	3	Written policy or procedure showing ownership, approval, and review cadence for notice and transparency.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`P1.2`	P1.2 Notice and Transparency readiness	gap	3	3	Written policy or procedure showing ownership, approval, and review cadence for notice and transparency.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`P2.1`	P2.1 Collection and Use Limitation readiness	gap	4	3	Written policy or procedure showing ownership, approval, and review cadence for collection and use limitation.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`P2.2`	P2.2 Collection and Use Limitation readiness	gap	3	3	Written policy or procedure showing ownership, approval, and review cadence for collection and use limitation.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`P3.1`	P3.1 Data Subject Rights readiness	gap	4	3	Written policy or procedure showing ownership, approval, and review cadence for data subject rights.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`P3.2`	P3.2 Data Subject Rights readiness	gap	3	3	Written policy or procedure showing ownership, approval, and review cadence for data subject rights.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`P4.1`	P4.1 Privacy Safeguards readiness	gap	4	3	Written policy or procedure showing ownership, approval, and review cadence for privacy safeguards.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`P4.2`	P4.2 Privacy Safeguards readiness	gap	3	3	Written policy or procedure showing ownership, approval, and review cadence for privacy safeguards.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`P5.1`	P5.1 Third-Party Privacy Management readiness	gap	4	3	Written policy or procedure showing ownership, approval, and review cadence for third-party privacy management.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`P5.2`	P5.2 Third-Party Privacy Management readiness	gap	3	3	Written policy or procedure showing ownership, approval, and review cadence for third-party privacy management.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`P6.1`	P6.1 Privacy Monitoring readiness	gap	4	3	Written policy or procedure showing ownership, approval, and review cadence for privacy monitoring.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`P6.2`	P6.2 Privacy Monitoring readiness	gap	3	3	Written policy or procedure showing ownership, approval, and review cadence for privacy monitoring.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`P7.1`	P7.1 Privacy Incident Response readiness	gap	4	3	Written policy or procedure showing ownership, approval, and review cadence for privacy incident response.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`P7.2`	P7.2 Privacy Incident Response readiness	gap	3	3	Written policy or procedure showing ownership, approval, and review cadence for privacy incident response.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`P8.1`	P8.1 Retention and Disposal readiness	gap	4	3	Written policy or procedure showing ownership, approval, and review cadence for retention and disposal.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.
`P8.2`	P8.2 Retention and Disposal readiness	gap	3	3	Written policy or procedure showing ownership, approval, and review cadence for retention and disposal.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.

Evidence Appendix

`CC1.1` - CC1.1 Control Environment readiness

gap | severity 4 | evidence_count 0

Demonstrate that control environment is defined, operated, and reviewable with reproducible local evidence.

Expected evidence: Written policy or procedure showing ownership, approval, and review cadence for control environment.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.

`SOC2-Q-001` - control environment cc1 control_environment ethics tone policy owner evidence review log ticket control

tags: control_environment, ethics, tone, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-002` - control environment cc1 control_environment ethics tone policy owner evidence review log ticket control

tags: control_environment, ethics, tone, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-003` - control environment cc1 control_environment ethics tone policy owner evidence review log ticket control

tags: control_environment, ethics, tone, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`CC1.2` - CC1.2 Control Environment readiness

gap | severity 5 | evidence_count 0

Demonstrate that control environment is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-002` - control environment cc1 control_environment ethics tone policy owner evidence review log ticket control

tags: control_environment, ethics, tone, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-003` - control environment cc1 control_environment ethics tone policy owner evidence review log ticket control

tags: control_environment, ethics, tone, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-004` - control environment cc1 control_environment ethics tone policy owner evidence review log ticket control

tags: control_environment, ethics, tone, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`CC1.3` - CC1.3 Control Environment readiness

gap | severity 4 | evidence_count 0

Demonstrate that control environment is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-003` - control environment cc1 control_environment ethics tone policy owner evidence review log ticket control

tags: control_environment, ethics, tone, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-004` - control environment cc1 control_environment ethics tone policy owner evidence review log ticket control

tags: control_environment, ethics, tone, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-001` - control environment cc1 control_environment ethics tone policy owner evidence review log ticket control

tags: control_environment, ethics, tone, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`CC1.4` - CC1.4 Control Environment readiness

gap | severity 5 | evidence_count 0

Demonstrate that control environment is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-004` - control environment cc1 control_environment ethics tone policy owner evidence review log ticket control

tags: control_environment, ethics, tone, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-001` - control environment cc1 control_environment ethics tone policy owner evidence review log ticket control

tags: control_environment, ethics, tone, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-002` - control environment cc1 control_environment ethics tone policy owner evidence review log ticket control

tags: control_environment, ethics, tone, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`CC1.5` - CC1.5 Control Environment readiness

gap | severity 4 | evidence_count 0

Demonstrate that control environment is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-001` - control environment cc1 control_environment ethics tone policy owner evidence review log ticket control

tags: control_environment, ethics, tone, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-002` - control environment cc1 control_environment ethics tone policy owner evidence review log ticket control

tags: control_environment, ethics, tone, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-003` - control environment cc1 control_environment ethics tone policy owner evidence review log ticket control

tags: control_environment, ethics, tone, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`CC2.1` - CC2.1 Communication and Information readiness

gap | severity 4 | evidence_count 0

Demonstrate that communication and information is defined, operated, and reviewable with reproducible local evidence.

Expected evidence: Written policy or procedure showing ownership, approval, and review cadence for communication and information.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.

`SOC2-Q-005` - communication and information cc2 communication reporting governance policy owner evidence review log ticket control

tags: communication, reporting, governance, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-006` - communication and information cc2 communication reporting governance policy owner evidence review log ticket control

tags: communication, reporting, governance, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-007` - communication and information cc2 communication reporting governance policy owner evidence review log ticket control

tags: communication, reporting, governance, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`CC2.2` - CC2.2 Communication and Information readiness

gap | severity 5 | evidence_count 0

Demonstrate that communication and information is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-006` - communication and information cc2 communication reporting governance policy owner evidence review log ticket control

tags: communication, reporting, governance, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-007` - communication and information cc2 communication reporting governance policy owner evidence review log ticket control

tags: communication, reporting, governance, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-008` - communication and information cc2 communication reporting governance policy owner evidence review log ticket control

tags: communication, reporting, governance, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`CC2.3` - CC2.3 Communication and Information readiness

gap | severity 4 | evidence_count 0

Demonstrate that communication and information is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-007` - communication and information cc2 communication reporting governance policy owner evidence review log ticket control

tags: communication, reporting, governance, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-008` - communication and information cc2 communication reporting governance policy owner evidence review log ticket control

tags: communication, reporting, governance, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-005` - communication and information cc2 communication reporting governance policy owner evidence review log ticket control

tags: communication, reporting, governance, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`CC2.4` - CC2.4 Communication and Information readiness

gap | severity 5 | evidence_count 0

Demonstrate that communication and information is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-008` - communication and information cc2 communication reporting governance policy owner evidence review log ticket control

tags: communication, reporting, governance, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-005` - communication and information cc2 communication reporting governance policy owner evidence review log ticket control

tags: communication, reporting, governance, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-006` - communication and information cc2 communication reporting governance policy owner evidence review log ticket control

tags: communication, reporting, governance, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`CC2.5` - CC2.5 Communication and Information readiness

gap | severity 4 | evidence_count 0

Demonstrate that communication and information is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-005` - communication and information cc2 communication reporting governance policy owner evidence review log ticket control

tags: communication, reporting, governance, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-006` - communication and information cc2 communication reporting governance policy owner evidence review log ticket control

tags: communication, reporting, governance, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-007` - communication and information cc2 communication reporting governance policy owner evidence review log ticket control

tags: communication, reporting, governance, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`CC3.1` - CC3.1 Risk Assessment readiness

gap | severity 4 | evidence_count 0

Demonstrate that risk assessment is defined, operated, and reviewable with reproducible local evidence.

Expected evidence: Written policy or procedure showing ownership, approval, and review cadence for risk assessment.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.

`SOC2-Q-009` - risk assessment cc3 risk_assessment threat_modeling enterprise_risk policy owner evidence review log ticket control

tags: risk_assessment, threat_modeling, enterprise_risk, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-010` - risk assessment cc3 risk_assessment threat_modeling enterprise_risk policy owner evidence review log ticket control

tags: risk_assessment, threat_modeling, enterprise_risk, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-011` - risk assessment cc3 risk_assessment threat_modeling enterprise_risk policy owner evidence review log ticket control

tags: risk_assessment, threat_modeling, enterprise_risk, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`CC3.2` - CC3.2 Risk Assessment readiness

gap | severity 5 | evidence_count 0

Demonstrate that risk assessment is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-010` - risk assessment cc3 risk_assessment threat_modeling enterprise_risk policy owner evidence review log ticket control

tags: risk_assessment, threat_modeling, enterprise_risk, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-011` - risk assessment cc3 risk_assessment threat_modeling enterprise_risk policy owner evidence review log ticket control

tags: risk_assessment, threat_modeling, enterprise_risk, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-012` - risk assessment cc3 risk_assessment threat_modeling enterprise_risk policy owner evidence review log ticket control

tags: risk_assessment, threat_modeling, enterprise_risk, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`CC3.3` - CC3.3 Risk Assessment readiness

gap | severity 4 | evidence_count 0

Demonstrate that risk assessment is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-011` - risk assessment cc3 risk_assessment threat_modeling enterprise_risk policy owner evidence review log ticket control

tags: risk_assessment, threat_modeling, enterprise_risk, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-012` - risk assessment cc3 risk_assessment threat_modeling enterprise_risk policy owner evidence review log ticket control

tags: risk_assessment, threat_modeling, enterprise_risk, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-009` - risk assessment cc3 risk_assessment threat_modeling enterprise_risk policy owner evidence review log ticket control

tags: risk_assessment, threat_modeling, enterprise_risk, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`CC3.4` - CC3.4 Risk Assessment readiness

gap | severity 5 | evidence_count 0

Demonstrate that risk assessment is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-012` - risk assessment cc3 risk_assessment threat_modeling enterprise_risk policy owner evidence review log ticket control

tags: risk_assessment, threat_modeling, enterprise_risk, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-009` - risk assessment cc3 risk_assessment threat_modeling enterprise_risk policy owner evidence review log ticket control

tags: risk_assessment, threat_modeling, enterprise_risk, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-010` - risk assessment cc3 risk_assessment threat_modeling enterprise_risk policy owner evidence review log ticket control

tags: risk_assessment, threat_modeling, enterprise_risk, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`CC3.5` - CC3.5 Risk Assessment readiness

gap | severity 4 | evidence_count 0

Demonstrate that risk assessment is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-009` - risk assessment cc3 risk_assessment threat_modeling enterprise_risk policy owner evidence review log ticket control

tags: risk_assessment, threat_modeling, enterprise_risk, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-010` - risk assessment cc3 risk_assessment threat_modeling enterprise_risk policy owner evidence review log ticket control

tags: risk_assessment, threat_modeling, enterprise_risk, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-011` - risk assessment cc3 risk_assessment threat_modeling enterprise_risk policy owner evidence review log ticket control

tags: risk_assessment, threat_modeling, enterprise_risk, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`CC4.1` - CC4.1 Monitoring Activities readiness

gap | severity 4 | evidence_count 0

Demonstrate that monitoring activities is defined, operated, and reviewable with reproducible local evidence.

Expected evidence: Written policy or procedure showing ownership, approval, and review cadence for monitoring activities.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.

