Control Owner & Evidence Plan

Records who owns each control the examination will test, what evidence it leaves, how often, and how the evidence is sampled over the period.

Available soon

Format: Excel
Size: 96 KB
Length: 16 sheets
Version: 1.1
Updated: 18 Oct 2026

Follow this documentFree account. We can email you when it changes.

Preview

The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.

Instructions

How to use this workbook

Step	What to do
1	What this is. The Control Owner & Evidence Plan of the SOC 2 Report Readiness pack. The CPA firm decides which occurrences it samples and how many. Do not assume a sample size, do not choose the occurrences yourself, and keep every occurrence, not only the good ones. The counts in this plan show how many occurrences the period holds, not how many will be tested.
2	Settings. Choose the length of the observation period: 3, 6 or 12 months. These are what advisory sources call common. They are market practice, not AICPA rules. The CPA firm agrees the period in the engagement letter (Auditor (CPA Firm) Selection & Engagement Checklist). Month 1 is the first month of the period.
3	Plan. The 18 starter rows are kinds of evidence an examination usually asks for (EV-01 to EV-18), each with a typical frequency. Enter your own control ID from P20-A03 Control Inventory & Ownership Register to bring a row in. A starter row with no control ID is not counted. Add your own controls in the blank rows. Replace each [[placeholder]].
4	Owner, record, system and retention. One owner by role (SR-09). The record the control leaves as a by-product of the work, the system of record that holds it, and how long it is kept: at least until the report is issued and for the records period your policy sets (SR-12).
5	Frequency and first month. For a control that happens every 3, 6 or 12 months, enter the month of the period in which its first occurrence falls. Controls that happen each time something happens, or continuously, need no month.
6	Occurrences and the flag. The workbook counts the occurrences the period holds. A control that happens once or twice a year may not fall in a short period. The flag says so, and you schedule it inside the period.
7	Evidence quality. Before the period starts, answer the four tests on each control. Do not test your own control (SR-11).
8	Period Calendar, Owners and Requests, Request Log. The calendar shows the months in which each control occurs. The RACI says who does what. The eight steps say how a request from the CPA firm is handled, and each request is logged.
9	Summary and Checks. Counts only. Settle each Action needed before the readiness assessment (Readiness Assessment Procedure). Counts are not a score (SR-15). Update the plan when a control, an owner or a system changes (SR-08).

Legend

Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.

EXAMPLE

Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval.

Limitations: This document helps an organisation get ready for a SOC 2 examination by a licensed CPA firm. It is not legal advice and not advice on an audit or attestation engagement. A SOC 2 report is the CPA firm's opinion on management's description of a system and on its controls. It is an attestation, not a certificate. This document does not say that you will receive any particular opinion, that any control meets a criterion, or that holding ISO/IEC 27001 or any other report equals or replaces a SOC 2 report. What the criteria require of you, how exceptions are described in the report and whether they affect the opinion are for the CPA firm to decide. Which customers accept which report is for them.

EXAMPLE: Acme Corp (EXAMPLE). The Example sheet shows eight rows for a 6 month period, all invented. Delete it, and the EXAMPLE rows of the Request Log, before you rely on the workbook.

Adapting this template:

• Small organisation: one person may be examination owner and own most controls, so the RACI shows one name in many cells. Nobody tests their own control (SR-11), so ask someone outside the control to do the four evidence tests.

• Regulated or customer-driven organisation: where a customer's contract or a regulator sets how often a control runs, use that frequency and say so in Notes. Counsel confirms what a contract binds you to. This plan counts occurrences and does not interpret a contract.

• Organisation that uses outsourced providers: where a provider performs a control, the control stays on the Plan under your owner, and the provider is named in the system of record column. The provider's report is evidence for your review of the provider (SR-06).

• Replace every [[placeholder]] with your own text. Keep the formulas.

Settings

Settings

Choose the length of the observation period. Everything on the Plan and the Period Calendar counts from it. The CPA firm agrees the period in the engagement letter.

