SOC 2 Controls with ISMS

Control-by-control mapping between SOC 2 and the Kudo ISMS, with the complete structure ready for audits and evidence.

Table of the 62 SOC 2 Trust Services Criteria organized by category and mapped to the Kudo ISMS policies.

CC — Common Criteria (Security)

CC1 — Control Environment

Code	ISMS Policy
CC1.1	Information Security Policy
CC1.2	Information Security Policy
CC1.3	Information Security Policy
CC1.4	Compliance Management Policy
CC1.5	Compliance Management Policy

CC2 — Communication and Information

Code	ISMS Policy
CC2.1	Information Security Policy
CC2.2	Documents and Records Policy
CC2.3	Documents and Records Policy

CC3 — Risk Assessment

Code	ISMS Policy
CC3.1	Risk Management Policy
CC3.2	Risk Management Policy
CC3.3	Risk Management Policy
CC3.4	Risk Management Policy

CC4 — Monitoring Activities

Code	ISMS Policy
CC4.1	Logging and Monitoring Policy
CC4.2	Compliance Management Policy

CC5 — Control Activities

Code	ISMS Policy
CC5.1	Compliance Management Policy
CC5.2	Compliance Management Policy
CC5.3	Documents and Records Policy

CC6 — Logical and Physical Access Controls

Code	ISMS Policy
CC6.1	Access Management Policy
CC6.2	Access Management Policy
CC6.3	Access Management Policy
CC6.4	Physical Security Policy
CC6.5	Physical Security Policy
CC6.6	Communications Security Policy
CC6.7	IT Security Policy
CC6.8	Hardening Policy

CC7 — System Operations

Code	ISMS Policy
CC7.1	Hardening Policy
CC7.2	Logging and Monitoring Policy
CC7.3	Incident Management Policy
CC7.4	Incident Management Policy
CC7.5	Incident Management Policy

CC8 — Change Management

Code	ISMS Policy
CC8.1	Change and Configuration Management Policy

CC9 — Risk Mitigation

Code	ISMS Policy
CC9.1	Risk Management Policy
CC9.2	Vendor Management Policy

A — Availability

Code	ISMS Policy
A1.1	Business Continuity Policy
A1.2	Backup and Recovery Policies
A1.3	IT Security Policy

C — Confidentiality

Code	ISMS Policy
C1.1	Privacy Policy
C1.2	Privacy Policy

PI — Processing Integrity

Code	ISMS Policy
PI1.1	Secure Development Policy
PI1.2	Secure Development Policy
PI1.3	Secure Development Policy
PI1.4	IT Security Policy
PI1.5	Secure Development Policy

P — Privacy

Code	ISMS Policy
P1.1	Privacy Policy
P1.2	Privacy Policy
P2.1	Privacy Policy
P3.1	Privacy Policy
P3.2	Privacy Policy
P4.1	Privacy Policy
P4.2	Privacy Policy
P4.3	Privacy Policy
P5.1	Privacy Policy
P5.2	Privacy Policy
P6.1	Privacy Policy
P6.2	Privacy Policy
P6.3	Privacy Policy
P6.4	Privacy Policy
P6.5	Privacy Policy
P6.6	Privacy Policy
P6.7	Privacy Policy
P7.1	Privacy Policy
P8.1	Compliance Management Policy

SOC 2 with ISMS

Overview of SOC 2 mapped to the Kudo ISMS: domains, scope and equivalences between both cybersecurity frameworks.

Domain Mapping

Graphical mapping between SOC 2 and Kudo domains

On this page

CC — Common Criteria (Security)CC1 — Control Environment CC2 — Communication and Information CC3 — Risk Assessment CC4 — Monitoring Activities CC5 — Control Activities CC6 — Logical and Physical Access Controls CC7 — System Operations CC8 — Change Management CC9 — Risk Mitigation A — Availability C — Confidentiality PI — Processing Integrity P — Privacy