`SOC2-Q-013` - monitoring activities cc4 monitoring metrics audit policy owner evidence review log ticket control

tags: monitoring, metrics, audit, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-014` - monitoring activities cc4 monitoring metrics audit policy owner evidence review log ticket control

tags: monitoring, metrics, audit, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-015` - monitoring activities cc4 monitoring metrics audit policy owner evidence review log ticket control

tags: monitoring, metrics, audit, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`CC4.2` - CC4.2 Monitoring Activities readiness

gap | severity 5 | evidence_count 0

Demonstrate that monitoring activities is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-014` - monitoring activities cc4 monitoring metrics audit policy owner evidence review log ticket control

tags: monitoring, metrics, audit, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-015` - monitoring activities cc4 monitoring metrics audit policy owner evidence review log ticket control

tags: monitoring, metrics, audit, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-016` - monitoring activities cc4 monitoring metrics audit policy owner evidence review log ticket control

tags: monitoring, metrics, audit, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`CC4.3` - CC4.3 Monitoring Activities readiness

gap | severity 4 | evidence_count 0

Demonstrate that monitoring activities is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-015` - monitoring activities cc4 monitoring metrics audit policy owner evidence review log ticket control

tags: monitoring, metrics, audit, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-016` - monitoring activities cc4 monitoring metrics audit policy owner evidence review log ticket control

tags: monitoring, metrics, audit, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-013` - monitoring activities cc4 monitoring metrics audit policy owner evidence review log ticket control

tags: monitoring, metrics, audit, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`CC4.4` - CC4.4 Monitoring Activities readiness

gap | severity 5 | evidence_count 0

Demonstrate that monitoring activities is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-016` - monitoring activities cc4 monitoring metrics audit policy owner evidence review log ticket control

tags: monitoring, metrics, audit, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-013` - monitoring activities cc4 monitoring metrics audit policy owner evidence review log ticket control

tags: monitoring, metrics, audit, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-014` - monitoring activities cc4 monitoring metrics audit policy owner evidence review log ticket control

tags: monitoring, metrics, audit, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`CC4.5` - CC4.5 Monitoring Activities readiness

gap | severity 4 | evidence_count 0

Demonstrate that monitoring activities is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-013` - monitoring activities cc4 monitoring metrics audit policy owner evidence review log ticket control

tags: monitoring, metrics, audit, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-014` - monitoring activities cc4 monitoring metrics audit policy owner evidence review log ticket control

tags: monitoring, metrics, audit, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-015` - monitoring activities cc4 monitoring metrics audit policy owner evidence review log ticket control

tags: monitoring, metrics, audit, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`CC5.1` - CC5.1 Control Activities readiness

gap | severity 4 | evidence_count 0

Demonstrate that control activities is defined, operated, and reviewable with reproducible local evidence.

Expected evidence: Written policy or procedure showing ownership, approval, and review cadence for control activities.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.

`SOC2-Q-017` - control activities cc5 control_activities review segregation policy owner evidence review log ticket control

tags: control_activities, review, segregation, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-018` - control activities cc5 control_activities review segregation policy owner evidence review log ticket control

tags: control_activities, review, segregation, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-019` - control activities cc5 control_activities review segregation policy owner evidence review log ticket control

tags: control_activities, review, segregation, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`CC5.2` - CC5.2 Control Activities readiness

gap | severity 5 | evidence_count 0

Demonstrate that control activities is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-018` - control activities cc5 control_activities review segregation policy owner evidence review log ticket control

tags: control_activities, review, segregation, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-019` - control activities cc5 control_activities review segregation policy owner evidence review log ticket control

tags: control_activities, review, segregation, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-020` - control activities cc5 control_activities review segregation policy owner evidence review log ticket control

tags: control_activities, review, segregation, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`CC5.3` - CC5.3 Control Activities readiness

gap | severity 4 | evidence_count 0

Demonstrate that control activities is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-019` - control activities cc5 control_activities review segregation policy owner evidence review log ticket control

tags: control_activities, review, segregation, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-020` - control activities cc5 control_activities review segregation policy owner evidence review log ticket control

tags: control_activities, review, segregation, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-017` - control activities cc5 control_activities review segregation policy owner evidence review log ticket control

tags: control_activities, review, segregation, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`CC5.4` - CC5.4 Control Activities readiness

gap | severity 5 | evidence_count 0

Demonstrate that control activities is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-020` - control activities cc5 control_activities review segregation policy owner evidence review log ticket control

tags: control_activities, review, segregation, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-017` - control activities cc5 control_activities review segregation policy owner evidence review log ticket control

tags: control_activities, review, segregation, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-018` - control activities cc5 control_activities review segregation policy owner evidence review log ticket control

tags: control_activities, review, segregation, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`CC5.5` - CC5.5 Control Activities readiness

gap | severity 4 | evidence_count 0

Demonstrate that control activities is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-017` - control activities cc5 control_activities review segregation policy owner evidence review log ticket control

tags: control_activities, review, segregation, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-018` - control activities cc5 control_activities review segregation policy owner evidence review log ticket control

tags: control_activities, review, segregation, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-019` - control activities cc5 control_activities review segregation policy owner evidence review log ticket control

tags: control_activities, review, segregation, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`CC6.1` - CC6.1 Logical and Physical Access readiness

gap | severity 4 | evidence_count 0

Demonstrate that logical and physical access is defined, operated, and reviewable with reproducible local evidence.

Expected evidence: Written policy or procedure showing ownership, approval, and review cadence for logical and physical access.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.

`SOC2-Q-021` - logical and physical access cc6 logical_access identity mfa policy owner evidence review log ticket control

tags: logical_access, identity, mfa, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-022` - logical and physical access cc6 logical_access identity mfa policy owner evidence review log ticket control

tags: logical_access, identity, mfa, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-023` - logical and physical access cc6 logical_access identity mfa policy owner evidence review log ticket control

tags: logical_access, identity, mfa, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`CC6.2` - CC6.2 Logical and Physical Access readiness

gap | severity 5 | evidence_count 0

Demonstrate that logical and physical access is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-022` - logical and physical access cc6 logical_access identity mfa policy owner evidence review log ticket control

tags: logical_access, identity, mfa, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-023` - logical and physical access cc6 logical_access identity mfa policy owner evidence review log ticket control

tags: logical_access, identity, mfa, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-024` - logical and physical access cc6 logical_access identity mfa policy owner evidence review log ticket control

tags: logical_access, identity, mfa, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`CC6.3` - CC6.3 Logical and Physical Access readiness

gap | severity 4 | evidence_count 0

Demonstrate that logical and physical access is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-023` - logical and physical access cc6 logical_access identity mfa policy owner evidence review log ticket control

tags: logical_access, identity, mfa, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-024` - logical and physical access cc6 logical_access identity mfa policy owner evidence review log ticket control

tags: logical_access, identity, mfa, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-021` - logical and physical access cc6 logical_access identity mfa policy owner evidence review log ticket control

tags: logical_access, identity, mfa, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`CC6.4` - CC6.4 Logical and Physical Access readiness

gap | severity 5 | evidence_count 0

Demonstrate that logical and physical access is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-024` - logical and physical access cc6 logical_access identity mfa policy owner evidence review log ticket control

tags: logical_access, identity, mfa, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-021` - logical and physical access cc6 logical_access identity mfa policy owner evidence review log ticket control

tags: logical_access, identity, mfa, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-022` - logical and physical access cc6 logical_access identity mfa policy owner evidence review log ticket control

tags: logical_access, identity, mfa, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`CC6.5` - CC6.5 Logical and Physical Access readiness

gap | severity 4 | evidence_count 0

Demonstrate that logical and physical access is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-021` - logical and physical access cc6 logical_access identity mfa policy owner evidence review log ticket control

tags: logical_access, identity, mfa, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-022` - logical and physical access cc6 logical_access identity mfa policy owner evidence review log ticket control

tags: logical_access, identity, mfa, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-023` - logical and physical access cc6 logical_access identity mfa policy owner evidence review log ticket control

tags: logical_access, identity, mfa, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`CC7.1` - CC7.1 System Operations readiness

gap | severity 4 | evidence_count 0

Demonstrate that system operations is defined, operated, and reviewable with reproducible local evidence.

Expected evidence: Written policy or procedure showing ownership, approval, and review cadence for system operations.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.

`SOC2-Q-025` - system operations cc7 system_operations logging alerting policy owner evidence review log ticket control

tags: system_operations, logging, alerting, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-026` - system operations cc7 system_operations logging alerting policy owner evidence review log ticket control

tags: system_operations, logging, alerting, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-027` - system operations cc7 system_operations logging alerting policy owner evidence review log ticket control

tags: system_operations, logging, alerting, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`CC7.2` - CC7.2 System Operations readiness

gap | severity 5 | evidence_count 0

Demonstrate that system operations is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-026` - system operations cc7 system_operations logging alerting policy owner evidence review log ticket control

tags: system_operations, logging, alerting, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-027` - system operations cc7 system_operations logging alerting policy owner evidence review log ticket control

tags: system_operations, logging, alerting, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-028` - system operations cc7 system_operations logging alerting policy owner evidence review log ticket control

tags: system_operations, logging, alerting, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`CC7.3` - CC7.3 System Operations readiness

gap | severity 4 | evidence_count 0

Demonstrate that system operations is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-027` - system operations cc7 system_operations logging alerting policy owner evidence review log ticket control

tags: system_operations, logging, alerting, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-028` - system operations cc7 system_operations logging alerting policy owner evidence review log ticket control

tags: system_operations, logging, alerting, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-025` - system operations cc7 system_operations logging alerting policy owner evidence review log ticket control

tags: system_operations, logging, alerting, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`CC7.4` - CC7.4 System Operations readiness

gap | severity 5 | evidence_count 0

Demonstrate that system operations is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-028` - system operations cc7 system_operations logging alerting policy owner evidence review log ticket control

tags: system_operations, logging, alerting, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-025` - system operations cc7 system_operations logging alerting policy owner evidence review log ticket control

tags: system_operations, logging, alerting, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-026` - system operations cc7 system_operations logging alerting policy owner evidence review log ticket control

tags: system_operations, logging, alerting, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`CC7.5` - CC7.5 System Operations readiness

gap | severity 4 | evidence_count 0

Demonstrate that system operations is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-025` - system operations cc7 system_operations logging alerting policy owner evidence review log ticket control

tags: system_operations, logging, alerting, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-026` - system operations cc7 system_operations logging alerting policy owner evidence review log ticket control

tags: system_operations, logging, alerting, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-027` - system operations cc7 system_operations logging alerting policy owner evidence review log ticket control

tags: system_operations, logging, alerting, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`CC8.1` - CC8.1 Change Management readiness

gap | severity 4 | evidence_count 0

Demonstrate that change management is defined, operated, and reviewable with reproducible local evidence.

Expected evidence: Written policy or procedure showing ownership, approval, and review cadence for change management.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.