Period length (months)

3, 6 or 12

Three, six and twelve months are what advisory sources call common. This is market practice. It is not an AICPA rule, and no minimum period was found in the sources read. Your customers may ask for a length. The CPA firm and you agree the dates in writing before the period starts (SR-16).

Frequencies and what a period holds

Frequency	Times a year	Every (months)	What it means
Each time it happens		0	For example each new starter, each change, each incident. The population is the events in the period.
Continuously		0	An automated control that operates all the time. Evidence is the configuration and logs.
Daily	365	1	365 times a year.
Weekly	52	1	52 times a year.
Monthly	12	1	12 times a year.
Quarterly	4	3	4 times a year.
Twice a year	2	6	2 times a year.
Once a year	1	12	May not fall in a short period. Schedule it inside the period (A05, EV rows).

Occurrences are rounded down, so a control that happens once a year can show 0 in a 6 month period. It may still fall inside the period if you schedule it there.

Plan

The CPA firm decides which occurrences it samples and how many. Do not assume a sample size, do not choose the occurrences yourself, and keep every occurrence, not only the good ones. The counts in this plan show how many occurrences the period holds, not how many will be tested.

Starter rows are the pack's evidence types. A row counts once it has a control ID of yours. Yellow cells are yours. The others calculate.

Row	Evidence type ID	Evidence type	Control ID (yours)	What is done	Owner (role)	Frequency	Record it leaves	System of record	Retention	Document that helps
Starter	EV-01	Approved policies and their review records	[[control ID]]	[[what is done]]	[[Head of Information Security]]	Once a year	[[the record it leaves]]	[[Policy register]]	[[retention]]	P04-A06 Policy Register & Review Schedule
Starter	EV-02	Risk assessment and treatment decisions	[[control ID]]	[[what is done]]	[[Head of Information Security]]	Once a year	[[the record it leaves]]	[[Risk register]]	[[retention]]	P05-A05 Information Security Risk Register
Starter	EV-03	Onboarding checks and signed acknowledgements for new staff	[[control ID]]	[[what is done]]	[[HR lead]]	Each time it happens	[[the record it leaves]]	[[HR system]]	[[retention]]	P13-A03 Joiner-Mover-Leaver Operating Procedure
Starter	EV-04	Security awareness training completion	[[control ID]]	[[what is done]]	[[HR lead]]	Once a year	[[the record it leaves]]	[[Training platform]]	[[retention]]	P16-A07 Training Completion & Evidence Register
Starter	EV-05	Access provisioning approvals	[[control ID]]	[[what is done]]	[[Head of Engineering]]	Each time it happens	[[the record it leaves]]	[[Ticketing system]]	[[retention]]	P13-A07 Access Provisioning Log
Starter	EV-06	Leaver access removal records	[[control ID]]	[[what is done]]	[[HR lead]]	Each time it happens	[[the record it leaves]]	[[Ticketing system and identity provider]]	[[retention]]	P13-A06 Leaver Access Removal Checklist
Starter	EV-07	Periodic access reviews of in-scope systems	[[control ID]]	[[what is done]]	[[Head of Information Security]]	Quarterly	[[the record it leaves]]	[[Review workbook and approvals]]	[[retention]]	P07-A06 Access Review Campaign Workbook
Starter	EV-08	Multi-factor authentication and privileged account settings	[[control ID]]	[[what is done]]	[[Head of Engineering]]	Continuously	[[the record it leaves]]	[[Identity provider configuration]]	[[retention]]	P14-A04 Privileged & Service Account Inventory
Starter	EV-09	Change records with review, test and approval	[[control ID]]	[[what is done]]	[[Head of Engineering]]	Each time it happens	[[the record it leaves]]	[[Source control and ticketing]]	[[retention]]	None in this pack
Starter	EV-10	Vulnerability scan results and remediation	[[control ID]]	[[what is done]]	[[Head of Information Security]]	Monthly	[[the record it leaves]]	[[Scanner and ticketing system]]	[[retention]]	None in this pack
Starter	EV-11	Logging and monitoring: alert review	[[control ID]]	[[what is done]]	[[Head of Information Security]]	Daily	[[the record it leaves]]	[[Monitoring platform]]	[[retention]]	None in this pack
Starter	EV-12	Incident records and post-incident reviews	[[control ID]]	[[what is done]]	[[Head of Information Security]]	Each time it happens	[[the record it leaves]]	[[Incident log]]	[[retention]]	P09-A03 Incident Response Plan
Starter	EV-13	Backup success and a restore test	[[control ID]]	[[what is done]]	[[Head of Engineering]]	Twice a year	[[the record it leaves]]	[[Backup system]]	[[retention]]	P23-A06 Immutable & Offline Backup Protection Checklist
Starter	EV-14	Supplier assessments and provider SOC 2 report reviews	[[control ID]]	[[what is done]]	[[Head of Information Security]]	Once a year	[[the record it leaves]]	[[Supplier register]]	[[retention]]	P06-A03 Supplier Security Assessment Procedure
Starter	EV-15	Encryption settings at rest and in transit	[[control ID]]	[[what is done]]	[[Head of Engineering]]	Continuously	[[the record it leaves]]	[[Cloud configuration]]	[[retention]]	None in this pack
Starter	EV-16	Management review of the control environment	[[control ID]]	[[what is done]]	[[Executive sponsor]]	Quarterly	[[the record it leaves]]	[[Meeting minutes]]	[[retention]]	None in this pack
Starter	EV-17	Customer commitment and contract review	[[control ID]]	[[what is done]]	[[Legal]]	Once a year	[[the record it leaves]]	[[Contract register]]	[[retention]]	P26-A09 Standard Security Commitments Schedule
Starter	EV-18	Disaster recovery or business continuity test	[[control ID]]	[[what is done]]	[[Head of Engineering]]	Once a year	[[the record it leaves]]	[[Test report]]	[[retention]]	P22-A03 Cyber Recovery Operating Procedure

