SOC 2 and outside-in evidence
Which SOC 2 Trust Services Criteria controls outside-in evidence can support, which findings count against each, and what it cannot tell you.
Last reviewed
SOC 2 Trust Services Criteria
2017 (rev. 2022)
5controls with outside-in evidence
Everything else in the framework needs evidence from inside the organisation.
SOC 2 reports are issued by an independent auditor against the AICPA Trust Services Criteria. A few criteria concern how systems are protected where they meet the internet, such as encryption in transit and configuration of public services.
TrustSek maps its findings to those criteria. That can help you spot, before an audit, the external issues an auditor or a customer could find on their own.
What it does not cover
A SOC 2 report is about the design and operating effectiveness of controls over time, tested by an auditor inside the organisation. Outside-in evidence cannot show that, and TrustSek does not issue or replace a SOC 2 report.
Controls with outside-in evidence (5)
Controls not listed here depend on policies, people and internal systems, so they need evidence from inside the organisation. Each finding links to its full explanation.
The mapping comes from the scoring engine and is being extended. In a few places it names the milder form of a finding and not the more serious one, for example 50 or more subdomains but not 100 or more.
CC6.6
Logical access controls for boundary protection
Boundary protection is contradicted by exposed admin/dev hostnames and active threat intel hits on the boundary.
Findings that count against it
CC6.7
Restriction and protection of data transmissions
Transmission protection requires HTTPS with valid trust chain, modern TLS, and HSTS.
Findings that count against it
CC6.8
Detection and prevention of unauthorized or malicious software
Malicious software detection is contradicted by external malware/threat-intel matches against the org domain.
Findings that count against it
CC7.1
Detection of vulnerabilities and configuration issues
Vulnerability detection is observable as misconfiguration drift in security headers and TLS posture.
Findings that count against it
CC7.2
Monitoring of system components for anomalies
Anomaly monitoring is contradicted by uncaught threat-intel matches and ransomware claims against the entity.
Findings that count against it