SOC 2 Control Relationships

This document provides a comprehensive mapping of relationships between SOC 2 control requirements to help you navigate the documentation and understand how controls work together to provide comprehensive security coverage.

Control Categories Overview

🔐 Data Security Controls (DS-01 to DS-06)

Controls focused on protecting data through encryption, classification, and secure handling.

🗄️ Logical Security Controls (LS-01 to LS-26)

Controls focused on access management, authentication, and logical security measures.

💾 Backup & Disaster Recovery (BDR-04 to BDR-09)

Controls focused on data backup, recovery procedures, and business continuity.

🔄 Change Management (CM-1 to CM-18)

Controls focused on managing changes to systems, applications, and infrastructure.

📊 Communications & Monitoring (COM-02 to COM-10)

Controls focused on logging, monitoring, alerting, and security scanning.

🚨 Incident Response (IR-01 to IR-02)

Controls focused on incident detection, response, and recovery procedures.

📋 Risk Assessment (RA-01 to RA-03)

Controls focused on risk identification, assessment, and management.

🤝 Third-Party Management (TPM-01 to TPM-04)

Controls focused on managing third-party vendors and their access.

📜 Policies & Procedures (PP-19 to PP-20)

Controls focused on policy development and incident reporting.

Cross-Category Relationships

Encryption & Data Protection

Primary Controls:

• DS-01: Removable Media Encryption
• DS-03: Data Classification and Handling
• DS-05: Secure Data Transmission
• LS-01: Database Encryption at Rest
• BDR-09: Backup Encryption

Related Controls:

• Access Management: LS-04, LS-05, LS-07, LS-14
• Monitoring: COM-02, COM-04, COM-08, COM-10
• Change Management: CM-1, CM-3, CM-4, CM-15
• Incident Response: IR-01, IR-02

Access Management & Authorization

Primary Controls:

• LS-04: Access Authorization
• LS-05: Access Review
• LS-07: Privileged Access Management
• LS-14: Administrative Access Restrictions

Related Controls:

• Data Security: DS-01, DS-03, DS-04, DS-06
• Logical Security: LS-01, LS-06, LS-10, LS-16, LS-19, LS-21, LS-22, LS-24, LS-25, LS-26
• Monitoring: COM-02, COM-04, COM-05, COM-10
• Change Management: CM-1, CM-3, CM-11, CM-12
• Incident Response: IR-01, IR-02

Monitoring & Logging

Primary Controls:

• COM-02: Centralized Logging Solution
• COM-04: Log Monitoring and Alerting
• COM-08: Quarterly Internal Network Scans
• COM-09: Annual External Scanning
• COM-10: Security Event Monitoring

Related Controls:

• Access Management: LS-04, LS-05, LS-07, LS-14
• Data Security: DS-03, DS-06
• Incident Response: IR-01, IR-02
• Risk Assessment: RA-01, RA-02, RA-03
• Change Management: CM-15, CM-17

Change Management

Primary Controls:

• CM-1: Source Code Access Review
• CM-3: Change Authorization
• CM-4: Change Testing
• CM-15: Change Monitoring
• CM-17: Change Review Process

Related Controls:

• Access Management: LS-04, LS-05, LS-07, LS-14
• Monitoring: COM-02, COM-04, COM-08
• Risk Assessment: RA-01, RA-02
• Incident Response: IR-01, IR-02
• Data Security: DS-01, DS-03

Backup & Disaster Recovery

Primary Controls:

• BDR-04: Backup Procedures
• BDR-06: Data Retention and Destruction
• BDR-07: Backup Storage and Security
• BDR-09: Backup Encryption

Related Controls:

• Data Security: DS-01, DS-03, DS-06
• Logical Security: LS-01, LS-22
• Access Management: LS-04, LS-05, LS-07
• Monitoring: COM-02, COM-04
• Incident Response: IR-01, IR-02

Incident Response

Primary Controls:

• IR-01: Monthly Incident Review
• IR-02: Incident Management Process
• PP-19: Incident Reporting Mechanisms

Related Controls:

• Monitoring: COM-02, COM-04, COM-10
• Access Management: LS-04, LS-05, LS-07
• Change Management: CM-1, CM-3, CM-4, CM-9
• Risk Assessment: RA-01, RA-02, RA-03
• Data Security: DS-01, DS-03, DS-04