Period Calendar

The months in which each control on the Plan occurs, counted from month 1 of the period. Only controls with a control ID of yours appear. Row 2 counts the controls that occur in each month.

				Occurs this month:	0	0	0	0	0	0	0	0	0	0	0	0
Control	Evidence type	Frequency	Every (months)	First month	Month 1	Month 2	Month 3	Month 4	Month 5	Month 6	Month 7	Month 8	Month 9	Month 10	Month 11	Month 12	Months with an occurrence (calc)

Evidence Quality

Evidence quality: four tests

A record the CPA firm asks for should pass four tests. Answer them for each control on the Plan before the period starts. The tests rest on the control evidence standards (P20-A07 Control Evidence Standards Checklist) and on SR-12. Nobody tests their own control (SR-11, P20 CA-10).

The tests

Test	Name	Related criteria	How to check it	What a failure looks like
EQ-Q1	Dated	P20-A07 EQ-02	Open the record. Is the date of the occurrence on it, and does it fall inside the period? A record dated when it was copied out is not dated.	A screenshot with no date, a spreadsheet saved a week later with no entry date.
EQ-Q2	Attributable	P20-A07 EQ-03	Does the record show who did or approved the work, a person or a system account, so that someone can check that person was allowed to?	An approval that says Approved with no name, a shared account.
EQ-Q3	Retrievable	P20-A07 EQ-06 and SR-12	Could someone who was not there find the record in minutes, without asking staff to reconstruct it, and will it still be there when the report is issued?	Evidence held in one person's mailbox, a record that is overwritten each month.
EQ-Q4	From the system of record	P20-A07 EQ-04, EQ-05	Does the record come straight from the system that holds the work, with its source, the date it was run and any filter used, so that it can be checked against a second source?	A list typed up from memory, a report with the filter hidden.

Answers so far, for the controls entered

Test	Name	Yes	No	Not checked or blank
EQ-Q1	Dated	0	0	0
EQ-Q2	Attributable	0	0	0
EQ-Q3	Retrievable	0	0	0
EQ-Q4	From the system of record	0	0	0

A No is a finding to fix at source. Record it, give it an owner and a date, and fix the way the record is made (SR-14).

