SOC 2
PI - Processing Integrity

SOC 2 SOC2-PI1.5: PI1.5 Controls over stored inputs, work in process and outputs

Policies and procedures keep inputs, work in progress and outputs in storage fully, correctly and promptly in line with system specifications. Points of focus: stored items are protected from theft, corruption, destruction or deterioration; system records are archived and the archives protected; storage of data is complete, accurate and timely; and records of storage activity are created and kept.

Maintained by Gerard BlokdykControl text last updated

What else in your programme already covers this

This control maps to 48 controls across 14 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

ISO 27002:2022 · 6 controls

  • 5.33 Protection of records
  • 8.13 Information backup
  • 8.15 Logging
  • 8.26 Application security requirements
  • 8.32 Change management
  • 8.9 Configuration management

FedRAMP High · 5 controls

  • AU-12 Audit Record Generation
  • CM-3 Configuration Change Control
  • SC-28 Protection of Information at Rest
  • SI-12 Information Management and Retention
  • SI-7 Software, Firmware, and Information Integrity

FedRAMP Moderate · 5 controls

  • AU-12 Audit Record Generation
  • CM-3 Configuration Change Control
  • SC-28 Protection of Information at Rest
  • SI-12 Information Management and Retention
  • SI-7 Software, Firmware, and Information Integrity

ISO 27001:2022 · 5 controls

  • 5.33 Protection of records
  • 8.13 Information backup
  • 8.15 Logging
  • 8.32 Change management
  • 8.9 Configuration management

NIST SP 800-53 Rev 5 · 5 controls

CIS Controls v8 · 4 controls

  • NIST-CSF-ID.AM-07 Inventories of data and corresponding metadata for designated data types are maintained
  • NIST-CSF-PR.DS-01 The confidentiality, integrity, and availability of data-at-rest are protected
  • NIST-CSF-PR.DS-11 Backups of data are created, protected, maintained, and tested
  • NIST-CSF-PR.PS-04 Log records are generated and made available for continuous monitoring

PCI DSS 4.0 · 3 controls

  • 10.2.1 10.2.1 Audit logging enabled on all system components
  • 10.6.2 10.6.2 Systems configured to correct and consistent time
  • 3.2.1 3.2.1 Data retention and disposal minimise stored account data

EU AI Act · 2 controls

ISO 27701:2019 · 2 controls

  • 6.9.1 Operational procedures and responsibilities
  • 7.4.3 Accuracy and quality

ISO/IEC 42001:2023 · 2 controls

  • A.7.4 Quality of data for AI systems
  • A.7.5 Data provenance

HIPAA Security Rule · 1 control

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in PI - Processing Integrity

You are reading one control. How much of SOC 2 have you already done?

SOC 2 SOC2-PI1.5 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of SOC 2 your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 49 of 61 SOC 2 controls already carry evidence.

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 193 were rejected on the NIST SP 800-53 Rev 5 pair alone.

Query this from an agent

The graph holds this control, the 48 it maps to, and the evidence behind each claim, over MCP and REST.