SOC 2
PI - Processing Integrity

SOC 2 PI1.3: System processing is complete, valid, accurate, timely, and authorized

Implements policies and procedures over system processing to result in products, services, and reporting to meet the entity's objectives

Maintained by Gerard BlokdykControl text last updated

What else in your programme already covers this

This control maps to 60 controls across 16 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

NIST SP 800-53 Rev 5 · 8 controls

  • NIST800-AC-4 Information flow enforcement
  • NIST800-AC-6 Least privilege
  • NIST800-AU-12 Audit record generation
  • NIST800-SC-8 Transmission confidentiality and integrity
  • NIST800-SI-10 Information input validation
  • NIST800-SI-15 Information Output Filtering. Validate information output from the following software programs and/or applications to ensure that the information is consistent with the expected content: [organization-defined]
  • NIST800-SI-6 Security and Privacy Function Verification. Verify the correct operation of [organization-defined]; Perform the verification of the functions specified in SI-6a [organization-defined]; Alert [organization-defined] to failed security and privacy verification tests; and [organization-defined] when anomalies
  • NIST800-SI-7 Software, firmware, and information integrity

FedRAMP High · 6 controls

  • AU-12 Audit Record Generation
  • CM-3 Configuration Change Control
  • CP-9 System Backup
  • SI-10 Information Input Validation
  • SI-6 Security and Privacy Function Verification. a. Verify the correct operation of [Assignment: organization-defined security and privacy functions]; b. Perform the verification of the functions specified in SI-6a [Selection (one or more): [Assignment: organization-defined system
  • SI-7 Software, Firmware, and Information Integrity

FedRAMP Moderate · 6 controls

  • AU-12 Audit Record Generation
  • CM-3 Configuration Change Control
  • CP-9 System Backup
  • SI-10 Information Input Validation
  • SI-6 Security and Privacy Function Verification. a. Verify the correct operation of [Assignment: organization-defined security and privacy functions]; b. Perform the verification of the functions specified in SI-6a [Selection (one or more): [Assignment: organization-defined system
  • SI-7 Software, Firmware, and Information Integrity

NIST SP 800-53 Revision 5.1 HIGH · 6 controls

  • AU-12 Audit Record Generation
  • CM-3 Configuration Change Control
  • CP-9 System Backup
  • SI-10 Information Input Validation
  • SI-6 Security and Privacy Function Verification. a. Verify the correct operation of [Assignment: organization-defined security and privacy functions]; b. Perform the verification of the functions specified in SI-6a [Selection (one or more): [Assignment: organization-defined system
  • SI-7 Software, Firmware, and Information Integrity

ISO 27001:2022 · 5 controls

  • 5.1 Policies for information security
  • 5.36 Compliance with policies, rules and standards for information security
  • 5.37 Documented operating procedures
  • 8.15 Logging
  • 8.32 Change management

ISO 27002:2022 · 5 controls

  • 5.36 Compliance with policies, rules and standards for information security
  • 5.37 Documented operating procedures
  • 8.15 Logging
  • 8.26 Application security requirements
  • 8.32 Change management

ISO 27701:2019 · 5 controls

  • 5.6.2 Information security risk assessment
  • 6.11.2 Security in development and support processes
  • 6.9.1 Operational procedures and responsibilities
  • 6.9.4 Logging and monitoring
  • 7.4.3 Accuracy and quality

NIST SP 800-53 Rev 5 MODERATE · 5 controls

  • AU-12 Audit Record Generation
  • CM-3 Configuration Change Control
  • CP-9 System Backup
  • SI-10 Information Input Validation
  • SI-7 Software, Firmware, and Information Integrity

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 2 controls

  • CCM-AIS-02 Application Security Baseline Requirements
  • CCM-AIS-04 Secure Application Design and Development

HIPAA Security Rule · 2 controls

ISO/IEC 42001:2023 · 2 controls

  • A.6.2.4 AI system verification and validation
  • A.7.4 Quality of data for AI systems

NIST SP 800-218 · 2 controls

NIST SP 800-53 Rev 5 LOW · 2 controls

  • AU-12 Audit Record Generation
  • CP-9 System Backup

NIST SP 800-66 Rev 2 · 2 controls

DORA · 1 control

  • DORA-Art.23 Operational or security payment-related incidents

EU AI Act · 1 control

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in PI - Processing Integrity

You are reading one control. How much of SOC 2 have you already done?

SOC 2 PI1.3 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of SOC 2 your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 49 of 61 SOC 2 controls already carry evidence.

If you hold NIST SP 800-53 Rev 580.3% covered · 12 gapsIf you hold FedRAMP Moderate60.7% covered · 24 gapsIf you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.157.4% covered · 26 gapsIf you hold ISO 27001:202257.4% covered · 26 gapsIf you hold C5 (Germany)54.1% covered · 28 gapsIf you hold NIST Cybersecurity Framework 2.052.5% covered · 29 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 193 were rejected on the NIST SP 800-53 Rev 5 pair alone.

See the released pairs, $299 eachBrowse the graph free

Query this from an agent

The graph holds this control, the 60 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll SOC 2 controls