Owners and Requests

Owners and requests

Who does what, and how a request from the CPA firm is handled. The letters are suggestions. Change them to fit your people. A is accountable (one per activity). R does the work. C is consulted. I is informed. A/R is one person who is both.

The roles

	Role	What the role does
R1	Executive sponsor	Backs the examination with time and money, signs management's assertion with the examination owner, and decides scope questions that cost money.
R2	Examination owner	Runs the readiness work and the calendar, is the CPA firm's day-to-day contact, keeps the description, and reports the position in counts and words.
R3	Head of Information Security	Owns the security controls, the risk assessment and the incident process; does not test their own controls (P20 CA-10).
R4	Head of Engineering	Owns change management, hosting, monitoring and the technical description of the system.
R5	HR lead	Owns onboarding, training and leaver records for in-scope staff.
R6	Legal	Reviews customer contracts and commitments, the engagement letter, the bridge letter and what is shared under a confidentiality agreement.
R7	Control owner	Performs the control as written, keeps the record it leaves, and answers the auditor's requests for that evidence.

Who does what (RACI)

Activity	What happens	Executive sponsor	Examination owner	Head of Information Security	Head of Engineering	HR lead	Legal	Control owner	Check (calc)
RC-01	Name one control owner for each control	I	A	R	C	C	C	I	One A and an R
RC-02	Write what each control does, how often, and the record it leaves	I	C	A	C	C		R	One A and an R
RC-03	Perform each control as written, on its date		I	A	C	C		R	One A and an R
RC-04	Keep the record in the system of record, dated and attributable		I	C	C			A/R	One A and an R
RC-05	Check each control's evidence against the four tests before the period starts	I	A/R	C				C	One A and an R
RC-06	Receive every request from the CPA firm in one channel and log it the day it arrives		A/R	I				I	One A and an R
RC-07	Pull the evidence for a request from the system of record		A					R	One A and an R
RC-08	Review what was pulled for completeness and for anything that must not be shared		A/R	C			C	I	One A and an R
RC-09	Send the evidence through the agreed channel and record the date		A/R					I	One A and an R
RC-10	Answer the CPA firm's questions about how a control works		A	C	C	C		R	One A and an R
RC-11	Record an exception the day it is found, with its cause and the management response (SR-17)	I	A	C	C	C		R	One A and an R
RC-12	Report the position to the executive sponsor in counts and words	I	A/R	C					One A and an R

Handling a request from the CPA firm

Step	What it is	What to do
RS-01	One channel	Every request goes to the examination owner, who logs it on the Request Log the day it arrives, with its due date. A request that reaches a control owner directly is forwarded, not answered.
RS-02	Find the control	Match the request to a control ID on the Plan and to its owner. If it matches no control, ask the CPA firm what it is testing.
RS-03	Pull, do not make	The control owner takes the record from the system of record. Evidence is not made up, tidied or back-dated afterwards (SR-09). If the record does not exist, say so and record an exception (SR-17).
RS-04	Test the record	Check it against the four tests on the Evidence Quality sheet. A record that fails a test is sent with a note saying so, or is fixed at source.
RS-05	Review before sending	The examination owner checks that the record is complete and holds nothing that should not be shared, such as other customers' data. Legal reviews where a confidentiality agreement is involved.
RS-06	Send and record	Send it through the channel agreed with the CPA firm, record the date sent and keep a copy of exactly what was sent.
RS-07	Answer questions	The control owner explains how the control works. The examination owner records the question and the answer on the log. Nobody guesses.
RS-08	Keep every occurrence	Keep the records of every occurrence in the period, not only those requested or those that look good. The CPA firm chooses what it samples.

Agree with the CPA firm how long you may take to answer a request, and write it in the engagement letter: [[working days]]. Do not promise a time you cannot keep.

Request Log

One row for each request from the CPA firm. Log it the day it arrives. Delete the EXAMPLE rows before you start.