`SOC2-Q-029` - change management cc8 change_management sdlc release policy owner evidence review log ticket control

tags: change_management, sdlc, release, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-030` - change management cc8 change_management sdlc release policy owner evidence review log ticket control

tags: change_management, sdlc, release, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-031` - change management cc8 change_management sdlc release policy owner evidence review log ticket control

tags: change_management, sdlc, release, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`CC8.2` - CC8.2 Change Management readiness

gap | severity 5 | evidence_count 0

Demonstrate that change management is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-030` - change management cc8 change_management sdlc release policy owner evidence review log ticket control

tags: change_management, sdlc, release, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-031` - change management cc8 change_management sdlc release policy owner evidence review log ticket control

tags: change_management, sdlc, release, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-032` - change management cc8 change_management sdlc release policy owner evidence review log ticket control

tags: change_management, sdlc, release, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`CC8.3` - CC8.3 Change Management readiness

gap | severity 4 | evidence_count 0

Demonstrate that change management is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-031` - change management cc8 change_management sdlc release policy owner evidence review log ticket control

tags: change_management, sdlc, release, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-032` - change management cc8 change_management sdlc release policy owner evidence review log ticket control

tags: change_management, sdlc, release, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-029` - change management cc8 change_management sdlc release policy owner evidence review log ticket control

tags: change_management, sdlc, release, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`CC8.4` - CC8.4 Change Management readiness

gap | severity 5 | evidence_count 0

Demonstrate that change management is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-032` - change management cc8 change_management sdlc release policy owner evidence review log ticket control

tags: change_management, sdlc, release, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-029` - change management cc8 change_management sdlc release policy owner evidence review log ticket control

tags: change_management, sdlc, release, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-030` - change management cc8 change_management sdlc release policy owner evidence review log ticket control

tags: change_management, sdlc, release, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`CC8.5` - CC8.5 Change Management readiness

gap | severity 4 | evidence_count 0

Demonstrate that change management is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-029` - change management cc8 change_management sdlc release policy owner evidence review log ticket control

tags: change_management, sdlc, release, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-030` - change management cc8 change_management sdlc release policy owner evidence review log ticket control

tags: change_management, sdlc, release, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-031` - change management cc8 change_management sdlc release policy owner evidence review log ticket control

tags: change_management, sdlc, release, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`CC9.1` - CC9.1 Risk Mitigation readiness

gap | severity 4 | evidence_count 0

Demonstrate that risk mitigation is defined, operated, and reviewable with reproducible local evidence.

Expected evidence: Written policy or procedure showing ownership, approval, and review cadence for risk mitigation.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.

`SOC2-Q-033` - risk mitigation cc9 risk_mitigation incident_response resilience policy owner evidence review log ticket control

tags: risk_mitigation, incident_response, resilience, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-034` - risk mitigation cc9 risk_mitigation incident_response resilience policy owner evidence review log ticket control

tags: risk_mitigation, incident_response, resilience, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-035` - risk mitigation cc9 risk_mitigation incident_response resilience policy owner evidence review log ticket control

tags: risk_mitigation, incident_response, resilience, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`CC9.2` - CC9.2 Risk Mitigation readiness

gap | severity 5 | evidence_count 0

Demonstrate that risk mitigation is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-034` - risk mitigation cc9 risk_mitigation incident_response resilience policy owner evidence review log ticket control

tags: risk_mitigation, incident_response, resilience, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-035` - risk mitigation cc9 risk_mitigation incident_response resilience policy owner evidence review log ticket control

tags: risk_mitigation, incident_response, resilience, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-036` - risk mitigation cc9 risk_mitigation incident_response resilience policy owner evidence review log ticket control

tags: risk_mitigation, incident_response, resilience, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`CC9.3` - CC9.3 Risk Mitigation readiness

gap | severity 4 | evidence_count 0

Demonstrate that risk mitigation is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-035` - risk mitigation cc9 risk_mitigation incident_response resilience policy owner evidence review log ticket control

tags: risk_mitigation, incident_response, resilience, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-036` - risk mitigation cc9 risk_mitigation incident_response resilience policy owner evidence review log ticket control

tags: risk_mitigation, incident_response, resilience, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-033` - risk mitigation cc9 risk_mitigation incident_response resilience policy owner evidence review log ticket control

tags: risk_mitigation, incident_response, resilience, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`CC9.4` - CC9.4 Risk Mitigation readiness

gap | severity 5 | evidence_count 0

Demonstrate that risk mitigation is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-036` - risk mitigation cc9 risk_mitigation incident_response resilience policy owner evidence review log ticket control

tags: risk_mitigation, incident_response, resilience, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-033` - risk mitigation cc9 risk_mitigation incident_response resilience policy owner evidence review log ticket control

tags: risk_mitigation, incident_response, resilience, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-034` - risk mitigation cc9 risk_mitigation incident_response resilience policy owner evidence review log ticket control

tags: risk_mitigation, incident_response, resilience, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`CC9.5` - CC9.5 Risk Mitigation readiness

gap | severity 4 | evidence_count 0

Demonstrate that risk mitigation is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-033` - risk mitigation cc9 risk_mitigation incident_response resilience policy owner evidence review log ticket control

tags: risk_mitigation, incident_response, resilience, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-034` - risk mitigation cc9 risk_mitigation incident_response resilience policy owner evidence review log ticket control

tags: risk_mitigation, incident_response, resilience, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`SOC2-Q-035` - risk mitigation cc9 risk_mitigation incident_response resilience policy owner evidence review log ticket control

tags: risk_mitigation, incident_response, resilience, soc2, readiness, security | hits: 0

No direct evidence hits for this query.

`C1.1` - C1.1 Confidentiality Commitments readiness

gap | severity 5 | evidence_count 0

Demonstrate that confidentiality commitments is defined, operated, and reviewable with reproducible local evidence.

Expected evidence: Written policy or procedure showing ownership, approval, and review cadence for confidentiality commitments.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.

`SOC2-Q-037` - confidentiality commitments c1 confidentiality data_classification encryption policy owner evidence review log ticket control

tags: confidentiality, data_classification, encryption, soc2, readiness | hits: 0

No direct evidence hits for this query.

`SOC2-Q-038` - confidentiality commitments c1 confidentiality data_classification encryption policy owner evidence review log ticket control

tags: confidentiality, data_classification, encryption, soc2, readiness | hits: 0

No direct evidence hits for this query.

`SOC2-Q-039` - confidentiality commitments c1 confidentiality data_classification encryption policy owner evidence review log ticket control

tags: confidentiality, data_classification, encryption, soc2, readiness | hits: 0

No direct evidence hits for this query.

`C1.2` - C1.2 Confidentiality Commitments readiness

gap | severity 4 | evidence_count 0

Demonstrate that confidentiality commitments is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-038` - confidentiality commitments c1 confidentiality data_classification encryption policy owner evidence review log ticket control

tags: confidentiality, data_classification, encryption, soc2, readiness | hits: 0

No direct evidence hits for this query.

`SOC2-Q-039` - confidentiality commitments c1 confidentiality data_classification encryption policy owner evidence review log ticket control

tags: confidentiality, data_classification, encryption, soc2, readiness | hits: 0

No direct evidence hits for this query.

`SOC2-Q-037` - confidentiality commitments c1 confidentiality data_classification encryption policy owner evidence review log ticket control

tags: confidentiality, data_classification, encryption, soc2, readiness | hits: 0

No direct evidence hits for this query.

`C1.3` - C1.3 Confidentiality Commitments readiness

gap | severity 5 | evidence_count 0

Demonstrate that confidentiality commitments is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-039` - confidentiality commitments c1 confidentiality data_classification encryption policy owner evidence review log ticket control

tags: confidentiality, data_classification, encryption, soc2, readiness | hits: 0

No direct evidence hits for this query.

`SOC2-Q-037` - confidentiality commitments c1 confidentiality data_classification encryption policy owner evidence review log ticket control

tags: confidentiality, data_classification, encryption, soc2, readiness | hits: 0

No direct evidence hits for this query.

`SOC2-Q-038` - confidentiality commitments c1 confidentiality data_classification encryption policy owner evidence review log ticket control

tags: confidentiality, data_classification, encryption, soc2, readiness | hits: 0

No direct evidence hits for this query.

`C1.4` - C1.4 Confidentiality Commitments readiness

gap | severity 4 | evidence_count 0

Demonstrate that confidentiality commitments is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-037` - confidentiality commitments c1 confidentiality data_classification encryption policy owner evidence review log ticket control

tags: confidentiality, data_classification, encryption, soc2, readiness | hits: 0

No direct evidence hits for this query.

`SOC2-Q-038` - confidentiality commitments c1 confidentiality data_classification encryption policy owner evidence review log ticket control

tags: confidentiality, data_classification, encryption, soc2, readiness | hits: 0

No direct evidence hits for this query.

`SOC2-Q-039` - confidentiality commitments c1 confidentiality data_classification encryption policy owner evidence review log ticket control

tags: confidentiality, data_classification, encryption, soc2, readiness | hits: 0

No direct evidence hits for this query.

`C1.5` - C1.5 Confidentiality Commitments readiness

gap | severity 5 | evidence_count 0

Demonstrate that confidentiality commitments is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-038` - confidentiality commitments c1 confidentiality data_classification encryption policy owner evidence review log ticket control

tags: confidentiality, data_classification, encryption, soc2, readiness | hits: 0

No direct evidence hits for this query.

`SOC2-Q-039` - confidentiality commitments c1 confidentiality data_classification encryption policy owner evidence review log ticket control

tags: confidentiality, data_classification, encryption, soc2, readiness | hits: 0

No direct evidence hits for this query.

`SOC2-Q-037` - confidentiality commitments c1 confidentiality data_classification encryption policy owner evidence review log ticket control

tags: confidentiality, data_classification, encryption, soc2, readiness | hits: 0

No direct evidence hits for this query.

`C1.6` - C1.6 Confidentiality Commitments readiness

gap | severity 4 | evidence_count 0

Demonstrate that confidentiality commitments is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-039` - confidentiality commitments c1 confidentiality data_classification encryption policy owner evidence review log ticket control

tags: confidentiality, data_classification, encryption, soc2, readiness | hits: 0

No direct evidence hits for this query.

`SOC2-Q-037` - confidentiality commitments c1 confidentiality data_classification encryption policy owner evidence review log ticket control

tags: confidentiality, data_classification, encryption, soc2, readiness | hits: 0

No direct evidence hits for this query.

`SOC2-Q-038` - confidentiality commitments c1 confidentiality data_classification encryption policy owner evidence review log ticket control

tags: confidentiality, data_classification, encryption, soc2, readiness | hits: 0

No direct evidence hits for this query.

`C2.1` - C2.1 Confidential Data Lifecycle readiness

gap | severity 5 | evidence_count 0

Demonstrate that confidential data lifecycle is defined, operated, and reviewable with reproducible local evidence.

Expected evidence: Written policy or procedure showing ownership, approval, and review cadence for confidential data lifecycle.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.

`SOC2-Q-040` - confidential data lifecycle c2 confidentiality data_handling retention policy owner evidence review log ticket control

tags: confidentiality, data_handling, retention, soc2, readiness | hits: 0

No direct evidence hits for this query.

`SOC2-Q-041` - confidential data lifecycle c2 confidentiality data_handling retention policy owner evidence review log ticket control

tags: confidentiality, data_handling, retention, soc2, readiness | hits: 0

No direct evidence hits for this query.

`SOC2-Q-042` - confidential data lifecycle c2 confidentiality data_handling retention policy owner evidence review log ticket control

tags: confidentiality, data_handling, retention, soc2, readiness | hits: 0

No direct evidence hits for this query.

`C2.2` - C2.2 Confidential Data Lifecycle readiness

gap | severity 4 | evidence_count 0

Demonstrate that confidential data lifecycle is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-041` - confidential data lifecycle c2 confidentiality data_handling retention policy owner evidence review log ticket control

tags: confidentiality, data_handling, retention, soc2, readiness | hits: 0

No direct evidence hits for this query.

`SOC2-Q-042` - confidential data lifecycle c2 confidentiality data_handling retention policy owner evidence review log ticket control

tags: confidentiality, data_handling, retention, soc2, readiness | hits: 0

No direct evidence hits for this query.

`SOC2-Q-040` - confidential data lifecycle c2 confidentiality data_handling retention policy owner evidence review log ticket control

tags: confidentiality, data_handling, retention, soc2, readiness | hits: 0

No direct evidence hits for this query.

`C2.3` - C2.3 Confidential Data Lifecycle readiness

gap | severity 5 | evidence_count 0

Demonstrate that confidential data lifecycle is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-042` - confidential data lifecycle c2 confidentiality data_handling retention policy owner evidence review log ticket control

tags: confidentiality, data_handling, retention, soc2, readiness | hits: 0

No direct evidence hits for this query.

