Readiness Assessment Procedure

How to use this procedure

Decide what the report is for. Draw the boundary around the service your customers rely on. Make the controls work and leave records before the period starts. Tell customers plainly what the report covers and what it does not.

This procedure is the management-led check that comes before the CPA firm starts. Its job is to find the gaps in your system, your controls and your evidence while there is still time to close them, and to decide, on stated grounds, when the observation period should begin. It has twelve steps, RP-01 to RP-12. The other documents of the SOC 2 Report Readiness pack cite the steps by those numbers.

What readiness is. Management's own check of the system, the controls and the evidence before the observation period starts. It is not the auditor's work and it is not an opinion.

What it is not. It is not an audit and not a test by the CPA firm, and it does not predict the firm's opinion. It is also not the control testing of the control testing pack (P20), although it borrows that pack's rules: they are cited here by ID and are not restated. A SOC 2 report is an attestation by a licensed CPA firm, not a certificate. Nobody is “SOC 2 certified”, and no document in this pack says that you are or will be.

Legal note. This document helps an organisation get ready for a SOC 2 examination by a licensed CPA firm. It is not legal advice and not advice on an audit or attestation engagement. A SOC 2 report is the CPA firm's opinion on management's description of a system and on its controls. It is an attestation, not a certificate. This document does not say that you will receive any particular opinion, that any control meets a criterion, or that holding ISO/IEC 27001 or any other report equals or replaces a SOC 2 report. What the criteria require of you, how exceptions are described in the report and whether they affect the opinion are for the CPA firm to decide. Which customers accept which report is for them.

Who it is for

A security or IT manager at a software company who has been asked to get the company ready for a SOC 2 report. The procedure assumes that the scope has been discussed (A02) and that a description is being drafted (A03). It needs a few hours of the assessor's time for each key control, and a decision from the sponsor at the end.

Who does what

• Executive sponsor backs the examination with time and money, signs management's assertion with the examination owner, and decides scope questions that cost money.
• Examination owner runs the readiness work and the calendar, is the CPA firm's day-to-day contact, keeps the description, and reports the position in counts and words.
• Assessor walks through and tests the controls, records each finding in one of the five words, and rates the readiness items. Does not perform, own or approve the controls assessed (SR-11, P20 CA-10).
• Control owner performs the control as written, keeps the record it leaves, and answers the auditor's requests for that evidence.
• Head of Information Security owns the security controls, the risk assessment and the incident process; does not test their own controls (P20 CA-10).
• Legal reviews customer contracts and commitments, the engagement letter, the bridge letter and what is shared under a confidentiality agreement.

Choosing the assessor

SR-11 Nobody tests their own control (P20 CA-10). The readiness assessment is done by someone who does not perform the controls it reads, or the check is recorded as a self-check.

The assessor is the one new role this procedure asks for. Choose by looking at the list of controls: they must perform none of them, own none and approve none. The table lists the usual choices, best first.

The rules the procedure puts into practice

SR-10 A control must run before it can be observed. Controls should have operated, with records, for at least [[3]] months before a first Type 2 period starts (a house default). If they have not, expect exceptions early in a short first period, or take a Type 1 report first and begin the Type 2 period when the controls have run. Controls that are not yet running at all are ready for neither report.

SR-12 Evidence is dated, attributable to a person or system, retrievable without asking staff to reconstruct it, and kept at least until the report is issued and for as long as the records period of P22 asks.

SR-13 Do the readiness assessment before the period starts (A06, A09). Fix what is a blocking item. Do not start the period with a blocking item below In place.

SR-14 A gap found in readiness is a finding with an owner, a date and a retest (P20 A08). A gap is fixed, not hidden, and a fix that has not yet operated is described as that.

SR-15 Readiness is reported as counts and words, with blocking items named. There is no score, no percentage and no pass or fail, because the opinion is the CPA firm's.

SR-16 Agree the observation period dates in writing with the CPA firm before the period starts. Do not change them in the period without the firm. Start the next period on the day after the last one ends so that no day is uncovered.

Three rules of the control testing pack apply and are cited by ID: P20 CA-03 (what counts as a test), P20 CA-10 (nobody tests their own control) and P20 CA-14 (when a deficiency may be closed). Read them in the control testing pack before the first walkthrough. They are not repeated in this procedure.

