SOC 2 C1.1: confidential data handling, explained for startups

What usually proves it

An auditor wants records from the period being examined, pulled from the systems that hold them rather than written up afterwards. Dates matter. A record with a date and a named owner carries more weight than a screenshot with neither. For C1.1, the usual records are these.

• A data classification standard
• An inventory of where confidential data lives
• Access lists for confidential data stores

What Polara asks about it

The free readiness assessment asks 4 questions that bear on C1.1. A yes becomes a task to show the proof. A no becomes a task to fix the gap, with the steps written out.

• Is confidential information labelled or tagged, so the people and systems handling it can tell it apart? If yes, show it: storage bucket or database tags marking confidential data, a document carrying its confidentiality label, or a data catalog entry with its classification. If no, the fix: apply your classification labels to every document, data store and bucket that holds confidential information, and export the labels.
• Is access to confidential information limited to the people whose work needs it, with each grant approved? If yes, show it: access group membership for a confidential data store, an approved access request, or an identity provider policy restricting the store to named groups. If no, the fix: put the data stores that hold confidential information behind their own access groups, require an approval for each addition, and export the membership.
• Have you set how long each kind of confidential information is kept, and is it protected from deletion before then? If yes, show it: retention schedule listing each kind of confidential information and its period, a storage lifecycle rule, or a contract clause naming the retention period. If no, the fix: write a retention schedule that names each kind of confidential information, its retention period and its owner.

It also asks, for context:

• What information have you promised customers or partners to keep confidential?

Policies, templates and connected evidence

A policy states the rule, a template gives you the record to keep, and a connected system pulls the proof from the source. An auditor checks that the three agree: the cadence in the policy, the dates in the record and what the system shows.

In the policy pack, the Confidentiality Policy covers C1.1.

Free templates that help, printed in full with Word, PDF or Excel downloads:

• Data classification standard template

If you also run ISO 27001, the Annex A controls A.5.34, personal data protection and A.8.11, data masking ask for overlapping evidence. One record can serve both when it names what it proves.

Is it in your scope?

Only if you add Confidentiality. How you identify and protect information you have agreed to keep confidential, and how you destroy it when the time comes. It fits a company whose contracts carry confidentiality obligations.

The scoping tool decides it with one question: Add it when contracts or non-disclosure agreements commit you to keep customer or partner information confidential. Identifying and labelling confidential information, limiting access to it, keeping it for a set period and destroying it with a record.

Security is the default and always in scope. Adding Confidentiality in the assessment puts its 2 criteria into the report and the examination, and adds 5 questions to the assessment.

Polara Labs is not a CPA firm. SOC 2 examinations are performed by independent licensed U.S. CPA firms.

Confidentiality: the criteria around it

C1.1 is one of 2 criteria in confidentiality, C1.1 to C1.2. Reading a group together shows how its outcomes fit, and one record often serves more than one of them.

• C1.1, this page
• C1.2, confidential data disposal

Before it: A1.3, recovery testing. After it: C1.2, confidential data disposal. All the criteria, Security first, are on the Trust Services Criteria page, grouped by category.