SOC 2® confidentiality criteria in plain English (C1.1, C1.2)
Unofficial plain-English guide. Not affiliated with or endorsed by the AICPA. Read the AICPA’s own criteria
An unofficial plain-English look at the SOC 2 confidentiality criteria, C1.1 and C1.2: knowing what is confidential, and deleting it when its time is up.
OrderFive custom security policies, $85 flat. Markdown, Word, and PDF.
Order the five policies
What do you hold in confidence, and when do you let it go?
Confidentiality is an optional category for companies that hold information their customers or partners treat as secret: contracts, source code, business plans, financial data. It is separate from privacy, which is about personal information.
The two criteria ask you to know what is confidential and to keep it no longer than it is useful, then to destroy it when the time is up. The second half is easy to neglect, because storage is cheap and deletion is work.
Where a small team starts
Write a classification with three levels, and list where each level of data lives. Then set a retention period for each level.
Make deletion a scheduled job with a log, not a promise. Include the backups and the copies that vendors hold, because those are where the old data hides.
The criteria, C1.1 to C1.2
Below are our short labels, what the criteria are about, and examples of what a small team might do or keep. The examples are our own views, not requirements of the standard.
C1.1: Knowing what is confidential
The company decides what counts as confidential, tracks where it lives, and keeps it only as long as it needs to. Retention should match contracts and the rules that apply to you.
In practice
- A data classification table with three levels and examples of each.
- A data inventory showing where the confidential material lives.
- A retention schedule by type of data.
- Customer contract terms on retention, noted next to the schedule.
C1.2: Deleting confidential data on schedule
When the retention period ends, or a customer leaves, confidential data is destroyed, and the company can show that it was.
In practice
- A scheduled deletion job that writes a log of what it removed.
- A customer offboarding checklist that includes deleting their data and confirming it.
- Backup expiry set to match the retention schedule.
- Written confirmation of deletion from vendors that held copies.
Questions worth being able to answer
These are ours, not a list of what an examiner will ask. If you can answer each in a sentence, and show where the proof lives, you are in good shape for the conversation.
- What do you treat as confidential, and who decided that?
- How long do you keep customer data after they leave?
- Show me a record of something you deleted.
- Do backups follow the same retention rules?
- For the data classification policy, read The first five security policies a startup needs before SOC 2.
More topics in this guide
This page is one part of our unofficial guide to the SOC 2 Trust Services Criteria. Here are the others.
- Ownership and communication (CC1.1 to CC2.3)
- Risk, monitoring, and policies (CC3.1 to CC5.3)
- Access control (CC6.1 to CC6.3)
- Networks, devices, and places (CC6.4 to CC6.8)
- Detection and incident response (CC7.1 to CC7.5)
- Change management (CC8.1)
- Vendors and business disruption (CC9.1 to CC9.2)
- Availability (A1.1 to A1.3)
- Processing integrity (PI1.1 to PI1.5)
- Privacy: notice and consent (P1.1 to P3.2)
- Privacy: use, retention, quality (P4.1, P4.2, P4.3, P7.1)
- Privacy: requests and complaints (P5.1, P5.2, P6.7, P8.1)
- Privacy: sharing and breaches (P6.1 to P6.6)
Related guides
About this guide and the study tool
Who we are, and aren’t
Blank Slate Creative, LLC is not affiliated with, endorsed by, or sponsored by the AICPA, CIMA, or the Association of International Certified Professional Accountants. We are not a CPA firm. Only a licensed CPA firm can perform a SOC 2 examination and issue a report.
What this is, and isn’t
This is an unofficial, plain-English explanation written by Blank Slate Creative, LLC. It is not the Trust Services Criteria, and it does not reproduce or replace them.
It is not legal, audit, or attestation advice.
Using this guide or the study tool does not mean you will pass an audit or satisfy any customer or auditor.
The “in practice” notes and examples are our own views, not requirements of the standard.
Written about the 2017 criteria with the 2022 revised points of focus. The AICPA may revise them.
Read the AICPA’s own publication for the authoritative wording. The PDF download asks for a free AICPA account.
Trademarks
AICPA and American Institute of CPAs are trademarks of the American Institute of Certified Public Accountants and are registered in the US, the EU and other countries.
SOC 1®, SOC 2® and SOC 3® trademarks are registered trademarks of the AICPA.