Incidents. If an incident happens while you are getting ready, the incident plan decides who decides and who is told, and when (P09-A03 Incident Response Plan). This procedure changes no decision right and states no notification clock.

The procedure at a glance

Read the table from top to bottom. The step numbers do not change, so records can cite them. Steps RP-05 to RP-08 repeat for each key control.

Key control. A control that the principal commitments depend on, so that if it did not work as written a commitment could be missed. The examination owner and the sponsor choose the key controls, and write the choice down. This is a term of this pack and not of the AICPA.

The twelve steps

Each step has the same layout: what it does, who leads, what comes in and what comes out, how to do it, and what usually goes wrong.

RP-01 Confirm the scope

Read the scoping result (A02) and the boundary. Settle the type, the categories and the providers with the sponsor.

Led by: Examination owner. With: Executive sponsor. Rules: SR-03, SR-04.

Inputs: The scoping result (A02), The draft boundary and The commitments customers rely on.

Output: A scope note: report type, categories with the reason for each, period length, the providers that matter. Record: A signed scope note.

• Re-run the scoping assessment if any answer has changed since it was done.
• For each category beyond Security, name the customer or the written commitment that needs it (SR-03). A category with no reason comes out.
• List the providers that run part of the system, and the method you expect for each (SR-06).
• The sponsor agrees the scope note and the date is recorded. Anything that costs money is the sponsor's decision.

Watch for: Treating the scope as settled because it was settled once. Re-scope when the service, the boundary, a major provider or a commitment changes (SR-08).

RP-02 Draft the description

Write the nine topics of the description with the template (A03). Draft first, then check each statement against how the system really works.

Led by: Examination owner. With: Head of Engineering and Head of Information Security. Rules: SR-02.

Inputs: The scope note, The template (A03) and Contracts and service levels.

Output: A draft description covering the nine topics, owned by management. Record: Draft description.

• Draft the twelve sections of the template. Start with the boundary and the commitments.
• Read each statement with a person who runs that part of the system, and change it until they agree it is true today.
• Management owns the description (SR-02). Advisers may help; they do not write it for you.

Watch for: A description that describes the plan. The readiness assessment tests what runs, and the description must say the same.

RP-03 List the controls and their owners

For each criterion in scope, write down the control or controls you rely on, the owner and the evidence (A04, A05).

Led by: Examination owner. With: Control owner and Head of Information Security. Rules: SR-09.

Inputs: The draft description, The criteria register (A04), The control inventory (P20-A03) and The evidence plan (A05).

Output: For each criterion in scope: the controls, their owners and the evidence; the key controls marked. Record: The completed register and plan.

• For each control, one named owner, one written statement of what is done and how often, and the record it leaves (SR-09).
• Reuse the owners and statements that already exist in your control inventory. Do not write a second set.
• Mark the key controls, and write down why each is key.

Watch for: Two owners for a control, or none. With two nobody acts, and with none nobody answers the CPA firm.

RP-04 Choose the assessor

Choose a person who does not perform the controls. If none exists, record the check as a self-check.

Led by: Examination owner. With: Executive sponsor. Rules: SR-11.

Inputs: The list of controls and their owners.

Output: The assessor named, with the reason they do not perform the controls; or a note that the check is a self-check. Record: Assessor named.

• Check the candidate against the list of controls: they perform none, own none and approve none (SR-11, P20 CA-10).
• Give them the written statements, this procedure and the forms, and time. A rushed assessor reads what they are told.
• If nobody independent exists, record the check as a self-check and say so in every report on it.

Watch for: Asking the control owner to assess their own control because they know it best. They do know it best, which is the problem.

RP-05 Walk through each control

For each key control, follow one real occurrence from start to record, as the auditor will. Ask for the record, do not rely on being told.

Led by: Assessor. With: Control owner. Rules: SR-09, SR-12.

Inputs: The written statement of each key control, The list of owners and Access to the systems of record.

Output: A walkthrough record for each key control (form 1). Record: Walkthrough notes.

• Follow one real occurrence of each key control from trigger to record, with the person who performed it, in the system where the record lives.
• Ask for the record yourself, as P20 CA-03 requires.
• Compare what you saw with the written statement, attribute by attribute (see the walkthrough method).

Watch for: A demonstration. Ask for the last real occurrence and not for an example prepared for you.

