SOC 2 template · Type I and Type II
Risk Assessment Policy
Methodology for identifying, assessing, and managing security risks. Written for your company, citing the controls below.
- Sections
- 8
- Controls cited
- 9
- Formats
- PDF, Word
- Shelf
- 22 SOC 2documents in all
No card needed to start.
SOC 28 sections
Risk Assessment PolicyMethodology for identifying, assessing, and managing security risks.
- Cites
- CC3.1, CC3.2, CC3.3 and 6 more
- Formats
- PDF and Word
SOC 2 shelf
Sections
Each written around your company: your tools, your roles, your review dates.
- Purpose and Scope
- Methodology
- Risk Identification
- Risk Analysis
- Risk Appetite
- Risk Treatment
- Risk Register
- Assessment Schedule
Controls it cites
The SOC 2 controls first, then the matching controls in other frameworks.
- CC3.1COSO Principle 6: Risk ObjectivesSOC 2
- CC3.2COSO Principle 7: Risk IdentificationSOC 2
- CC3.3COSO Principle 8: Fraud RiskSOC 2
- CC9.1Risk Mitigation: Design & ImplementationSOC 2
- ISO A.5.1Policies for Information SecurityISO 27001
- HIPAA §164.308(a)(1)Security Management ProcessHIPAA
- CSF ID.RA-1Vulnerability IdentificationNIST CSF
- CSF ID.RA-5Risk ResponseNIST CSF
- CC4.2COSO Principle 17: Deficiency CommunicationSOC 2
- SOC 27 sections
Vendor Management Policy
CitesCC9.2 CC2.3 ISO A.5.19 +4 +5PDF · WordCites CC9.2, Risk Mitigation: Vendor & Business Partner (SOC 2); CC2.3, COSO Principle 15: External Communication (SOC 2); ISO A.5.19, Information Security in Supplier Relationships (ISO 27001), and 4 more. - SOC 27 sections
Data Retention Policy
CitesCC6.5 C1.2 ISO A.5.12 +4 +5PDF · WordCites CC6.5, Logical & Physical Access: Asset Disposal (SOC 2); C1.2, Confidentiality: Disposal (SOC 2); ISO A.5.12, Classification of Information (ISO 27001), and 4 more. - SOC 28 sections
Privacy Policy
CitesP1.1 P3.1 P4.1 +6 +7PDF · WordCites P1.1, Privacy: Notice (SOC 2); P3.1, Privacy: Choice & Consent (SOC 2); P4.1, Privacy: Collection (SOC 2), and 6 more. - SOC 28 sections
Employee Onboarding and Offboarding Policy
CitesCC1.4 CC6.2 CC6.3 +5 +6PDF · WordCites CC1.4, COSO Principle 4: Competence Commitment (SOC 2); CC6.2, Logical & Physical Access: Credentials (SOC 2); CC6.3, Logical & Physical Access: Authorization (SOC 2), and 5 more. - SOC 27 sections
Physical Security Policy
CitesCC6.4 ISO A.7.1 ISO A.7.2 +3 +4PDF · WordCites CC6.4, Logical & Physical Access: Physical Restrictions (SOC 2); ISO A.7.1, Physical Security Perimeters (ISO 27001); ISO A.7.2, Physical Entry (ISO 27001), and 3 more. - SOC 27 sections
Network Security Policy
CitesCC6.6 CC6.7 ISO A.8.20 +3 +4PDF · WordCites CC6.6, Logical & Physical Access: External Threats (SOC 2); CC6.7, Logical & Physical Access: Transmission Security (SOC 2); ISO A.8.20, Networks Security (ISO 27001), and 3 more.
SOC 2 on its own
- Documents
- 22
- Plan
- Growth
- Price
- $199 a month or $1,990 a year
Growth also covers HIPAA, so SOC 2 + HIPAA stays at $199 a month. Two frameworks besides HIPAA need Scale.
Your first policy is free. No card needed to start.