Row	Request ID	Date received	From (CPA firm contact)	What was asked	Control ID	Control owner	Date due	Date sent	Status	Notes	Check (calc)
EXAMPLE	R-001	3 Feb 2027	[[CPA firm contact]]	The Q1 review of production access, with the approvals	EX-04	Head of Engineering	10 Feb 2027	8 Feb 2027	Closed	Sent from the review workbook folder. No questions.	Nothing missing
EXAMPLE	R-002	12 Feb 2027	[[CPA firm contact]]	Every release in January, with the review and test records	EX-05	Head of Engineering	19 Feb 2027		Open	Population taken from source control by the control owner.	Nothing missing
EXAMPLE	R-003	15 Feb 2027	[[CPA firm contact]]	How is production access removed when someone leaves?	EX-04	HR lead	22 Feb 2027	17 Feb 2027	Question open	The control owner explained the steps. Answer recorded here.	Nothing missing
EXAMPLE	R-004	20 Feb 2027	[[CPA firm contact]]	The December and January vulnerability scan reports	EX-06	Head of Information Security	27 Feb 2027		Sent	Status says Sent but no date is entered. The check says so.	Date sent needed

Example

EXAMPLE: eight rows for a 6 month period

Acme Corp (EXAMPLE) is invented, and so is every control, owner and record below. The period is the example's own: 6 months, from its scoping outcome. Delete this sheet before you rely on the workbook.

Period length (months)				6

Eight rows of the plan

Label	Evidence type ID	Control ID	What is done	Owner (role)	Frequency	Record it leaves	System of record	Retention	First month	Occurrences (calc)	May not fall in the period (calc)	Planned (calc)	Schedule check (calc)	Months it occurs (calc)	What this row shows
EXAMPLE	EV-07	EX-04	Quarterly review of who can reach the production console, approved by the Head of Engineering	Head of Information Security	Quarterly	Review workbook with approvals	Review workbook folder	Per records policy (SR-12)	2	2		2	Matches the frequency	2, 5	Quarterly in a 6 month period: two occurrences, in months 2 and 5. The plan matches the frequency.
EXAMPLE	EV-01	EX-02	Policies reviewed and approved once a year	Head of Information Security	Once a year	Policy register with approval dates	Policy register	Per records policy (SR-12)	3	0	May not fall in the period	1	Scheduled inside the period	3	Once a year in a 6 month period: the period may not hold one. Month 3 is chosen so that it falls inside.
EXAMPLE	EV-04	EX-09	Security awareness training completed by every employee once a year	HR lead	Once a year	Training completion report	Training platform	Per records policy (SR-12)		0	May not fall in the period		Schedule it inside the period		The same flag, and no month chosen yet, so the schedule check says to schedule it inside the period.
EXAMPLE	EV-13	EX-08	Backups checked daily and a restore test twice a year	Head of Engineering	Twice a year	Restore test record	Backup system	Per records policy (SR-12)	4	1		1	Matches the frequency	4	Twice a year in a 6 month period: one occurrence, in month 4.
EXAMPLE	EV-16	EX-11	Management reviews the control environment and open exceptions each quarter	Executive sponsor	Quarterly	Meeting minutes with attendees and decisions	Meeting minutes folder	Per records policy (SR-12)	4	2		1	Fewer planned than the period holds	4	A quarterly control that starts in month 4: only one occurrence falls in a 6 month period, fewer than the two the period holds.
EXAMPLE	EV-10	EX-06	Monthly vulnerability scan and tracking of fixes to closure	Head of Information Security	Monthly	Scan reports and fix tickets	Scanner and ticketing system	Per records policy (SR-12)		6		6	Every month	Every month	Monthly: six occurrences in a 6 month period, every month. No first month is needed.
EXAMPLE	EV-09	EX-05	Every release peer reviewed and tested before it ships	Head of Engineering	Each time it happens	Pull request and test records	Source control	Per records policy (SR-12)		Events			No month needed	Events	An event control: the population is every release in the period. The CPA firm samples. You keep them all.
EXAMPLE	EV-08	EX-03	Multi-factor authentication enforced for the production console	Head of Engineering	Continuously	Identity provider settings export	Identity provider	Per records policy (SR-12)		Always on			No month needed	Always on	An automated control that is always on. The evidence is the setting and its history.