RP-06 Test a few occurrences

Take a handful of occurrences of each key control from the system of record and check them against the written statement.

Led by: Assessor. With: Control owner. Rules: SR-12.

Inputs: The walkthrough records and The population of occurrences from the system of record.

Output: A workpaper for each control tested (P20-A06), with every occurrence examined recorded, including the ones that did not match. Record: Workpaper (P20 A06).

• Take the population from the system of record, not from a list the owner supplies.
• Choose a handful of occurrences yourself, spread across the time the control has run.
• Check each against the written statement and record the result for each occurrence.

Watch for: Choosing the occurrences the owner is proud of. Keep every occurrence you examined, not only the good ones.

RP-07 Record each finding in one of five words

Use the finding words. A finding is a design, operating, evidence or scope gap, or no gap found.

Led by: Assessor. With: Examination owner. Rules: SR-14.

Inputs: The walkthrough records and the workpapers.

Output: A finding record for each control and each scope question (form 2), each in one of the five words. Record: Findings list.

• Use the questions in the section on the five words, in order. The first question answered No gives the word.
• Write what was found as a fact: what was seen, where, on which date. Leave out blame.
• Say whether the control is a key control and whether the readiness item it supports is blocking.

Watch for: Softening the word. A design gap called an evidence gap will not be fixed in time.

RP-08 Decide what to do about each gap

For each gap choose a disposition, with an owner and a date, and track it (P20 A08).

Led by: Examination owner. With: Executive sponsor and Control owner. Rules: SR-14.

Inputs: The findings.

Output: A disposition for each gap, an owner, a due date and a row in the deficiency tracker (P20-A08). Record: Dispositions.

• Choose one of the three dispositions with the disposition guide below. A gap on a blocking item or on a key control is fixed before the period starts.
• Accepting a gap is a risk acceptance, with the approval the risk process sets (P05 RM-08), and the description says what was accepted.
• Set a due date from the planning days of the gap's priority, or a nearer one the owner can keep.

Watch for: Accepting a gap to save the date. The CPA firm tests what is written, and an accepted gap is still written.

RP-09 Run the self-assessment

Rate the readiness items (A09). Count the blocking items below In place.

Led by: Examination owner. With: Assessor. Rules: SR-13, SR-15.

Inputs: The findings and dispositions and The readiness workbook (A09).

Output: A readiness result in words, with the counts and the blocking items named. Record: A readiness result in words.

• Rate each readiness item with the level words, using the findings: see running the workbook.
• Count the blocking items below In place. Read the result word from the workbook, and copy it unchanged into the report.
• Report counts and words. There is no score (SR-15).

Watch for: Rating from memory. A rating needs a finding, a walkthrough or a record behind it.

RP-10 Retest the fixes

A fixed control is retested only after it has operated for a while (P20 CA-14).

Led by: Assessor. With: Control owner. Rules: SR-14.

Inputs: The tracker rows for fixed gaps and The fixed control, after it has operated.

Output: A retest record for each fix, by someone other than the owner. Record: Retest records.

• Retest only after the fixed control has operated for a while (P20 CA-14). A control fixed yesterday has not yet shown that it works.
• Someone other than the owner retests. Record the result in the tracker, and close the row only on a retest that finds no gap.
• A fix that has not yet operated is described as that in every report (SR-14).

Watch for: Closing a row because the fix was made. Closing needs the retest.

RP-11 Decide to start

The sponsor and the examination owner decide with the start decision rule. They record who decided, and when. If the dates are the only reason to hold, record Hold, agree the dates (RP-12), then record Start.

Led by: Executive sponsor. With: Examination owner. Rules: SR-13, SR-16.

Inputs: The readiness result, The open gaps on key controls and The state of the dates.

Output: A start-decision record (form 3): Start or Hold, the reasons, who decided and when. Record: Start decision.

• Apply the start decision rule to three facts: the blocking items below In place, the open design or operating gaps on key controls, and whether the dates are agreed in writing.
• Start only when none of the three holds a reason. Otherwise Hold, with the actions and the date of the next decision. If the dates are the only reason, Hold, agree them with the CPA firm (RP-12), then record Start.
• The sponsor and the examination owner decide together, and the record shows who and when.

Watch for: Treating the planned start as a promise. The date serves the controls and not the reverse.

RP-12 Agree the dates with the CPA firm

Confirm the period dates in writing before the period starts. This closes the last reason to hold when only the dates are missing.