`SOC2-Q-040` - confidential data lifecycle c2 confidentiality data_handling retention policy owner evidence review log ticket control

tags: confidentiality, data_handling, retention, soc2, readiness | hits: 0

No direct evidence hits for this query.

`SOC2-Q-041` - confidential data lifecycle c2 confidentiality data_handling retention policy owner evidence review log ticket control

tags: confidentiality, data_handling, retention, soc2, readiness | hits: 0

No direct evidence hits for this query.

`C2.4` - C2.4 Confidential Data Lifecycle readiness

gap | severity 4 | evidence_count 0

Demonstrate that confidential data lifecycle is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-040` - confidential data lifecycle c2 confidentiality data_handling retention policy owner evidence review log ticket control

tags: confidentiality, data_handling, retention, soc2, readiness | hits: 0

No direct evidence hits for this query.

`SOC2-Q-041` - confidential data lifecycle c2 confidentiality data_handling retention policy owner evidence review log ticket control

tags: confidentiality, data_handling, retention, soc2, readiness | hits: 0

No direct evidence hits for this query.

`SOC2-Q-042` - confidential data lifecycle c2 confidentiality data_handling retention policy owner evidence review log ticket control

tags: confidentiality, data_handling, retention, soc2, readiness | hits: 0

No direct evidence hits for this query.

`C2.5` - C2.5 Confidential Data Lifecycle readiness

gap | severity 5 | evidence_count 0

Demonstrate that confidential data lifecycle is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-041` - confidential data lifecycle c2 confidentiality data_handling retention policy owner evidence review log ticket control

tags: confidentiality, data_handling, retention, soc2, readiness | hits: 0

No direct evidence hits for this query.

`SOC2-Q-042` - confidential data lifecycle c2 confidentiality data_handling retention policy owner evidence review log ticket control

tags: confidentiality, data_handling, retention, soc2, readiness | hits: 0

No direct evidence hits for this query.

`SOC2-Q-040` - confidential data lifecycle c2 confidentiality data_handling retention policy owner evidence review log ticket control

tags: confidentiality, data_handling, retention, soc2, readiness | hits: 0

No direct evidence hits for this query.

`C2.6` - C2.6 Confidential Data Lifecycle readiness

gap | severity 4 | evidence_count 0

Demonstrate that confidential data lifecycle is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-042` - confidential data lifecycle c2 confidentiality data_handling retention policy owner evidence review log ticket control

tags: confidentiality, data_handling, retention, soc2, readiness | hits: 0

No direct evidence hits for this query.

`SOC2-Q-040` - confidential data lifecycle c2 confidentiality data_handling retention policy owner evidence review log ticket control

tags: confidentiality, data_handling, retention, soc2, readiness | hits: 0

No direct evidence hits for this query.

`SOC2-Q-041` - confidential data lifecycle c2 confidentiality data_handling retention policy owner evidence review log ticket control

tags: confidentiality, data_handling, retention, soc2, readiness | hits: 0

No direct evidence hits for this query.

`A1.1` - A1.1 Availability Planning readiness

gap | severity 4 | evidence_count 0

Demonstrate that availability planning is defined, operated, and reviewable with reproducible local evidence.

Expected evidence: Written policy or procedure showing ownership, approval, and review cadence for availability planning.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.

`SOC2-Q-043` - availability planning a1 availability capacity sla policy owner evidence review log ticket control

tags: availability, capacity, sla, soc2, readiness | hits: 0

No direct evidence hits for this query.

`SOC2-Q-044` - availability planning a1 availability capacity sla policy owner evidence review log ticket control

tags: availability, capacity, sla, soc2, readiness | hits: 0

No direct evidence hits for this query.

`A1.2` - A1.2 Availability Planning readiness

gap | severity 3 | evidence_count 0

Demonstrate that availability planning is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-044` - availability planning a1 availability capacity sla policy owner evidence review log ticket control

tags: availability, capacity, sla, soc2, readiness | hits: 0

No direct evidence hits for this query.

`SOC2-Q-043` - availability planning a1 availability capacity sla policy owner evidence review log ticket control

tags: availability, capacity, sla, soc2, readiness | hits: 0

No direct evidence hits for this query.

`A1.3` - A1.3 Availability Planning readiness

gap | severity 4 | evidence_count 0

Demonstrate that availability planning is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-043` - availability planning a1 availability capacity sla policy owner evidence review log ticket control

tags: availability, capacity, sla, soc2, readiness | hits: 0

No direct evidence hits for this query.

`SOC2-Q-044` - availability planning a1 availability capacity sla policy owner evidence review log ticket control

tags: availability, capacity, sla, soc2, readiness | hits: 0

No direct evidence hits for this query.

`A1.4` - A1.4 Availability Planning readiness

gap | severity 3 | evidence_count 0

Demonstrate that availability planning is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-044` - availability planning a1 availability capacity sla policy owner evidence review log ticket control

tags: availability, capacity, sla, soc2, readiness | hits: 0

No direct evidence hits for this query.

`SOC2-Q-043` - availability planning a1 availability capacity sla policy owner evidence review log ticket control

tags: availability, capacity, sla, soc2, readiness | hits: 0

No direct evidence hits for this query.

`A2.1` - A2.1 Backup and Recovery readiness

gap | severity 4 | evidence_count 0

Demonstrate that backup and recovery is defined, operated, and reviewable with reproducible local evidence.

Expected evidence: Written policy or procedure showing ownership, approval, and review cadence for backup and recovery.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.

`SOC2-Q-045` - backup and recovery a2 availability backup restore policy owner evidence review log ticket control

tags: availability, backup, restore, soc2, readiness | hits: 0

No direct evidence hits for this query.

`SOC2-Q-046` - backup and recovery a2 availability backup restore policy owner evidence review log ticket control

tags: availability, backup, restore, soc2, readiness | hits: 0

No direct evidence hits for this query.

`A2.2` - A2.2 Backup and Recovery readiness

gap | severity 3 | evidence_count 0

Demonstrate that backup and recovery is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-046` - backup and recovery a2 availability backup restore policy owner evidence review log ticket control

tags: availability, backup, restore, soc2, readiness | hits: 0

No direct evidence hits for this query.

`SOC2-Q-045` - backup and recovery a2 availability backup restore policy owner evidence review log ticket control

tags: availability, backup, restore, soc2, readiness | hits: 0

No direct evidence hits for this query.

`A2.3` - A2.3 Backup and Recovery readiness

gap | severity 4 | evidence_count 0

Demonstrate that backup and recovery is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-045` - backup and recovery a2 availability backup restore policy owner evidence review log ticket control

tags: availability, backup, restore, soc2, readiness | hits: 0

No direct evidence hits for this query.

`SOC2-Q-046` - backup and recovery a2 availability backup restore policy owner evidence review log ticket control

tags: availability, backup, restore, soc2, readiness | hits: 0

No direct evidence hits for this query.

`A2.4` - A2.4 Backup and Recovery readiness

gap | severity 3 | evidence_count 0

Demonstrate that backup and recovery is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-046` - backup and recovery a2 availability backup restore policy owner evidence review log ticket control

tags: availability, backup, restore, soc2, readiness | hits: 0

No direct evidence hits for this query.

`SOC2-Q-045` - backup and recovery a2 availability backup restore policy owner evidence review log ticket control

tags: availability, backup, restore, soc2, readiness | hits: 0

No direct evidence hits for this query.

`A3.1` - A3.1 Resilience Testing readiness

gap | severity 4 | evidence_count 0

Demonstrate that resilience testing is defined, operated, and reviewable with reproducible local evidence.

Expected evidence: Written policy or procedure showing ownership, approval, and review cadence for resilience testing.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.

`SOC2-Q-047` - resilience testing a3 availability dr_testing continuity policy owner evidence review log ticket control

tags: availability, dr_testing, continuity, soc2, readiness | hits: 0

No direct evidence hits for this query.

`SOC2-Q-048` - resilience testing a3 availability dr_testing continuity policy owner evidence review log ticket control

tags: availability, dr_testing, continuity, soc2, readiness | hits: 0

No direct evidence hits for this query.

`A3.2` - A3.2 Resilience Testing readiness

gap | severity 3 | evidence_count 0

Demonstrate that resilience testing is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-048` - resilience testing a3 availability dr_testing continuity policy owner evidence review log ticket control

tags: availability, dr_testing, continuity, soc2, readiness | hits: 0

No direct evidence hits for this query.

`SOC2-Q-047` - resilience testing a3 availability dr_testing continuity policy owner evidence review log ticket control

tags: availability, dr_testing, continuity, soc2, readiness | hits: 0

No direct evidence hits for this query.

`A3.3` - A3.3 Resilience Testing readiness

gap | severity 4 | evidence_count 0

Demonstrate that resilience testing is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-047` - resilience testing a3 availability dr_testing continuity policy owner evidence review log ticket control

tags: availability, dr_testing, continuity, soc2, readiness | hits: 0

No direct evidence hits for this query.

`SOC2-Q-048` - resilience testing a3 availability dr_testing continuity policy owner evidence review log ticket control

tags: availability, dr_testing, continuity, soc2, readiness | hits: 0

No direct evidence hits for this query.

`A3.4` - A3.4 Resilience Testing readiness

gap | severity 3 | evidence_count 0

Demonstrate that resilience testing is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-048` - resilience testing a3 availability dr_testing continuity policy owner evidence review log ticket control

tags: availability, dr_testing, continuity, soc2, readiness | hits: 0

No direct evidence hits for this query.

`SOC2-Q-047` - resilience testing a3 availability dr_testing continuity policy owner evidence review log ticket control

tags: availability, dr_testing, continuity, soc2, readiness | hits: 0

No direct evidence hits for this query.

`PI1.1` - PI1.1 Input Integrity readiness

gap | severity 3 | evidence_count 0

Demonstrate that input integrity is defined, operated, and reviewable with reproducible local evidence.

Expected evidence: Written policy or procedure showing ownership, approval, and review cadence for input integrity.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.

`SOC2-Q-049` - input integrity pi1 processing_integrity input_validation completeness policy owner evidence review log ticket control

tags: processing_integrity, input_validation, completeness, soc2, readiness, processingintegrity | hits: 0

No direct evidence hits for this query.

`PI1.2` - PI1.2 Input Integrity readiness

gap | severity 4 | evidence_count 0

Demonstrate that input integrity is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-049` - input integrity pi1 processing_integrity input_validation completeness policy owner evidence review log ticket control

tags: processing_integrity, input_validation, completeness, soc2, readiness, processingintegrity | hits: 0

No direct evidence hits for this query.

`PI1.3` - PI1.3 Input Integrity readiness

gap | severity 3 | evidence_count 0

Demonstrate that input integrity is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-049` - input integrity pi1 processing_integrity input_validation completeness policy owner evidence review log ticket control

tags: processing_integrity, input_validation, completeness, soc2, readiness, processingintegrity | hits: 0

No direct evidence hits for this query.

`PI2.1` - PI2.1 Processing Accuracy readiness

gap | severity 3 | evidence_count 0

Demonstrate that processing accuracy is defined, operated, and reviewable with reproducible local evidence.

Expected evidence: Written policy or procedure showing ownership, approval, and review cadence for processing accuracy.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.

`SOC2-Q-050` - processing accuracy pi2 processing_integrity accuracy reconciliation policy owner evidence review log ticket control

tags: processing_integrity, accuracy, reconciliation, soc2, readiness, processingintegrity | hits: 0

No direct evidence hits for this query.

`PI2.2` - PI2.2 Processing Accuracy readiness

gap | severity 4 | evidence_count 0

Demonstrate that processing accuracy is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-050` - processing accuracy pi2 processing_integrity accuracy reconciliation policy owner evidence review log ticket control

tags: processing_integrity, accuracy, reconciliation, soc2, readiness, processingintegrity | hits: 0

No direct evidence hits for this query.

