SOC 2 Controls List: Map Controls to the Trust Services Criteria

Suggested Inventory Columns

Use a spreadsheet or GRC tool with columns like these (request a working template via contact — we do not host a fake public Excel download):

Starter Control Groups (Illustrative)

• Access provisioning, MFA, privileged access, joiner-mover-leaver (CC6)
• Logging, alerting, incident response (CC7)
• Change approval and release (CC8)
• Vendor risk and BCP/DR where Availability/CC9 apply
• Encryption and classification when Confidentiality is in scope

How CyberSilo Helps

CSA maintains a living control-to-evidence map so your list stays current through the observation period.

Frequently Asked Questions

Is there an official AICPA SOC 2 controls Excel?

No single official fixed control count Excel from AICPA replaces your organisation-defined controls mapped to TSC criteria and points of focus.

Should every company use the same control list?

No. Scope, architecture, and trust commitments differ. Reuse patterns, then tailor.

How does this differ from the checklist?

The controls list is the durable inventory. The compliance checklist is a readiness/progress tracker across programme steps.

Related SOC 2 Resources

SOC 2 hub · Policies · Checklist · CSA