What the Summary would count for these eight rows

Count				Number
Controls entered				8
May not fall in the period				2
Of those, scheduled inside the period				1
Of those, still to schedule				1
Fewer planned than the period holds				1

These are counts of occurrences the period holds. The CPA firm decides which it samples. They are not a score.

Summary

Summary

Counts worked out from the Plan, the RACI and the Request Log. A count is work left or work done in your own plan. It is not a score. The CPA firm decides what it samples.

The headline counts

Count	Number

Period length (months)

Controls entered	0
Controls that may not fall in the period	0
Of those, scheduled inside the period	0
Of those, still to schedule	0
Controls with fewer planned than the period holds	0
Controls with no owner named	0
Controls with no system of record named	0
Controls with no retention	0
Controls with all four quality tests Yes	0
Controls with a quality test answered No	0
Requests open (Open or Question open)	2
Requests closed	1

Controls entered, by frequency

Frequency	Controls entered	Occurrences each in the period	May not fall in the period
Each time it happens	0
Continuously	0
Daily	0
Weekly	0
Monthly	0
Quarterly	0
Twice a year	0
Once a year	0

Occurrences are what the period holds. They are not the sample, which the CPA firm chooses.

Checks

Checks

Twelve checks on the plan as typed. Each says Clear, Action needed or Nothing to check. Where nothing is entered yet, CK-01 and CK-02 say Action needed.

The checks

Check	What it looks at	Result	Of	Status (calc)
CK-01	The period length is chosen on the Settings sheet: 3, 6 or 12 months.	0	1	Action needed
CK-02	At least one control is entered on the Plan. A starter row counts once it has a control ID of yours.	0	1	Action needed
CK-03	Every control entered says what is done. A [[placeholder]] does not count.	0	0	Nothing to check
CK-04	Every control entered has an owner by role. A [[placeholder]] does not count.	0	0	Nothing to check
CK-05	Every control entered has a frequency.	0	0	Nothing to check
CK-06	Every control entered names the record it leaves and its system of record. A [[placeholder]] does not count.	0	0	Nothing to check
CK-07	Every control entered has a retention. A [[placeholder]] does not count.	0	0	Nothing to check
CK-08	Every control that may not fall in the period is scheduled inside it.	0	0	Nothing to check
CK-09	Every control with a frequency has a schedule that fits the period: nothing is outside it and no control has fewer planned than the period holds.	0	0	Nothing to check
CK-10	Every control entered has all four evidence quality tests answered Yes or No.	0	0	Nothing to check
CK-11	Each activity on the RACI has exactly one A and at least one R.	12	12	Clear
CK-12	Every request on the Request Log that is Sent or Closed has a date sent.	1	2	Action needed

Needing action

checks

The number of checks that need action is a count of work left. It is not a score.

Lists

ListPeriod	ListFrequency	ListQuality	ListRACI	ListRequestStatus
3	Each time it happens	Yes	R	Open
6	Continuously	No	A	Sent
12	Daily	Not checked	A/R	Question open
	Weekly		C	Closed
	Monthly		I