`PI2.3` - PI2.3 Processing Accuracy readiness

gap | severity 3 | evidence_count 0

Demonstrate that processing accuracy is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-050` - processing accuracy pi2 processing_integrity accuracy reconciliation policy owner evidence review log ticket control

tags: processing_integrity, accuracy, reconciliation, soc2, readiness, processingintegrity | hits: 0

No direct evidence hits for this query.

`PI3.1` - PI3.1 Exception Handling readiness

gap | severity 3 | evidence_count 0

Demonstrate that exception handling is defined, operated, and reviewable with reproducible local evidence.

Expected evidence: Written policy or procedure showing ownership, approval, and review cadence for exception handling.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.

`SOC2-Q-051` - exception handling pi3 processing_integrity exceptions workflow policy owner evidence review log ticket control

tags: processing_integrity, exceptions, workflow, soc2, readiness, processingintegrity | hits: 0

No direct evidence hits for this query.

`PI3.2` - PI3.2 Exception Handling readiness

gap | severity 4 | evidence_count 0

Demonstrate that exception handling is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-051` - exception handling pi3 processing_integrity exceptions workflow policy owner evidence review log ticket control

tags: processing_integrity, exceptions, workflow, soc2, readiness, processingintegrity | hits: 0

No direct evidence hits for this query.

`PI3.3` - PI3.3 Exception Handling readiness

gap | severity 3 | evidence_count 0

Demonstrate that exception handling is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-051` - exception handling pi3 processing_integrity exceptions workflow policy owner evidence review log ticket control

tags: processing_integrity, exceptions, workflow, soc2, readiness, processingintegrity | hits: 0

No direct evidence hits for this query.

`PI4.1` - PI4.1 Job and Batch Control readiness

gap | severity 3 | evidence_count 0

Demonstrate that job and batch control is defined, operated, and reviewable with reproducible local evidence.

Expected evidence: Written policy or procedure showing ownership, approval, and review cadence for job and batch control.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.

`SOC2-Q-052` - job and batch control pi4 processing_integrity job_control batch policy owner evidence review log ticket control

tags: processing_integrity, job_control, batch, soc2, readiness, processingintegrity | hits: 0

No direct evidence hits for this query.

`PI4.2` - PI4.2 Job and Batch Control readiness

gap | severity 4 | evidence_count 0

Demonstrate that job and batch control is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-052` - job and batch control pi4 processing_integrity job_control batch policy owner evidence review log ticket control

tags: processing_integrity, job_control, batch, soc2, readiness, processingintegrity | hits: 0

No direct evidence hits for this query.

`PI4.3` - PI4.3 Job and Batch Control readiness

gap | severity 3 | evidence_count 0

Demonstrate that job and batch control is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-052` - job and batch control pi4 processing_integrity job_control batch policy owner evidence review log ticket control

tags: processing_integrity, job_control, batch, soc2, readiness, processingintegrity | hits: 0

No direct evidence hits for this query.

`PI5.1` - PI5.1 Output Review readiness

gap | severity 3 | evidence_count 0

Demonstrate that output review is defined, operated, and reviewable with reproducible local evidence.

Expected evidence: Written policy or procedure showing ownership, approval, and review cadence for output review.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.

`SOC2-Q-053` - output review pi5 processing_integrity output_review traceability policy owner evidence review log ticket control

tags: processing_integrity, output_review, traceability, soc2, readiness, processingintegrity | hits: 0

No direct evidence hits for this query.

`PI5.2` - PI5.2 Output Review readiness

gap | severity 4 | evidence_count 0

Demonstrate that output review is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-053` - output review pi5 processing_integrity output_review traceability policy owner evidence review log ticket control

tags: processing_integrity, output_review, traceability, soc2, readiness, processingintegrity | hits: 0

No direct evidence hits for this query.

`PI5.3` - PI5.3 Output Review readiness

gap | severity 3 | evidence_count 0

Demonstrate that output review is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-053` - output review pi5 processing_integrity output_review traceability policy owner evidence review log ticket control

tags: processing_integrity, output_review, traceability, soc2, readiness, processingintegrity | hits: 0

No direct evidence hits for this query.

`P1.1` - P1.1 Notice and Transparency readiness

gap | severity 4 | evidence_count 0

Demonstrate that notice and transparency is defined, operated, and reviewable with reproducible local evidence.

Expected evidence: Written policy or procedure showing ownership, approval, and review cadence for notice and transparency.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.

`SOC2-Q-054` - notice and transparency p1 privacy notice consent policy owner evidence review log ticket control

tags: privacy, notice, consent, soc2, readiness | hits: 0

No direct evidence hits for this query.

`P1.2` - P1.2 Notice and Transparency readiness

gap | severity 3 | evidence_count 0

Demonstrate that notice and transparency is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-054` - notice and transparency p1 privacy notice consent policy owner evidence review log ticket control

tags: privacy, notice, consent, soc2, readiness | hits: 0

No direct evidence hits for this query.

`P2.1` - P2.1 Collection and Use Limitation readiness

gap | severity 4 | evidence_count 0

Demonstrate that collection and use limitation is defined, operated, and reviewable with reproducible local evidence.

Expected evidence: Written policy or procedure showing ownership, approval, and review cadence for collection and use limitation.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.

`SOC2-Q-055` - collection and use limitation p2 privacy collection purpose_limitation policy owner evidence review log ticket control

tags: privacy, collection, purpose_limitation, soc2, readiness | hits: 0

No direct evidence hits for this query.

`P2.2` - P2.2 Collection and Use Limitation readiness

gap | severity 3 | evidence_count 0

Demonstrate that collection and use limitation is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-055` - collection and use limitation p2 privacy collection purpose_limitation policy owner evidence review log ticket control

tags: privacy, collection, purpose_limitation, soc2, readiness | hits: 0

No direct evidence hits for this query.

`P3.1` - P3.1 Data Subject Rights readiness

gap | severity 4 | evidence_count 0

Demonstrate that data subject rights is defined, operated, and reviewable with reproducible local evidence.

Expected evidence: Written policy or procedure showing ownership, approval, and review cadence for data subject rights.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.

`SOC2-Q-056` - data subject rights p3 privacy data_subject_rights request_handling policy owner evidence review log ticket control

tags: privacy, data_subject_rights, request_handling, soc2, readiness | hits: 0

No direct evidence hits for this query.

`P3.2` - P3.2 Data Subject Rights readiness

gap | severity 3 | evidence_count 0

Demonstrate that data subject rights is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-056` - data subject rights p3 privacy data_subject_rights request_handling policy owner evidence review log ticket control

tags: privacy, data_subject_rights, request_handling, soc2, readiness | hits: 0

No direct evidence hits for this query.

`P4.1` - P4.1 Privacy Safeguards readiness

gap | severity 4 | evidence_count 0

Demonstrate that privacy safeguards is defined, operated, and reviewable with reproducible local evidence.

Expected evidence: Written policy or procedure showing ownership, approval, and review cadence for privacy safeguards.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.

`SOC2-Q-057` - privacy safeguards p4 privacy safeguards confidentiality policy owner evidence review log ticket control

tags: privacy, safeguards, confidentiality, soc2, readiness | hits: 0

No direct evidence hits for this query.

`P4.2` - P4.2 Privacy Safeguards readiness

gap | severity 3 | evidence_count 0

Demonstrate that privacy safeguards is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-057` - privacy safeguards p4 privacy safeguards confidentiality policy owner evidence review log ticket control

tags: privacy, safeguards, confidentiality, soc2, readiness | hits: 0

No direct evidence hits for this query.

`P5.1` - P5.1 Third-Party Privacy Management readiness

gap | severity 4 | evidence_count 0

Demonstrate that third-party privacy management is defined, operated, and reviewable with reproducible local evidence.

Expected evidence: Written policy or procedure showing ownership, approval, and review cadence for third-party privacy management.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.

`SOC2-Q-058` - third-party privacy management p5 privacy third_party contracts policy owner evidence review log ticket control

tags: privacy, third_party, contracts, soc2, readiness | hits: 0

No direct evidence hits for this query.

`P5.2` - P5.2 Third-Party Privacy Management readiness

gap | severity 3 | evidence_count 0

Demonstrate that third-party privacy management is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-058` - third-party privacy management p5 privacy third_party contracts policy owner evidence review log ticket control

tags: privacy, third_party, contracts, soc2, readiness | hits: 0

No direct evidence hits for this query.

`P6.1` - P6.1 Privacy Monitoring readiness

gap | severity 4 | evidence_count 0

Demonstrate that privacy monitoring is defined, operated, and reviewable with reproducible local evidence.

Expected evidence: Written policy or procedure showing ownership, approval, and review cadence for privacy monitoring.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.

`SOC2-Q-059` - privacy monitoring p6 privacy monitoring compliance policy owner evidence review log ticket control

tags: privacy, monitoring, compliance, soc2, readiness | hits: 0

No direct evidence hits for this query.

`P6.2` - P6.2 Privacy Monitoring readiness

gap | severity 3 | evidence_count 0

Demonstrate that privacy monitoring is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-059` - privacy monitoring p6 privacy monitoring compliance policy owner evidence review log ticket control

tags: privacy, monitoring, compliance, soc2, readiness | hits: 0

No direct evidence hits for this query.

`P7.1` - P7.1 Privacy Incident Response readiness

gap | severity 4 | evidence_count 0

Demonstrate that privacy incident response is defined, operated, and reviewable with reproducible local evidence.

Expected evidence: Written policy or procedure showing ownership, approval, and review cadence for privacy incident response.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.

`SOC2-Q-060` - privacy incident response p7 privacy incident_response breach policy owner evidence review log ticket control

tags: privacy, incident_response, breach, soc2, readiness | hits: 0

No direct evidence hits for this query.

`P7.2` - P7.2 Privacy Incident Response readiness

gap | severity 3 | evidence_count 0

Demonstrate that privacy incident response is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-060` - privacy incident response p7 privacy incident_response breach policy owner evidence review log ticket control

tags: privacy, incident_response, breach, soc2, readiness | hits: 0

No direct evidence hits for this query.

`P8.1` - P8.1 Retention and Disposal readiness

gap | severity 4 | evidence_count 0

Demonstrate that retention and disposal is defined, operated, and reviewable with reproducible local evidence.

Expected evidence: Written policy or procedure showing ownership, approval, and review cadence for retention and disposal.; Operational records (logs, tickets, reports, or dashboards) demonstrating the control is performed consistently.; Evidence of exception handling and remediation tracking when control failures or gaps are identified.

`SOC2-Q-061` - retention and disposal p8 privacy retention deletion policy owner evidence review log ticket control

tags: privacy, retention, deletion, soc2, readiness | hits: 0

No direct evidence hits for this query.

`P8.2` - P8.2 Retention and Disposal readiness

gap | severity 3 | evidence_count 0

Demonstrate that retention and disposal is defined, operated, and reviewable with reproducible local evidence.

`SOC2-Q-061` - retention and disposal p8 privacy retention deletion policy owner evidence review log ticket control

tags: privacy, retention, deletion, soc2, readiness | hits: 0

No direct evidence hits for this query.

