SOC 2 template · Type I and Type II
Incident Response Plan
Structured approach for detecting, responding to, and recovering from security incidents. Written for your company, citing the controls below.
- Sections
- 10
- Controls cited
- 8
- Formats
- PDF, Word
- Shelf
- 22 SOC 2documents in all
No card needed to start.
SOC 210 sections
Incident Response PlanStructured approach for detecting, responding to, and recovering from security incidents.
- Cites
- CC7.3, CC7.4, CC7.5 and 5 more
- Formats
- PDF and Word
SOC 2 shelf
Sections
Each written around your company: your tools, your roles, your review dates.
- Purpose and Scope
- Incident Classification
- Incident Response Team
- Detection and Identification
- Containment Strategy
- Eradication and Recovery
- Communication Plan
- Escalation Matrix
- Post-Incident Review
- Plan Testing
Controls it cites
The SOC 2 controls first, then the matching controls in other frameworks.
- CC7.3System Operations: Incident ResponseSOC 2
- CC7.4System Operations: Incident HandlingSOC 2
- CC7.5System Operations: RecoverySOC 2
- ISO A.5.24Incident Management PlanningISO 27001
- HIPAA §164.308(a)(6)Security Incident ProceduresHIPAA
- PCI DSS Req. 12.10Incident ResponsePCI DSS
- CSF RS.MA-1Incident ManagementNIST CSF
- CSF RS.CO-2Incident ReportingNIST CSF
- SOC 28 sections
Business Continuity Plan
CitesA1.1 A1.2 A1.3 +4 +5PDF · WordCites A1.1, Availability: Capacity Planning (SOC 2); A1.2, Availability: Recovery (SOC 2); A1.3, Availability: Recovery Testing (SOC 2), and 4 more. - SOC 28 sections
Disaster Recovery Plan
CitesA1.2 A1.3 CC7.5 +4 +5PDF · WordCites A1.2, Availability: Recovery (SOC 2); A1.3, Availability: Recovery Testing (SOC 2); CC7.5, System Operations: Recovery (SOC 2), and 4 more. - SOC 28 sections
Change Management Policy
CitesCC8.1 CC3.4 ISO A.8.32 +6 +7PDF · WordCites CC8.1, Change Management (SOC 2); CC3.4, COSO Principle 9: Change Impact (SOC 2); ISO A.8.32, Change Management (ISO 27001), and 6 more. - SOC 28 sections
Risk Assessment Policy
CitesCC3.1 CC3.2 CC3.3 +6 +7PDF · WordCites CC3.1, COSO Principle 6: Risk Objectives (SOC 2); CC3.2, COSO Principle 7: Risk Identification (SOC 2); CC3.3, COSO Principle 8: Fraud Risk (SOC 2), and 6 more. - SOC 27 sections
Vendor Management Policy
CitesCC9.2 CC2.3 ISO A.5.19 +4 +5PDF · WordCites CC9.2, Risk Mitigation: Vendor & Business Partner (SOC 2); CC2.3, COSO Principle 15: External Communication (SOC 2); ISO A.5.19, Information Security in Supplier Relationships (ISO 27001), and 4 more. - SOC 27 sections
Data Retention Policy
CitesCC6.5 C1.2 ISO A.5.12 +4 +5PDF · WordCites CC6.5, Logical & Physical Access: Asset Disposal (SOC 2); C1.2, Confidentiality: Disposal (SOC 2); ISO A.5.12, Classification of Information (ISO 27001), and 4 more.
SOC 2 on its own
- Documents
- 22
- Plan
- Growth
- Price
- $199 a month or $1,990 a year
Growth also covers HIPAA, so SOC 2 + HIPAA stays at $199 a month. Two frameworks besides HIPAA need Scale.
Your first policy is free. No card needed to start.