General Policies

SourceSource:: https://secureframe.com/hub/soc-2/policies-and-procedures

All SOC 2 examinations involve an auditor review of your organization’s policies.

Policies must be documented, formally reviewed, and accepted by employees.

Each policy supports an element of the overall security and approach to handling customer data.

All Policies Must follow and include details for which an Auditor looks for.

• [OPS] Acceptable Use Policy: – Defines the ways in which the network, website or system may be used. Can also define which devicessystem, and typesdevice ofusage rules, removable media can be used,media, password requirements, andissuance/return howof devices will be issued and returned.devices.
• [TECH] Access Control Policy: – Defines who will have access to company systems and how often those access permissions will be reviewed.
• [TECH] Business Continuity Plan: – Defines how employees will respond to a disruptiondisruptions to keep the business running smoothly.running.
• [TECH] Change Management Policy :– Defines how system changes will be documented and communicated across your organization.communicated.
• [OPS] Confidentiality Policy :– Defines howhandling your organization will handleof confidential information about clients, partners, or the company itself.company.
• [OPS] Code of Conduct Policy :– Defines theexpected policiesbehavior bothof employees and employers must adhere to. This includes how people should interact with one another at work.
• [TECH] [OPS] Data Classification Policy :– Defines howclassification you will classifyof sensitive data according to the level ofby risk it poses to your organization.level.
• [TECH] Disaster Recovery Policy :– Defines how your company willto recover from adisasters disastrousand event.maintain It also includes the minimum necessary functions your organization needs to continueminimal operations.
• [TECH] Encryption Policy :– Defines the type ofwhich data youris organization will encryptencrypted and how it’s encrypted.how.
• [TECH] Incident Response Plan :– Defines roles and responsibilities in response toduring a data breach and during the ensuingor investigation.
• [TECH] [OPS] Information Security Policy :– Defines youroverall approach to information security and whyreasons you’refor putting processes and policies in place.processes.
• [TECH] Information, Software, and System Backup Policy: – Defines how information from business applicationsapplication willdata beis stored tofor ensure data recoverability.recovery.
• [TECH] Logging and Monitoring Policy: – Defines which logs you’llare collectcollected, monitored, and monitor. Also covers what’s captured in those logs, and whichhow systems will beare configured for logging.
• [OPS] Physical Security Policy: – Defines how you will monitor and secure physical access tois your company’s location. What will you do to prevent unauthorized physical access to data centersmonitored and equipment?secured at company locations.
• [TECH] Password Policy –: Defines the requirements for using strong passwords,password, password managers,manager, and passwordexpiration expirations.requirements.
• [TECH] [OPS] Remote Access Policy: – Defines who is authorized tocan work remotely.remotely, Alsoconnection defines what type of connectivity they will usetypes, and howprotection that connection will be protected and monitored.measures.
• [TECH] [OPS] Risk Assessment and Risk Mitigation Plan: – Defines securitypotential threats that could occur and thepreventive action plan to prevent those incidents.actions.
• [TECH] Software Development Lifecycle Policy –: Defines howsecure youbuild, will ensure your software is built securely, tested regularly,testing, and compliescompliance withfor regulatory requirements.software.
• [TECH] [OPS] Vendor Management Policy: – Defines vendors that may introduce risk,risk as well asand controls put in place to minimize those risks.mitigate.
• [TECH] [OPS] Workstation Security Policy: – Defines how you willto secure your employees’employee workstations to reduce the risk of dataagainst loss and unauthorized access.