Led by: Examination owner. With: Executive sponsor and Legal. Rules: SR-16.

Inputs: The start decision, or a Hold whose only reason is that the dates are not yet agreed and The draft engagement letter.

Output: The period start and end dates, agreed in writing with the CPA firm before the period starts. Record: Engagement letter dates.

• Confirm the dates in writing, in the engagement letter or an exchange the firm acknowledges. Do not change them in the period without the firm (SR-16).
• Put the next period's first day on the calendar: the day after this one ends, so that no day is uncovered (SR-16).
• Tell the customer-facing lead what they may say about the report, and when (A10).

Watch for: Starting on a verbal agreement. A date that is not written is a date the firm can understand differently.

Walkthrough and test method

The walkthrough and the test of occurrences are how an assessor learns whether a control works as written. Both follow P20 CA-03, which says what counts as a test. This section says how to carry them out.

The walkthrough

A walkthrough follows one real occurrence of a control from trigger to record. Do it for each key control (RP-05).

1. Pick the control, read its written statement and note the owner, the frequency and the record it should leave.
2. Ask for the most recent real occurrence, and for one from a different month where the control has run that long.
3. Sit with the person who performed it. Ask them to show it in the system, not to describe it.
4. Follow it from the trigger to the record: what started it, what was done, who approved it, what was written down and where.
5. Ask for the record from its system of record, and look at it yourself.
6. Compare with the written statement, one attribute at a time, and write what matched and what did not.
7. Note anything the person did that the statement does not say, and anything the statement says that the person did not do.
8. Give the control a finding word before you leave the system, while you still remember what you saw.

Compare what you saw with the statement on five attributes, and write the answer for each on the walkthrough record.

Testing a handful of occurrences

After the walkthrough, take a handful of occurrences of the same control and check each against the statement (RP-06). The population comes from the system of record and is checked against a second source where one exists (P20 CA-04). You choose the occurrences, spread across the time the control has run, and the owner does not. Record the result for each occurrence on a workpaper (P20-A06 Control Test Workpaper Template, P20 CA-11).

The CPA firm decides which occurrences it samples and how many. Do not assume a sample size, do not choose the occurrences yourself, and keep every occurrence, not only the good ones. The counts in this plan show how many occurrences the period holds, not how many will be tested.

A handful is for finding gaps. It says nothing about how many occurrences the CPA firm will take, and a handful with no exception is not a conclusion about the whole period.

A control that has not run yet

A control cannot be tested before it has run. Do a walkthrough of its design (P20 CA-02) and rate it by its level, not by a test. How many occurrences fall in a period depends on how often the control happens: a control that happens quarterly gives 2 occurrences in a six-month period, and a control that happens once a year may give none (0), so schedule it inside the period. With 2 occurrences one late one is half of them, and it will be seen.

The five finding words, and what to do about a gap

Every control and every scope question ends in exactly one of five words. The words are the same in the readiness workbook, in the tracker and in your reports to the sponsor.

Choosing the word

Ask the four questions in order. The first question answered No gives the word. If all four are answered Yes, the word is No gap found. A control with more than one gap carries the first word in the findings list and the others in the text of the record.

Choosing what to do

The table below says which disposition is usual. The sponsor and the examination owner decide. Where the table and your judgement differ, write down why.

Running a readiness assessment with the workbook (SOC 2 Readiness Self-Assessment)

The workbook holds 32 readiness items, RI-01 to RI-32, in five areas. You rate each item with one of four level words, and the workbook counts them and returns one of three result words. Use it twice: early, as a first look, and again at RP-09 with the findings behind the ratings.

An item that does not apply is rated Not applicable with its reason written beside it. A blank is not a rating, and the workbook reports that ratings are missing.

From a finding to a rating

Rate an item from the findings on the controls it rests on. The table gives the highest level an item may be given for each word. It is a guide. The level words of the workbook decide, and you write the reason beside the rating.

The result

Not ready to start the observation period: at least one blocking item is below In place. Ready to start, with actions: no blocking item is below In place, but some items are below Operating. Ready to start: every applicable item is Operating, and each item that does not apply has its reason recorded. The result is one of three words with the counts beside it. It is never a score, a share or a pass or a fail. An item at In place has not yet run for the three months SR-10 asks for, so expect exceptions early in the period or take a Type 1 report first; only four items can be Not applicable (RI-05, RI-06, RI-19 and RI-21), and an item left out of the result that way should be confirmed with the CPA firm.

