SOC 2 (TSC 2017)
How the access, approval, and audit primitives align to the Trust Services Criteria your SOC 2 report is written against.
What this is, and is not
Using Break Glass Business does not make you SOC 2 (TSC 2017)-certified — that is an assessment of your whole organisation. For the specific controls below, the records this product generates are the kind of evidence an assessor asks you to produce.
| Control | Title | Evidence in the pack |
|---|---|---|
| CC6.1 | Logical access security measures | secrets, accessRequests, membership |
| CC6.2 | Registration and authorisation of new users | membership |
| CC6.3 | Access modification and removal | membership, accessReview |
| CC7.4 | Response to identified security incidents | incidents, runs, messages |
| A1.2 | Recovery and business continuity testing | drills, tabletops, recoveryPlans |
Every evidence pack carries this mapping. See the full trust and control overview or the security questionnaire.