← All templates

SOC 2 Type II

AICPA Trust Service Criteria covering security, availability, processing integrity, confidentiality, and privacy for service organizations.

45 questions·Version 2017
Use this template free

Access Controls

  • Do you enforce multi-factor authentication (MFA) for all users accessing production systems?CC6.1
  • Is access to systems based on the principle of least privilege?CC6.1
  • Do you conduct periodic access reviews (at least quarterly)?CC6.2
  • Is access revoked within 24 hours of employee termination?CC6.2
  • Do you maintain an inventory of all user accounts with privileged access?CC6.2
  • Are shared or generic accounts prohibited?CC6.1

Encryption

  • Is all data encrypted in transit using TLS 1.2 or higher?CC6.7
  • Is all sensitive data encrypted at rest using AES-256 or equivalent?CC6.7
  • Are encryption keys managed using a dedicated key management system?CC6.7

Incident Response

  • Do you have a documented incident response plan?CC7.3
  • Is the incident response plan tested at least annually?CC7.3
  • Can you notify customers of a security incident within 72 hours?CC7.4
  • Do you maintain a log of all security incidents?CC7.3

Change Management

  • Do you have a formal change management process?CC8.1
  • Are all changes to production systems reviewed and approved before deployment?CC8.1
  • Do you conduct security testing before deploying changes to production?CC8.1

Risk Management

  • Do you conduct an annual risk assessment?CC3.1
  • Do you have a documented risk treatment process?CC3.2
  • Do you conduct background checks on employees with access to sensitive data?CC9.1

Availability

  • Do you have documented uptime SLAs?A1.1
  • What is your current uptime SLA percentage?A1.1
  • Do you have a business continuity plan?A1.2
  • Is the business continuity plan tested at least annually?A1.2
  • Do you have redundant infrastructure across multiple availability zones?A1.1

Monitoring

  • Do you have 24/7 security monitoring in place?CC7.1
  • Do you use a Security Information and Event Management (SIEM) system?CC7.1
  • Are logs retained for a minimum of 12 months?CC7.2
  • Do you conduct regular vulnerability scans?CC7.1
  • Do you conduct annual penetration testing?CC7.1

Vendor Management

  • Do you assess the security posture of your sub-processors?CC9.2
  • Do you have data processing agreements with all sub-processors?CC9.2

Confidentiality

  • Do you have a data classification policy?C1.1
  • Are NDAs required for employees and contractors with access to confidential data?C1.2
  • Do you have a secure data disposal process?C1.2

Privacy

  • Do you have a published privacy policy?P1.1
  • Do you obtain consent before collecting personal data?P3.1
  • Can you fulfill data subject access requests within 30 days?P5.1
  • Do you have a process for handling data deletion requests?P4.3

Physical Security

  • Do you have physical access controls for data centers?CC6.4
  • Are data centers compliant with SOC 2 or ISO 27001?CC6.4

Training

  • Do all employees receive annual security awareness training?CC1.4
  • Do you conduct phishing simulation exercises?CC1.4

Certifications

  • Do you hold a current SOC 2 Type II report?CC1.1
  • When was your most recent SOC 2 audit completed?CC1.1
  • Can you provide a copy of your most recent SOC 2 report?CC1.1

Send this questionnaire to your vendors

VendorAuditly automatically scores responses, maps answers to framework controls, and tracks coverage over time. Free to start.

Get started free →← All templates