Australia Consumer Data Right - Banking (CDR) covers 47.5% of SOC 2
29 of the 61 controls in SOC 2 are already satisfied by evidence you collected for Australia Consumer Data Right - Banking (CDR). 32 are genuine gaps. Every claim below was judged against both control sets and then argued against; the ones that did not survive are published further down with the reason each failed.
This number is directional. It says how much of SOC 2 your Australia Consumer Data Right - Banking (CDR) evidence satisfies. The reverse pair is a different number, often very different, because a security standard has enormous depth for access control and almost none for lawful basis or data subject rights.
55 candidate mappings were examined and 0 were removed. Signed off 2026-08-19, review level machine verified. Mappings were judged by Claude Code rather than read line by line by a practitioner. Every claim shows its reasoning so you can check it. Ask and a practitioner will review this pair.
Where the gaps are
Coverage is never evenly spread. A source standard usually satisfies one part of a target almost completely and barely touches another, and which part is which is the thing worth knowing before you plan the work.
Theme level, not control level, deliberately. The per-control list of what is evidenced and what is a gap is the report itself, so publishing it here would be publishing the thing being sold.
Claims that held
A sample. Each one names the control whose evidence does the work, the control it satisfies, and why.
Step 2 requires the CDR data environment be assessed, defined and documented.
Privacy Safeguard 12 requires redundant CDR data be destroyed or de-identified.
Step 1 requires documented practices and responsibilities including those of senior management.
Step 3 requires the capability be adapted to the threats and the potential consumer harm.
Step 2 requires boundaries be reviewed on becoming aware of material change.
Step 4 requires a testing program using independent skilled testers, reviewed annually.
Step 4 requires control deficiencies be escalated to senior management.
Step 3 requires a control set adapted to assessed risk rather than a fixed list.
Claims that did not hold
Nothing proposed for this pair was rejected in review. That is unusual and worth knowing rather than hiding: it means the candidate set was small and every candidate held.
The full report
Everything above is a sample. The report is every evidenced control and every gap, with the reasoning and the source document behind each one, in a form you can hand to an assessor. $299, emailed immediately.
Buy this crosswalk