Data subjects receive notice of the organisation's privacy practices, updated and communicated promptly when practices, including uses of personal information, change. Points of focus: notice covers purpose of collection, choice and consent, types of information collected, collection methods such as cookies and tracking, how information is used, kept and disposed of, how individuals can see it, sharing with third parties, security, quality and the data subject's part in it, and monitoring and enforcement, and names other sources where information is not collected from the individual; notice is given at or before collection or soon after, before a notice change takes effect, and before new uses; the entities and activities covered are described objectively; and the notice is conspicuous and plainly written. The 2022 revision marks privacy points of focus as typical for data controllers, data processors or both, and adds for controllers that the notice is current, dated and easy to find, is reviewed periodically and updated, that data subjects are told of changes and their nature, and that earlier versions are retained as a record of what was communicated.
This control maps to 50 controls across 16 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
SOC 2 SOC2-P1.1 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of SOC 2 your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 49 of 61 SOC 2 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 193 were rejected on the NIST SP 800-53 Rev 5 pair alone.
The graph holds this control, the 50 it maps to, and the evidence behind each claim, over MCP and REST.