Query Log

query_id	query_text	tags
`SOC2-Q-001`	control environment cc1 control_environment ethics tone policy owner evidence review log ticket control	control_environment, ethics, tone, soc2, readiness, security
`SOC2-Q-002`	control environment cc1 control_environment ethics tone policy owner evidence review log ticket control	control_environment, ethics, tone, soc2, readiness, security
`SOC2-Q-003`	control environment cc1 control_environment ethics tone policy owner evidence review log ticket control	control_environment, ethics, tone, soc2, readiness, security
`SOC2-Q-004`	control environment cc1 control_environment ethics tone policy owner evidence review log ticket control	control_environment, ethics, tone, soc2, readiness, security
`SOC2-Q-005`	communication and information cc2 communication reporting governance policy owner evidence review log ticket control	communication, reporting, governance, soc2, readiness, security
`SOC2-Q-006`	communication and information cc2 communication reporting governance policy owner evidence review log ticket control	communication, reporting, governance, soc2, readiness, security
`SOC2-Q-007`	communication and information cc2 communication reporting governance policy owner evidence review log ticket control	communication, reporting, governance, soc2, readiness, security
`SOC2-Q-008`	communication and information cc2 communication reporting governance policy owner evidence review log ticket control	communication, reporting, governance, soc2, readiness, security
`SOC2-Q-009`	risk assessment cc3 risk_assessment threat_modeling enterprise_risk policy owner evidence review log ticket control	risk_assessment, threat_modeling, enterprise_risk, soc2, readiness, security
`SOC2-Q-010`	risk assessment cc3 risk_assessment threat_modeling enterprise_risk policy owner evidence review log ticket control	risk_assessment, threat_modeling, enterprise_risk, soc2, readiness, security
`SOC2-Q-011`	risk assessment cc3 risk_assessment threat_modeling enterprise_risk policy owner evidence review log ticket control	risk_assessment, threat_modeling, enterprise_risk, soc2, readiness, security
`SOC2-Q-012`	risk assessment cc3 risk_assessment threat_modeling enterprise_risk policy owner evidence review log ticket control	risk_assessment, threat_modeling, enterprise_risk, soc2, readiness, security
`SOC2-Q-013`	monitoring activities cc4 monitoring metrics audit policy owner evidence review log ticket control	monitoring, metrics, audit, soc2, readiness, security
`SOC2-Q-014`	monitoring activities cc4 monitoring metrics audit policy owner evidence review log ticket control	monitoring, metrics, audit, soc2, readiness, security
`SOC2-Q-015`	monitoring activities cc4 monitoring metrics audit policy owner evidence review log ticket control	monitoring, metrics, audit, soc2, readiness, security
`SOC2-Q-016`	monitoring activities cc4 monitoring metrics audit policy owner evidence review log ticket control	monitoring, metrics, audit, soc2, readiness, security
`SOC2-Q-017`	control activities cc5 control_activities review segregation policy owner evidence review log ticket control	control_activities, review, segregation, soc2, readiness, security
`SOC2-Q-018`	control activities cc5 control_activities review segregation policy owner evidence review log ticket control	control_activities, review, segregation, soc2, readiness, security
`SOC2-Q-019`	control activities cc5 control_activities review segregation policy owner evidence review log ticket control	control_activities, review, segregation, soc2, readiness, security
`SOC2-Q-020`	control activities cc5 control_activities review segregation policy owner evidence review log ticket control	control_activities, review, segregation, soc2, readiness, security
`SOC2-Q-021`	logical and physical access cc6 logical_access identity mfa policy owner evidence review log ticket control	logical_access, identity, mfa, soc2, readiness, security
`SOC2-Q-022`	logical and physical access cc6 logical_access identity mfa policy owner evidence review log ticket control	logical_access, identity, mfa, soc2, readiness, security
`SOC2-Q-023`	logical and physical access cc6 logical_access identity mfa policy owner evidence review log ticket control	logical_access, identity, mfa, soc2, readiness, security
`SOC2-Q-024`	logical and physical access cc6 logical_access identity mfa policy owner evidence review log ticket control	logical_access, identity, mfa, soc2, readiness, security
`SOC2-Q-025`	system operations cc7 system_operations logging alerting policy owner evidence review log ticket control	system_operations, logging, alerting, soc2, readiness, security
`SOC2-Q-026`	system operations cc7 system_operations logging alerting policy owner evidence review log ticket control	system_operations, logging, alerting, soc2, readiness, security
`SOC2-Q-027`	system operations cc7 system_operations logging alerting policy owner evidence review log ticket control	system_operations, logging, alerting, soc2, readiness, security
`SOC2-Q-028`	system operations cc7 system_operations logging alerting policy owner evidence review log ticket control	system_operations, logging, alerting, soc2, readiness, security
`SOC2-Q-029`	change management cc8 change_management sdlc release policy owner evidence review log ticket control	change_management, sdlc, release, soc2, readiness, security
`SOC2-Q-030`	change management cc8 change_management sdlc release policy owner evidence review log ticket control	change_management, sdlc, release, soc2, readiness, security
`SOC2-Q-031`	change management cc8 change_management sdlc release policy owner evidence review log ticket control	change_management, sdlc, release, soc2, readiness, security
`SOC2-Q-032`	change management cc8 change_management sdlc release policy owner evidence review log ticket control	change_management, sdlc, release, soc2, readiness, security
`SOC2-Q-033`	risk mitigation cc9 risk_mitigation incident_response resilience policy owner evidence review log ticket control	risk_mitigation, incident_response, resilience, soc2, readiness, security
`SOC2-Q-034`	risk mitigation cc9 risk_mitigation incident_response resilience policy owner evidence review log ticket control	risk_mitigation, incident_response, resilience, soc2, readiness, security
`SOC2-Q-035`	risk mitigation cc9 risk_mitigation incident_response resilience policy owner evidence review log ticket control	risk_mitigation, incident_response, resilience, soc2, readiness, security
`SOC2-Q-036`	risk mitigation cc9 risk_mitigation incident_response resilience policy owner evidence review log ticket control	risk_mitigation, incident_response, resilience, soc2, readiness, security
`SOC2-Q-037`	confidentiality commitments c1 confidentiality data_classification encryption policy owner evidence review log ticket control	confidentiality, data_classification, encryption, soc2, readiness
`SOC2-Q-038`	confidentiality commitments c1 confidentiality data_classification encryption policy owner evidence review log ticket control	confidentiality, data_classification, encryption, soc2, readiness
`SOC2-Q-039`	confidentiality commitments c1 confidentiality data_classification encryption policy owner evidence review log ticket control	confidentiality, data_classification, encryption, soc2, readiness
`SOC2-Q-040`	confidential data lifecycle c2 confidentiality data_handling retention policy owner evidence review log ticket control	confidentiality, data_handling, retention, soc2, readiness
`SOC2-Q-041`	confidential data lifecycle c2 confidentiality data_handling retention policy owner evidence review log ticket control	confidentiality, data_handling, retention, soc2, readiness
`SOC2-Q-042`	confidential data lifecycle c2 confidentiality data_handling retention policy owner evidence review log ticket control	confidentiality, data_handling, retention, soc2, readiness
`SOC2-Q-043`	availability planning a1 availability capacity sla policy owner evidence review log ticket control	availability, capacity, sla, soc2, readiness
`SOC2-Q-044`	availability planning a1 availability capacity sla policy owner evidence review log ticket control	availability, capacity, sla, soc2, readiness
`SOC2-Q-045`	backup and recovery a2 availability backup restore policy owner evidence review log ticket control	availability, backup, restore, soc2, readiness
`SOC2-Q-046`	backup and recovery a2 availability backup restore policy owner evidence review log ticket control	availability, backup, restore, soc2, readiness
`SOC2-Q-047`	resilience testing a3 availability dr_testing continuity policy owner evidence review log ticket control	availability, dr_testing, continuity, soc2, readiness
`SOC2-Q-048`	resilience testing a3 availability dr_testing continuity policy owner evidence review log ticket control	availability, dr_testing, continuity, soc2, readiness
`SOC2-Q-049`	input integrity pi1 processing_integrity input_validation completeness policy owner evidence review log ticket control	processing_integrity, input_validation, completeness, soc2, readiness, processingintegrity
`SOC2-Q-050`	processing accuracy pi2 processing_integrity accuracy reconciliation policy owner evidence review log ticket control	processing_integrity, accuracy, reconciliation, soc2, readiness, processingintegrity
`SOC2-Q-051`	exception handling pi3 processing_integrity exceptions workflow policy owner evidence review log ticket control	processing_integrity, exceptions, workflow, soc2, readiness, processingintegrity
`SOC2-Q-052`	job and batch control pi4 processing_integrity job_control batch policy owner evidence review log ticket control	processing_integrity, job_control, batch, soc2, readiness, processingintegrity
`SOC2-Q-053`	output review pi5 processing_integrity output_review traceability policy owner evidence review log ticket control	processing_integrity, output_review, traceability, soc2, readiness, processingintegrity
`SOC2-Q-054`	notice and transparency p1 privacy notice consent policy owner evidence review log ticket control	privacy, notice, consent, soc2, readiness
`SOC2-Q-055`	collection and use limitation p2 privacy collection purpose_limitation policy owner evidence review log ticket control	privacy, collection, purpose_limitation, soc2, readiness
`SOC2-Q-056`	data subject rights p3 privacy data_subject_rights request_handling policy owner evidence review log ticket control	privacy, data_subject_rights, request_handling, soc2, readiness
`SOC2-Q-057`	privacy safeguards p4 privacy safeguards confidentiality policy owner evidence review log ticket control	privacy, safeguards, confidentiality, soc2, readiness
`SOC2-Q-058`	third-party privacy management p5 privacy third_party contracts policy owner evidence review log ticket control	privacy, third_party, contracts, soc2, readiness
`SOC2-Q-059`	privacy monitoring p6 privacy monitoring compliance policy owner evidence review log ticket control	privacy, monitoring, compliance, soc2, readiness
`SOC2-Q-060`	privacy incident response p7 privacy incident_response breach policy owner evidence review log ticket control	privacy, incident_response, breach, soc2, readiness
`SOC2-Q-061`	retention and disposal p8 privacy retention deletion policy owner evidence review log ticket control	privacy, retention, deletion, soc2, readiness