Report the result word with the counts. Do not turn them into a share, a rating or a colour (SR-15).

Gaps by priority

The workbook ranks every item below Operating into three priorities and gives each a planning number of days. These are house defaults for planning, not rules of the AICPA. They are not deadlines for the deficiencies that the control testing pack (P20) finds, which keep the deadlines that pack sets (P20 CA-13).

Tracking gaps in the deficiency tracker (P20-A08 Control Deficiency & Remediation Tracker)

Every gap that is not "No gap found" becomes a row in the deficiency and remediation tracker (P20-A08 Control Deficiency & Remediation Tracker), with an owner and a due date (SR-14). The tracker belongs to the control testing pack. This procedure uses it so that readiness gaps and test deficiencies are in one place.

A readiness finding is not the result of a control test. Do not copy it into your test results as one. Rate a deficiency by the tracker's own rules (P20 CA-12) if it also arises from a test.

Retest

A fixed control is retested after it has operated for a while (P20 CA-14), by someone other than its owner. The retest looks at the same attributes as the walkthrough, on occurrences that happened after the fix. The row closes only on a retest that finds no gap.

• If the control has not yet operated enough to retest, the row stays open with the status Fixed, awaiting retest. In every report, call the control fixed and not yet operated (SR-14).
• A control that happens once a year, or an automated control, may be retested after one occurrence (P20 CA-14). Say which route you took.
• If the retest finds a gap, the finding is recorded again with a new date and the row stays open.
• A blocking item may be at In place when the period starts, and is then tested as it stands. It becomes Priority 2 in the workbook and is made Operating in the period.

When to start the observation period

SR-13 Do the readiness assessment before the period starts (A06, A09). Fix what is a blocking item. Do not start the period with a blocking item below In place.

The start decision is made once readiness is complete, and again whenever it was Hold. The rule looks at three facts and nothing else.

If none of the three is a reason, the decision is Start. If one or more is, the decision is Hold, with the reasons stated, the actions, and the date of the next decision.

Plan backwards. A house default is that readiness is complete and the dates are agreed 14 days before the period starts (A08, MS-01 and MS-02). The observation period lengths of three, six and twelve months are market practice, not rules of the AICPA, and the CPA firm agrees the period (SR-16).

What to tell the sponsor

Report readiness in counts and in words. The sponsor needs the result word, the counts, the blocking items by name, the gaps by priority, and the one decision they have to make. Nothing in the report is a score, a share or a rating (SR-15).

EXAMPLE report, 27 November 2026. Not ready to start the observation period. 11 Operating, 9 In place, 9 Planned, 3 Not started (32 items). six blocking items are below In place: RI-04, RI-13, RI-25, RI-26, RI-27, RI-28. Gaps by priority: Priority 1 6, Priority 2 9, Priority 3 6. 1 open gap on a key control (RI-13, the access review). Dates not yet agreed with the CPA firm. The start decision is Hold. This was a first look by the examination owner and the assessor.

Forms

Three forms carry the records of the procedure. Copy each into your own document system. They hold no secrets and no personal data beyond the names of roles; keep them with the readiness workbook.

Form 1: Walkthrough record

Form 2: Finding record

Form 3: Start-decision record

EXAMPLE finding record. FD-03, 27 November 2026. Control: review of access to the production systems. Item: RI-13. Finding word: Design gap: the review is written in the access policy, but no reviewer is named and no output is defined. Blocking item: Yes. Key control: Yes. Priority 1. Disposition: Fix before the period starts. Owner: Head of Engineering. Due: 11 December 2026. Retest: by the assessor, after the fixed review has operated as P20 CA-14 asks.

EXAMPLE start-decision record, first look. 27 November 2026. Result: Not ready to start the observation period. Blocking items below In place: 6 (RI-04, RI-13, RI-25, RI-26, RI-27, RI-28). Open gaps on key controls: 1. Dates agreed: No. Decision: Hold. Reasons: 6 blocking items are below In place; 1 design or operating gap on key controls is open; the dates are not agreed in writing with the CPA firm.