Quarterly

Twice a year

Once a year

Definitions

Definitions

Term	Meaning in this workbook
Control owner	The one person who performs or supervises a control and answers the CPA firm's requests for its evidence. The plan names the owner by role.
Evidence	The record a control leaves, kept in a system of record, dated, tied to a person or system, and retrievable without rebuilding it.
System of record	The system that holds the work and its record, such as the ticketing system or the HR system.
Occurrence	One time a control happens.
Occurrences in the period	How many occurrences the period holds, by the frequency, rounded down. It is a count of what exists, not the sample.
May not fall in the period	A control that happens once or twice a year can show 0 in a short period. Schedule it inside the period.
Sampling	The CPA firm chooses which occurrences it tests and how many. You never choose them, and you keep every occurrence.
RACI	A table of who is Responsible, Accountable, Consulted and Informed for each activity. One A for each activity.
CPA firm	The licensed firm of certified public accountants that examines management's description and its controls and issues the report. Also called the auditor.
SOC 2 report	A SOC 2 report is an attestation by a licensed CPA firm, not a certificate. Nobody is “SOC 2 certified”, and no document in this pack says that you are or will be.
EV-nn, CK-nn, RC-nn, RS-nn	EV-nn are the evidence types. CK-nn are the checks. RC-nn are the activities of the RACI. RS-nn are the steps for a request. SR-nn are rules of the pack's Guide.
EXAMPLE	A worked example: Acme Corp (EXAMPLE). Every name and value is made up. Delete before use.
(calc)	A column or cell the workbook calculates. Do not type or paste over it.

Framework References

Framework references

These references indicate relevance only and do not reproduce the text of any standard.

Framework	Reference	Supported by
ISO/IEC 27001:2022	Clause 7.5 — Documented information	Plan and Evidence Quality sheets: the records the organisation keeps as evidence, with where they are kept and for how long
NIST CSF 2.0	GV.RR-02 — “Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced”	Owners and Requests sheet: roles and responsibilities for each control and for the CPA firm's requests are written down and assigned
AICPA, SOC 2	Trust Services Criteria (TSP section 100, 2017, with revised points of focus, 2022): five categories. Security is the category whose criteria, CC1 to CC9, are the “common criteria”: they apply to every report, and a complete set of criteria is the common criteria plus those of each other category chosen. (CC2 is titled Information and Communication in the 2022 edition; earlier editions print Communication and Information.) The criteria number 61: 33 Security, 3 Availability, 2 Confidentiality, 5 Processing Integrity and 18 Privacy. Cited by number and series title only; the statements are in the Library	Plan sheet: the controls an examination tests, each with an owner and the evidence it leaves. The criteria themselves are in the Library
AICPA, SOC 2	AICPA Trust Services Criteria (TSP section 100), introduction: a Type 2 SOC 2 report gives an opinion on the suitability of design and operating effectiveness of controls throughout a specified period and describes the tests and results; a Type 1 report addresses the same subject matter without an opinion on operating effectiveness or a description of tests, and is as of a specified date. The Journal of Accountancy (2016, an AICPA publication) gives the same split for SOC 1 and says SOC 2 reports come in both types. Neither source states a minimum period	Settings and Plan sheets: a Type 2 report covers a period, so the plan counts what the period holds
AICPA, SOC 2	SOC 2 CC4.1, Monitoring Activities	Evidence Quality sheet: evidence that can be checked, kept by the organisation for review
AICPA, SOC 2	SOC 2 CC6.2, Logical and Physical Access Controls	Plan sheet: access records such as provisioning approvals and leaver removal are among the starter rows
AICPA, SOC 2	SOC 2 CC8.1, Change Management	Plan sheet: change records are among the starter rows

Editions referenced: AICPA Trust Services Criteria (TSP section 100, 2017, with revised points of focus, 2022), by number and series title only; the AICPA description criteria (DC section 200, 2018, with revised implementation guidance, 2022), by topic only; ISO/IEC 27001:2022 and NIST CSF 2.0, by number and title; the Journal of Accountancy and the AICPA & CIMA pages named in the references; as published and read on 18 October 2026

Criteria are cited by number and series title only. The statements of the criteria are in the Library. Citing a criterion does not say that any document, control or practice meets it.

ISO/IEC 27001 references name the clause or control this document relates to, by number and title only. No text of the standard is reproduced. A reference does not say that holding an ISO/IEC 27001 certificate equals, replaces or shortens a SOC 2 examination.

These references show where this document supports an external framework. They indicate relevance only and do not reproduce the text of any standard.

This pack does not say which document, record or practice meets a criterion. Each reference says what its source describes and which CISO Times document helps with that work. Using a document does not by itself show that a criterion is met.