SOC 2 with ISMS
Overview of SOC 2 mapped to the Kudo ISMS: domains, scope and equivalences between both cybersecurity frameworks.
SOC 2 Trust Services Criteria organized by their mapping to the Kudo domains and mapped to the ISMS policies.
CC — Common Criteria (Security)
COR — Organizational Coherence
🛡️ Information Security Policy
CC1.1–CC1.3, CC2.1 — Control environment: management commitment, structure and ethical values.
⚖️ Compliance Management Policy
CC1.4, CC1.5, CC4.2, CC5.1, CC5.2 — Responsibilities, oversight and control activities.
📄 Documents and Records Policy
CC2.2, CC2.3, CC5.3 — Communication of relevant information internally and externally.
⚠️ Risk Management Policy
CC3.1–CC3.4, CC9.1 — Risk assessment: risk identification, analysis and response.
🤝 Vendor Management Policy
CC9.2 — Risk mitigation with vendors and business partners.
CIP — Identity and Endpoints
🔑 Access Management Policy
CC6.1–CC6.3 — Logical access controls: authentication, authorization and credential management.
🔒 Hardening Policy
CC6.8, CC7.1 — Prevention and detection of unauthorized software and insecure configurations.
CIF — Infrastructure Cybersecurity
🏢 Physical Security Policy
CC6.4, CC6.5 — Physical access controls for facilities and infrastructure assets.
📡 Communications Security Policy
CC6.6 — Protection of logical transmissions against unauthorized access.
💻 IT Security Policy
CC6.7 — Restriction of the transmission, movement and deletion of information.
CCN — Business Continuity and Change
ADR — Analysis, Detection and Response
📊 Logging and Monitoring Policy
CC4.1, CC7.2 — Continuous monitoring of controls and evaluation of system performance.
🚨 Incident Management Policy
CC7.3–CC7.5 — Assessment of, response to and recovery from security events.
A — Availability
🛟 Business Continuity Policy
A1.1 — Availability of the infrastructure components needed for operations.
💾 Backup and Recovery Policies
A1.2 — Data backup and recovery to meet availability objectives.
💻 IT Security Policy
A1.3 — System recovery and restoration within the agreed time objectives.
C — Confidentiality
PI — Processing Integrity
👨💻 Secure Development Policy
PI1.1–PI1.3, PI1.5 — Complete, valid, accurate, timely and authorized transaction processing.
💻 IT Security Policy
PI1.4 — System outputs delivered to the correct recipients and protected in transit.