SOC 2
PI - Processing Integrity

SOC 2 SOC2-PI1.3: PI1.3 Controls over system processing

Policies and procedures over system processing produce products, services and reporting that meet objectives. Points of focus: processing specifications needed to meet requirements are defined; processing activities are defined to meet them; production errors are detected and corrected promptly; processing is recorded completely, accurately and on time; and authorised inputs are processed in full, correctly and on schedule.

Maintained by Gerard BlokdykControl text last updated

What else in your programme already covers this

This control maps to 47 controls across 13 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

NIST SP 800-53 Rev 5 · 8 controls

FedRAMP High · 6 controls

  • AU-12 Audit Record Generation
  • CM-3 Configuration Change Control
  • CP-9 System Backup
  • SI-10 Information Input Validation
  • SI-6 Security and Privacy Function Verification (SI-6)
  • SI-7 Software, Firmware, and Information Integrity

FedRAMP Moderate · 6 controls

  • AU-12 Audit Record Generation
  • CM-3 Configuration Change Control
  • CP-9 System Backup
  • SI-10 Information Input Validation
  • SI-6 Security and Privacy Function Verification (SI-6)
  • SI-7 Software, Firmware, and Information Integrity

ISO 27001:2022 · 5 controls

  • 5.1 Policies for information security
  • 5.36 Compliance with policies, rules and standards for information security
  • 5.37 Documented operating procedures
  • 8.15 Logging
  • 8.32 Change management

ISO 27002:2022 · 5 controls

  • 5.36 Compliance with policies, rules and standards for information security
  • 5.37 Documented operating procedures
  • 8.15 Logging
  • 8.26 Application security requirements
  • 8.32 Change management

ISO 27701:2019 · 5 controls

  • 5.6.2 Information security risk assessment
  • 6.11.2 Security in development and support processes
  • 6.9.1 Operational procedures and responsibilities
  • 6.9.4 Logging and monitoring
  • 7.4.3 Accuracy and quality
  • CCM-AIS-02 Application Security Baseline Requirements
  • CCM-AIS-04 Secure Application Design and Development

HIPAA Security Rule · 2 controls

ISO/IEC 42001:2023 · 2 controls

  • A.6.2.4 AI system verification and validation
  • A.7.4 Quality of data for AI systems

NIST SP 800-218 · 2 controls

NIST SP 800-66 Rev 2 · 2 controls

DORA · 1 control

  • DORA-Art.23 Operational or security payment-related incidents

EU AI Act · 1 control

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in PI - Processing Integrity

You are reading one control. How much of SOC 2 have you already done?

SOC 2 SOC2-PI1.3 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of SOC 2 your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 49 of 61 SOC 2 controls already carry evidence.

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 193 were rejected on the NIST SP 800-53 Rev 5 pair alone.

Query this from an agent

The graph holds this control, the 47 it maps to, and the evidence behind each claim, over MCP and REST.