Query Log

query_id	query_text	tags
`SOC2-Q-001`	control environment cc1 control_environment ethics tone policy owner evidence review log ticket control	control_environment, ethics, tone, soc2, readiness, security
`SOC2-Q-002`	control environment cc1 control_environment ethics tone policy owner evidence review log ticket control	control_environment, ethics, tone, soc2, readiness, security
`SOC2-Q-003`	control environment cc1 control_environment ethics tone policy owner evidence review log ticket control	control_environment, ethics, tone, soc2, readiness, security
`SOC2-Q-004`	control environment cc1 control_environment ethics tone policy owner evidence review log ticket control	control_environment, ethics, tone, soc2, readiness, security
`SOC2-Q-005`	communication and information cc2 communication reporting governance policy owner evidence review log ticket control	communication, reporting, governance, soc2, readiness, security
`SOC2-Q-006`	communication and information cc2 communication reporting governance policy owner evidence review log ticket control	communication, reporting, governance, soc2, readiness, security
`SOC2-Q-007`	communication and information cc2 communication reporting governance policy owner evidence review log ticket control	communication, reporting, governance, soc2, readiness, security
`SOC2-Q-008`	communication and information cc2 communication reporting governance policy owner evidence review log ticket control	communication, reporting, governance, soc2, readiness, security
`SOC2-Q-009`	risk assessment cc3 risk_assessment threat_modeling enterprise_risk policy owner evidence review log ticket control	risk_assessment, threat_modeling, enterprise_risk, soc2, readiness, security
`SOC2-Q-010`	risk assessment cc3 risk_assessment threat_modeling enterprise_risk policy owner evidence review log ticket control	risk_assessment, threat_modeling, enterprise_risk, soc2, readiness, security
`SOC2-Q-011`	risk assessment cc3 risk_assessment threat_modeling enterprise_risk policy owner evidence review log ticket control	risk_assessment, threat_modeling, enterprise_risk, soc2, readiness, security
`SOC2-Q-012`	risk assessment cc3 risk_assessment threat_modeling enterprise_risk policy owner evidence review log ticket control	risk_assessment, threat_modeling, enterprise_risk, soc2, readiness, security
`SOC2-Q-013`	monitoring activities cc4 monitoring metrics audit policy owner evidence review log ticket control	monitoring, metrics, audit, soc2, readiness, security
`SOC2-Q-014`	monitoring activities cc4 monitoring metrics audit policy owner evidence review log ticket control	monitoring, metrics, audit, soc2, readiness, security
`SOC2-Q-015`	monitoring activities cc4 monitoring metrics audit policy owner evidence review log ticket control	monitoring, metrics, audit, soc2, readiness, security
`SOC2-Q-016`	monitoring activities cc4 monitoring metrics audit policy owner evidence review log ticket control	monitoring, metrics, audit, soc2, readiness, security
`SOC2-Q-017`	control activities cc5 control_activities review segregation policy owner evidence review log ticket control	control_activities, review, segregation, soc2, readiness, security
`SOC2-Q-018`	control activities cc5 control_activities review segregation policy owner evidence review log ticket control	control_activities, review, segregation, soc2, readiness, security
`SOC2-Q-019`	control activities cc5 control_activities review segregation policy owner evidence review log ticket control	control_activities, review, segregation, soc2, readiness, security
`SOC2-Q-020`	control activities cc5 control_activities review segregation policy owner evidence review log ticket control	control_activities, review, segregation, soc2, readiness, security
`SOC2-Q-021`	logical and physical access cc6 logical_access identity mfa policy owner evidence review log ticket control	logical_access, identity, mfa, soc2, readiness, security
`SOC2-Q-022`	logical and physical access cc6 logical_access identity mfa policy owner evidence review log ticket control	logical_access, identity, mfa, soc2, readiness, security
`SOC2-Q-023`	logical and physical access cc6 logical_access identity mfa policy owner evidence review log ticket control	logical_access, identity, mfa, soc2, readiness, security
`SOC2-Q-024`	logical and physical access cc6 logical_access identity mfa policy owner evidence review log ticket control	logical_access, identity, mfa, soc2, readiness, security
`SOC2-Q-025`	system operations cc7 system_operations logging alerting policy owner evidence review log ticket control	system_operations, logging, alerting, soc2, readiness, security
`SOC2-Q-026`	system operations cc7 system_operations logging alerting policy owner evidence review log ticket control	system_operations, logging, alerting, soc2, readiness, security
`SOC2-Q-027`	system operations cc7 system_operations logging alerting policy owner evidence review log ticket control	system_operations, logging, alerting, soc2, readiness, security
`SOC2-Q-028`	system operations cc7 system_operations logging alerting policy owner evidence review log ticket control	system_operations, logging, alerting, soc2, readiness, security
`SOC2-Q-029`	change management cc8 change_management sdlc release policy owner evidence review log ticket control	change_management, sdlc, release, soc2, readiness, security
`SOC2-Q-030`	change management cc8 change_management sdlc release policy owner evidence review log ticket control	change_management, sdlc, release, soc2, readiness, security
`SOC2-Q-031`	change management cc8 change_management sdlc release policy owner evidence review log ticket control	change_management, sdlc, release, soc2, readiness, security
`SOC2-Q-032`	change management cc8 change_management sdlc release policy owner evidence review log ticket control	change_management, sdlc, release, soc2, readiness, security
`SOC2-Q-033`	risk mitigation cc9 risk_mitigation incident_response resilience policy owner evidence review log ticket control	risk_mitigation, incident_response, resilience, soc2, readiness, security
`SOC2-Q-034`	risk mitigation cc9 risk_mitigation incident_response resilience policy owner evidence review log ticket control	risk_mitigation, incident_response, resilience, soc2, readiness, security
`SOC2-Q-035`	risk mitigation cc9 risk_mitigation incident_response resilience policy owner evidence review log ticket control	risk_mitigation, incident_response, resilience, soc2, readiness, security
`SOC2-Q-036`	risk mitigation cc9 risk_mitigation incident_response resilience policy owner evidence review log ticket control	risk_mitigation, incident_response, resilience, soc2, readiness, security
`SOC2-Q-037`	confidentiality commitments c1 confidentiality data_classification encryption policy owner evidence review log ticket control	confidentiality, data_classification, encryption, soc2, readiness
`SOC2-Q-038`	confidentiality commitments c1 confidentiality data_classification encryption policy owner evidence review log ticket control	confidentiality, data_classification, encryption, soc2, readiness
`SOC2-Q-039`	confidentiality commitments c1 confidentiality data_classification encryption policy owner evidence review log ticket control	confidentiality, data_classification, encryption, soc2, readiness
`SOC2-Q-040`	confidential data lifecycle c2 confidentiality data_handling retention policy owner evidence review log ticket control	confidentiality, data_handling, retention, soc2, readiness
`SOC2-Q-041`	confidential data lifecycle c2 confidentiality data_handling retention policy owner evidence review log ticket control	confidentiality, data_handling, retention, soc2, readiness
`SOC2-Q-042`	confidential data lifecycle c2 confidentiality data_handling retention policy owner evidence review log ticket control	confidentiality, data_handling, retention, soc2, readiness
`SOC2-Q-043`	availability planning a1 availability capacity sla policy owner evidence review log ticket control	availability, capacity, sla, soc2, readiness
`SOC2-Q-044`	availability planning a1 availability capacity sla policy owner evidence review log ticket control	availability, capacity, sla, soc2, readiness
`SOC2-Q-045`	backup and recovery a2 availability backup restore policy owner evidence review log ticket control	availability, backup, restore, soc2, readiness
`SOC2-Q-046`	backup and recovery a2 availability backup restore policy owner evidence review log ticket control	availability, backup, restore, soc2, readiness
`SOC2-Q-047`	resilience testing a3 availability dr_testing continuity policy owner evidence review log ticket control	availability, dr_testing, continuity, soc2, readiness
`SOC2-Q-048`	resilience testing a3 availability dr_testing continuity policy owner evidence review log ticket control	availability, dr_testing, continuity, soc2, readiness
`SOC2-Q-049`	input integrity pi1 processing_integrity input_validation completeness policy owner evidence review log ticket control	processing_integrity, input_validation, completeness, soc2, readiness, processingintegrity
`SOC2-Q-050`	processing accuracy pi2 processing_integrity accuracy reconciliation policy owner evidence review log ticket control	processing_integrity, accuracy, reconciliation, soc2, readiness, processingintegrity
`SOC2-Q-051`	exception handling pi3 processing_integrity exceptions workflow policy owner evidence review log ticket control	processing_integrity, exceptions, workflow, soc2, readiness, processingintegrity
`SOC2-Q-052`	job and batch control pi4 processing_integrity job_control batch policy owner evidence review log ticket control	processing_integrity, job_control, batch, soc2, readiness, processingintegrity
`SOC2-Q-053`	output review pi5 processing_integrity output_review traceability policy owner evidence review log ticket control	processing_integrity, output_review, traceability, soc2, readiness, processingintegrity
`SOC2-Q-054`	notice and transparency p1 privacy notice consent policy owner evidence review log ticket control	privacy, notice, consent, soc2, readiness
`SOC2-Q-055`	collection and use limitation p2 privacy collection purpose_limitation policy owner evidence review log ticket control	privacy, collection, purpose_limitation, soc2, readiness
`SOC2-Q-056`	data subject rights p3 privacy data_subject_rights request_handling policy owner evidence review log ticket control	privacy, data_subject_rights, request_handling, soc2, readiness
`SOC2-Q-057`	privacy safeguards p4 privacy safeguards confidentiality policy owner evidence review log ticket control	privacy, safeguards, confidentiality, soc2, readiness
`SOC2-Q-058`	third-party privacy management p5 privacy third_party contracts policy owner evidence review log ticket control	privacy, third_party, contracts, soc2, readiness
`SOC2-Q-059`	privacy monitoring p6 privacy monitoring compliance policy owner evidence review log ticket control	privacy, monitoring, compliance, soc2, readiness
`SOC2-Q-060`	privacy incident response p7 privacy incident_response breach policy owner evidence review log ticket control	privacy, incident_response, breach, soc2, readiness
`SOC2-Q-061`	retention and disposal p8 privacy retention deletion policy owner evidence review log ticket control	privacy, retention, deletion, soc2, readiness

Executive Summary

Key Gaps

Full Controls Table

Gap Register

Evidence Appendix

CC1.1 - CC1.1 Control Environment readiness

SOC2-Q-001 - control environment cc1 control_environment ethics tone policy owner evidence review log ticket control

SOC2-Q-002 - control environment cc1 control_environment ethics tone policy owner evidence review log ticket control

SOC2-Q-003 - control environment cc1 control_environment ethics tone policy owner evidence review log ticket control

CC1.2 - CC1.2 Control Environment readiness

SOC2-Q-002 - control environment cc1 control_environment ethics tone policy owner evidence review log ticket control

SOC2-Q-003 - control environment cc1 control_environment ethics tone policy owner evidence review log ticket control

SOC2-Q-004 - control environment cc1 control_environment ethics tone policy owner evidence review log ticket control

CC1.3 - CC1.3 Control Environment readiness

SOC2-Q-003 - control environment cc1 control_environment ethics tone policy owner evidence review log ticket control

SOC2-Q-004 - control environment cc1 control_environment ethics tone policy owner evidence review log ticket control

SOC2-Q-001 - control environment cc1 control_environment ethics tone policy owner evidence review log ticket control

CC1.4 - CC1.4 Control Environment readiness

SOC2-Q-004 - control environment cc1 control_environment ethics tone policy owner evidence review log ticket control

SOC2-Q-001 - control environment cc1 control_environment ethics tone policy owner evidence review log ticket control

SOC2-Q-002 - control environment cc1 control_environment ethics tone policy owner evidence review log ticket control

CC1.5 - CC1.5 Control Environment readiness

SOC2-Q-001 - control environment cc1 control_environment ethics tone policy owner evidence review log ticket control

SOC2-Q-002 - control environment cc1 control_environment ethics tone policy owner evidence review log ticket control

SOC2-Q-003 - control environment cc1 control_environment ethics tone policy owner evidence review log ticket control

CC2.1 - CC2.1 Communication and Information readiness

SOC2-Q-005 - communication and information cc2 communication reporting governance policy owner evidence review log ticket control

SOC2-Q-006 - communication and information cc2 communication reporting governance policy owner evidence review log ticket control

SOC2-Q-007 - communication and information cc2 communication reporting governance policy owner evidence review log ticket control

CC2.2 - CC2.2 Communication and Information readiness

SOC2-Q-006 - communication and information cc2 communication reporting governance policy owner evidence review log ticket control

SOC2-Q-007 - communication and information cc2 communication reporting governance policy owner evidence review log ticket control

SOC2-Q-008 - communication and information cc2 communication reporting governance policy owner evidence review log ticket control

CC2.3 - CC2.3 Communication and Information readiness

SOC2-Q-007 - communication and information cc2 communication reporting governance policy owner evidence review log ticket control

SOC2-Q-008 - communication and information cc2 communication reporting governance policy owner evidence review log ticket control

SOC2-Q-005 - communication and information cc2 communication reporting governance policy owner evidence review log ticket control

CC2.4 - CC2.4 Communication and Information readiness

SOC2-Q-008 - communication and information cc2 communication reporting governance policy owner evidence review log ticket control

SOC2-Q-005 - communication and information cc2 communication reporting governance policy owner evidence review log ticket control

SOC2-Q-006 - communication and information cc2 communication reporting governance policy owner evidence review log ticket control

CC2.5 - CC2.5 Communication and Information readiness

SOC2-Q-005 - communication and information cc2 communication reporting governance policy owner evidence review log ticket control

SOC2-Q-006 - communication and information cc2 communication reporting governance policy owner evidence review log ticket control