Risk Assessment

Primary Controls:

• RA-01: Internal Control Audits
• RA-02: Risk Assessment Procedures
• RA-03: Third-Party Risk Assessment

Related Controls:

• Monitoring: COM-08, COM-09, COM-10
• Access Management: LS-04, LS-05, LS-14, LS-16
• Change Management: CM-1, CM-3, CM-4
• Third-Party Management: TPM-01, TPM-02, TPM-03, TPM-04
• Incident Response: IR-01, IR-02

Third-Party Management

Primary Controls:

• TPM-01: Third-Party Risk Assessment
• TPM-02: Third-Party Access Controls
• TPM-03: Third-Party Monitoring
• TPM-04: Third-Party Incident Response

Related Controls:

• Risk Assessment: RA-01, RA-02, RA-03
• Access Management: LS-04, LS-05, LS-07, LS-14
• Monitoring: COM-02, COM-04, COM-10
• Incident Response: IR-01, IR-02
• Data Security: DS-03, DS-06

Implementation Guidance

Starting Points

1. For Data Protection: Start with DS-01 and LS-01 for encryption fundamentals
2. For Access Control: Begin with LS-04 and LS-05 for access management
3. For Monitoring: Start with COM-02 for logging infrastructure
4. For Change Management: Begin with CM-1 and CM-3 for change controls
5. For Incident Response: Start with IR-01 and PP-19 for incident procedures

Control Dependencies

• Foundation Controls: LS-04, LS-05, COM-02 (required for most other controls)
• Enabling Controls: CM-1, CM-3, CM-4 (support change management)
• Protective Controls: DS-01, DS-03, LS-01, BDR-09 (protect data and systems)
• Detective Controls: COM-04, COM-08, COM-10, IR-01 (detect and respond to issues)

Compliance Mapping

• Security: All controls contribute to security objectives
• Availability: BDR-04, BDR-06, BDR-07, BDR-08, BDR-09, CM-15, CM-16, CM-17
• Confidentiality: DS-01, DS-03, DS-05, LS-01, LS-04, LS-05, LS-07, LS-14
• Processing Integrity: CM-1, CM-3, CM-4, CM-15, LS-04, LS-05, LS-07
• Privacy: DS-03, DS-06, LS-04, LS-05, LS-07, IR-01, IR-02

Navigation Tips

1. Use Related Controls Sections: Each control document includes a "Related Controls" section with direct links
2. Follow Control Categories: Use the category groupings to understand related controls
3. Check Dependencies: Review control dependencies before implementation
4. Cross-Reference: Use this matrix to understand how controls work together
5. Implementation Order: Consider the foundation controls first, then build upon them

Quick Reference

Most Critical Controls

• LS-04: Access Authorization (foundation for access control)
• LS-05: Access Review (ongoing access management)
• COM-02: Centralized Logging (foundation for monitoring)
• CM-1: Source Code Access Review (change management foundation)
• IR-01: Monthly Incident Review (incident response foundation)

Most Interconnected Controls

• LS-04: Access Authorization (connects to 15+ other controls)
• COM-02: Centralized Logging (connects to 12+ other controls)
• LS-05: Access Review (connects to 10+ other controls)
• IR-01: Monthly Incident Review (connects to 8+ other controls)
• RA-01: Internal Control Audits (connects to 8+ other controls)

Monitoring and Observability Implementation

Implementation Resources

Leadline Architecture Design

• Observability & Monitoring: Comprehensive observability stack with Prometheus, Grafana, Loki, and monitoring best practices for implementing monitoring and logging controls
• SSDLC Security Practices: Secure Software Development Lifecycle implementation and security toolchain for implementing security controls

Key Implementation Areas

• Monitoring & Logging Controls: Use the Observability guide for COM-02, COM-04, COM-08, COM-09, COM-10
• Security Controls: Use the SSDLC guide for CM-1, CM-3, CM-4, LS-04, LS-05, LS-07, LS-14
• Data Protection: Use both guides for DS-01, DS-03, DS-05, LS-01, BDR-09
• Incident Response: Use both guides for IR-01, IR-02, PP-19
• Risk Assessment: Use both guides for RA-01, RA-02, RA-03

This relationship matrix helps you understand the interconnected nature of SOC 2 controls and provides a roadmap for effective implementation and compliance.