Roles and responsibilities

The matrix shows who is responsible (R), accountable (A), consulted (C) and informed (I); A/R is both. Columns, in order: Spons for executive sponsor; Owner for examination owner; Assess for assessor; Ctrl for control owner; Sec for Head of Information Security; Legal for Legal. Each step has one accountable role. No control owner tests their own control.

Common mistakes

Related documents

Definitions

Worked example: Acme

EXAMPLE, not part of the procedure. Acme Corp (EXAMPLE) is a US software-as-a-service provider with about 400 staff, selling to businesses that ask for a SOC 2 report. It is not the organisation used in the earlier packs. It hopes to start a six-month observation period on 1 January 2027 (the period would end on 30 June 2027). Five weeks before that, on 27 November 2026, the examination owner and an assessor from another team ran the readiness workbook as a first look. Replace the example with your own, or delete this section before approval.

The first look

Not ready to start the observation period. 11 Operating, 9 In place, 9 Planned, 3 Not started, of 32 items. The six blocking items below In place are these.

The start decision rule takes three facts: 6 blocking items below In place, 1 open design gap on a key control (RI-13) and dates not agreed. It gives Hold, for three reasons: 6 blocking items are below In place; 1 design or operating gap on key controls is open; the dates are not agreed in writing with the CPA firm.

The days that are left

The calendar asks for readiness to be complete 14 days before the start (A08, MS-01), which is 18 December 2026. From 27 November 2026 that leaves 21 days. The planning default for a Priority 1 gap is 30 days, which is more. The examination owner asked the owners of the six items whether they could close them in 21 days. RI-27 and RI-28 depend on the CPA firm, and a draft engagement letter was already with it. RI-04 needed one more round of the description. RI-13 needed one run of the access review. RI-25 and RI-26 are done by the assessment itself once the walkthroughs are finished. All the owners said yes. The sponsor accepted that, and wrote down that the default was a planning figure and that the start date would move if any item slipped.

The second decision

On 18 December 2026 the six items were rated again, with the findings behind each. The result was Ready to start, with actions: 13 Operating, 13 In place, 5 Planned, 1 Not started, of 32 items, and no blocking item below In place. RI-13 was In place: the first review had run, and it would be tested as it stands (Priority 2). The sponsor and the examination owner applied the rule again.

Case B is the decision they took: Start, with the period from 1 January 2027 to 30 June 2027. Case C shows the same position with the dates not yet agreed in writing. The rule says Hold, for one reason, and the owner would have chased the CPA firm for the writing before the start.

Adapting this procedure

Small organisation

Regulated or customer-driven

Outsourced providers

Framework references

These references show where this document supports an external framework. They indicate relevance only and do not reproduce the text of any standard. Editions referenced: AICPA Trust Services Criteria (TSP section 100, 2017, with revised points of focus, 2022), by number and series title only; the AICPA description criteria (DC section 200, 2018, with revised implementation guidance, 2022), by topic only; ISO/IEC 27001:2022 and NIST CSF 2.0, by number and title; the Journal of Accountancy and the AICPA & CIMA pages named in the references; as published and read on 18 October 2026.

The Trust Services Criteria and the description criteria are published by the AICPA for CPAs who examine a service organisation. Nothing in law makes a SOC 2 report mandatory. A customer's contract, a procurement policy or an investor can ask for one, and the organisation chooses whether to commission an examination. The report is a CPA firm's opinion about the organisation's description and its controls. It is an attestation, not a certificate, and nobody is “SOC 2 certified” or “SOC 2 compliant” by holding one.

The observation period lengths, the three-month limit of a bridge letter, the order of the steps and the sample of questions for a CPA firm are market practice and house defaults. They are not rules of the AICPA, and the CPA firm and your customers decide what they accept.

ISO/IEC 27001 references name the clause or control this document relates to, by number and title only. No text of the standard is reproduced. A reference does not say that holding an ISO/IEC 27001 certificate equals, replaces or shortens a SOC 2 examination.

Criteria are cited by number and series title only. The statements of the criteria are in the Library. Citing a criterion does not say that any document, control or practice meets it.

A reference says what its source describes and which CISO Times document helps with that work. It does not say that a document from this pack meets a criterion, and it does not say that an organisation will receive an unqualified opinion.

This pack does not say which document, record or practice meets a criterion. Each reference says what its source describes and which CISO Times document helps with that work. Using a document does not by itself show that a criterion is met.