SOC2-Q-007 - communication and information cc2 communication reporting governance policy owner evidence review log ticket control

CC3.1 - CC3.1 Risk Assessment readiness

SOC2-Q-009 - risk assessment cc3 risk_assessment threat_modeling enterprise_risk policy owner evidence review log ticket control

SOC2-Q-010 - risk assessment cc3 risk_assessment threat_modeling enterprise_risk policy owner evidence review log ticket control

SOC2-Q-011 - risk assessment cc3 risk_assessment threat_modeling enterprise_risk policy owner evidence review log ticket control

CC3.2 - CC3.2 Risk Assessment readiness

SOC2-Q-010 - risk assessment cc3 risk_assessment threat_modeling enterprise_risk policy owner evidence review log ticket control

SOC2-Q-011 - risk assessment cc3 risk_assessment threat_modeling enterprise_risk policy owner evidence review log ticket control

SOC2-Q-012 - risk assessment cc3 risk_assessment threat_modeling enterprise_risk policy owner evidence review log ticket control

CC3.3 - CC3.3 Risk Assessment readiness

SOC2-Q-011 - risk assessment cc3 risk_assessment threat_modeling enterprise_risk policy owner evidence review log ticket control

SOC2-Q-012 - risk assessment cc3 risk_assessment threat_modeling enterprise_risk policy owner evidence review log ticket control

SOC2-Q-009 - risk assessment cc3 risk_assessment threat_modeling enterprise_risk policy owner evidence review log ticket control

CC3.4 - CC3.4 Risk Assessment readiness

SOC2-Q-012 - risk assessment cc3 risk_assessment threat_modeling enterprise_risk policy owner evidence review log ticket control

SOC2-Q-009 - risk assessment cc3 risk_assessment threat_modeling enterprise_risk policy owner evidence review log ticket control

SOC2-Q-010 - risk assessment cc3 risk_assessment threat_modeling enterprise_risk policy owner evidence review log ticket control

CC3.5 - CC3.5 Risk Assessment readiness

SOC2-Q-009 - risk assessment cc3 risk_assessment threat_modeling enterprise_risk policy owner evidence review log ticket control

SOC2-Q-010 - risk assessment cc3 risk_assessment threat_modeling enterprise_risk policy owner evidence review log ticket control

SOC2-Q-011 - risk assessment cc3 risk_assessment threat_modeling enterprise_risk policy owner evidence review log ticket control

CC4.1 - CC4.1 Monitoring Activities readiness

SOC2-Q-013 - monitoring activities cc4 monitoring metrics audit policy owner evidence review log ticket control

SOC2-Q-014 - monitoring activities cc4 monitoring metrics audit policy owner evidence review log ticket control

SOC2-Q-015 - monitoring activities cc4 monitoring metrics audit policy owner evidence review log ticket control

CC4.2 - CC4.2 Monitoring Activities readiness

SOC2-Q-014 - monitoring activities cc4 monitoring metrics audit policy owner evidence review log ticket control

SOC2-Q-015 - monitoring activities cc4 monitoring metrics audit policy owner evidence review log ticket control

SOC2-Q-016 - monitoring activities cc4 monitoring metrics audit policy owner evidence review log ticket control

CC4.3 - CC4.3 Monitoring Activities readiness

SOC2-Q-015 - monitoring activities cc4 monitoring metrics audit policy owner evidence review log ticket control

SOC2-Q-016 - monitoring activities cc4 monitoring metrics audit policy owner evidence review log ticket control

SOC2-Q-013 - monitoring activities cc4 monitoring metrics audit policy owner evidence review log ticket control

CC4.4 - CC4.4 Monitoring Activities readiness

SOC2-Q-016 - monitoring activities cc4 monitoring metrics audit policy owner evidence review log ticket control

SOC2-Q-013 - monitoring activities cc4 monitoring metrics audit policy owner evidence review log ticket control

`CC1.1` - CC1.1 Control Environment readiness

`SOC2-Q-001` - control environment cc1 control_environment ethics tone policy owner evidence review log ticket control

`SOC2-Q-002` - control environment cc1 control_environment ethics tone policy owner evidence review log ticket control

`SOC2-Q-003` - control environment cc1 control_environment ethics tone policy owner evidence review log ticket control

`CC1.2` - CC1.2 Control Environment readiness

`SOC2-Q-002` - control environment cc1 control_environment ethics tone policy owner evidence review log ticket control

`SOC2-Q-003` - control environment cc1 control_environment ethics tone policy owner evidence review log ticket control

`SOC2-Q-004` - control environment cc1 control_environment ethics tone policy owner evidence review log ticket control

`CC1.3` - CC1.3 Control Environment readiness

`SOC2-Q-003` - control environment cc1 control_environment ethics tone policy owner evidence review log ticket control

`SOC2-Q-004` - control environment cc1 control_environment ethics tone policy owner evidence review log ticket control

`SOC2-Q-001` - control environment cc1 control_environment ethics tone policy owner evidence review log ticket control

`CC1.4` - CC1.4 Control Environment readiness

`SOC2-Q-004` - control environment cc1 control_environment ethics tone policy owner evidence review log ticket control

`SOC2-Q-001` - control environment cc1 control_environment ethics tone policy owner evidence review log ticket control

`SOC2-Q-002` - control environment cc1 control_environment ethics tone policy owner evidence review log ticket control

`CC1.5` - CC1.5 Control Environment readiness

`SOC2-Q-001` - control environment cc1 control_environment ethics tone policy owner evidence review log ticket control

`SOC2-Q-002` - control environment cc1 control_environment ethics tone policy owner evidence review log ticket control

`SOC2-Q-003` - control environment cc1 control_environment ethics tone policy owner evidence review log ticket control

`CC2.1` - CC2.1 Communication and Information readiness

`SOC2-Q-005` - communication and information cc2 communication reporting governance policy owner evidence review log ticket control

`SOC2-Q-006` - communication and information cc2 communication reporting governance policy owner evidence review log ticket control

`SOC2-Q-007` - communication and information cc2 communication reporting governance policy owner evidence review log ticket control

`CC2.2` - CC2.2 Communication and Information readiness

`SOC2-Q-006` - communication and information cc2 communication reporting governance policy owner evidence review log ticket control

`SOC2-Q-007` - communication and information cc2 communication reporting governance policy owner evidence review log ticket control

`SOC2-Q-008` - communication and information cc2 communication reporting governance policy owner evidence review log ticket control

`CC2.3` - CC2.3 Communication and Information readiness

`SOC2-Q-007` - communication and information cc2 communication reporting governance policy owner evidence review log ticket control

`SOC2-Q-008` - communication and information cc2 communication reporting governance policy owner evidence review log ticket control

`SOC2-Q-005` - communication and information cc2 communication reporting governance policy owner evidence review log ticket control

`CC2.4` - CC2.4 Communication and Information readiness

`SOC2-Q-008` - communication and information cc2 communication reporting governance policy owner evidence review log ticket control

`SOC2-Q-005` - communication and information cc2 communication reporting governance policy owner evidence review log ticket control

`SOC2-Q-006` - communication and information cc2 communication reporting governance policy owner evidence review log ticket control

`CC2.5` - CC2.5 Communication and Information readiness

`SOC2-Q-005` - communication and information cc2 communication reporting governance policy owner evidence review log ticket control

`SOC2-Q-006` - communication and information cc2 communication reporting governance policy owner evidence review log ticket control

`SOC2-Q-007` - communication and information cc2 communication reporting governance policy owner evidence review log ticket control

`CC3.1` - CC3.1 Risk Assessment readiness

`SOC2-Q-009` - risk assessment cc3 risk_assessment threat_modeling enterprise_risk policy owner evidence review log ticket control

`SOC2-Q-010` - risk assessment cc3 risk_assessment threat_modeling enterprise_risk policy owner evidence review log ticket control

`SOC2-Q-011` - risk assessment cc3 risk_assessment threat_modeling enterprise_risk policy owner evidence review log ticket control

`CC3.2` - CC3.2 Risk Assessment readiness

`SOC2-Q-010` - risk assessment cc3 risk_assessment threat_modeling enterprise_risk policy owner evidence review log ticket control

`SOC2-Q-011` - risk assessment cc3 risk_assessment threat_modeling enterprise_risk policy owner evidence review log ticket control

`SOC2-Q-012` - risk assessment cc3 risk_assessment threat_modeling enterprise_risk policy owner evidence review log ticket control

`CC3.3` - CC3.3 Risk Assessment readiness

`SOC2-Q-011` - risk assessment cc3 risk_assessment threat_modeling enterprise_risk policy owner evidence review log ticket control

`SOC2-Q-012` - risk assessment cc3 risk_assessment threat_modeling enterprise_risk policy owner evidence review log ticket control

`SOC2-Q-009` - risk assessment cc3 risk_assessment threat_modeling enterprise_risk policy owner evidence review log ticket control

`CC3.4` - CC3.4 Risk Assessment readiness

`SOC2-Q-012` - risk assessment cc3 risk_assessment threat_modeling enterprise_risk policy owner evidence review log ticket control

`SOC2-Q-009` - risk assessment cc3 risk_assessment threat_modeling enterprise_risk policy owner evidence review log ticket control

`SOC2-Q-010` - risk assessment cc3 risk_assessment threat_modeling enterprise_risk policy owner evidence review log ticket control

`CC3.5` - CC3.5 Risk Assessment readiness

`SOC2-Q-009` - risk assessment cc3 risk_assessment threat_modeling enterprise_risk policy owner evidence review log ticket control

`SOC2-Q-010` - risk assessment cc3 risk_assessment threat_modeling enterprise_risk policy owner evidence review log ticket control

`SOC2-Q-011` - risk assessment cc3 risk_assessment threat_modeling enterprise_risk policy owner evidence review log ticket control

`CC4.1` - CC4.1 Monitoring Activities readiness

`SOC2-Q-013` - monitoring activities cc4 monitoring metrics audit policy owner evidence review log ticket control

`SOC2-Q-014` - monitoring activities cc4 monitoring metrics audit policy owner evidence review log ticket control

`SOC2-Q-015` - monitoring activities cc4 monitoring metrics audit policy owner evidence review log ticket control

`CC4.2` - CC4.2 Monitoring Activities readiness

`SOC2-Q-014` - monitoring activities cc4 monitoring metrics audit policy owner evidence review log ticket control

`SOC2-Q-015` - monitoring activities cc4 monitoring metrics audit policy owner evidence review log ticket control

`SOC2-Q-016` - monitoring activities cc4 monitoring metrics audit policy owner evidence review log ticket control

`CC4.3` - CC4.3 Monitoring Activities readiness

`SOC2-Q-015` - monitoring activities cc4 monitoring metrics audit policy owner evidence review log ticket control

`SOC2-Q-016` - monitoring activities cc4 monitoring metrics audit policy owner evidence review log ticket control

`SOC2-Q-013` - monitoring activities cc4 monitoring metrics audit policy owner evidence review log ticket control

`CC4.4` - CC4.4 Monitoring Activities readiness

`SOC2-Q-016` - monitoring activities cc4 monitoring metrics audit policy owner evidence review log ticket control

`SOC2-Q-013` - monitoring activities cc4 monitoring metrics audit policy owner evidence review log ticket control

`SOC2-Q-014` - monitoring activities cc4 monitoring metrics audit policy owner evidence review log ticket control

`CC4.5` - CC4.5 Monitoring Activities readiness

`SOC2-Q-013` - monitoring activities cc4 monitoring metrics audit policy owner evidence review log ticket control

`SOC2-Q-014` - monitoring activities cc4 monitoring metrics audit policy owner evidence review log ticket control

`SOC2-Q-015` - monitoring activities cc4 monitoring metrics audit policy owner evidence review log ticket control