Asset, Data & Architecture
Customer data and telemetry are classified and protected according to sensitivity, contractual commitments, privacy obligations, and operational use.
Use this guide to put the control into operation, decide what records to retain, and check that an auditor can trace the evidence back to the work your team performed.
Maintained by GreenHat Security · Reviewed August 21, 2026
Customer data and telemetry receive a clear classification based on sensitivity, commitments, privacy considerations, and operational use, and the classification drives how the data is accessed, transferred, retained, and protected.
First SOC 2 program
Choose a small set of understandable sensitivity levels, classify the major production stores, logs, analytics, support exports, and backups, and write concrete handling rules for each level. Focus first on places containing customer content, credentials, identifiers, or sensitive telemetry.
As the company scales
Manage classifications in a data catalog with named owners, discovery, labels, and periodic review. Map classifications to access policy, encryption, masking, retention, non-production use, and monitoring so a label changes actual system behavior.
Describe each level with concrete examples, sensitivity signals, customer and privacy considerations, and an owner who resolves ambiguous cases.
You should end up with: An approved classification standard with examples and decision rules.
Identify production stores, object storage, logs, analytics, backups, support tools, exports, and non-production copies that contain customer information.
You should end up with: A data inventory with repository, data category, use, and owner.
Have data owners classify each repository or data set and record the reason, including contractual or privacy factors that affect the decision.
You should end up with: Approved classification entries with owner and review date.
Specify access, encryption, transfer, sharing, logging, retention, disposal, and non-production handling for every classification level.
You should end up with: A handling matrix tied to the classification standard.
Configure labels, access groups, masking, encryption, retention, export restrictions, or monitoring appropriate to the assigned level.
You should end up with: Configuration records for sampled repositories showing the handling rule in effect.
Reassess classifications when data use, commitments, integrations, or schemas change and periodically investigate unclassified or mismatched repositories.
You should end up with: A dated review report with reclassifications and remediation tickets.
Build the evidence set in three layers: what defines the control, who approved or reviewed it, and what proves it operated. Collect operating records when the work happens so they remain dated, attributable, correctly scoped, and traceable to the underlying activity.
Before sharing, remove unrelated personal or customer data, never expose passwords, tokens, or secret values, preserve enough source context to authenticate the record, and use the secure exchange approved for the engagement.
Documents that define the control, its scope, ownership, and expected way of working.
Confirm what the record proves
Shows the assigned sensitivity of each customer-data or telemetry set, the owner’s decision, and the context needed to apply handling rules.
Include this context
data set or repository identifier
Include this context
data categories
Include this context
classification
Include this context
owner
Include this context
decision rationale
Include this context
review date
Weak evidence to avoid
A list that marks every production system confidential without identifying data sets, owners, rationale, or review status.
Confirm what the record proves
Shows where classified customer data and telemetry originate, reside, move, and leave, including operational copies outside the primary database.
Include this context
data category and classification
Include this context
source and collection point
Include this context
repositories and processors
Include this context
recipients or destinations
Include this context
owner
Include this context
retention or lifecycle reference
Weak evidence to avoid
A single database entry that omits logs, analytics, support exports, backups, integrations, and non-production copies.
Confirm what the record proves
Shows the access, encryption, transfer, sharing, logging, retention, disposal, and non-production treatment expected for each classification.
Include this context
classification level
Include this context
access and storage rules
Include this context
transfer and sharing rules
Include this context
retention and disposal rules
Include this context
exception path
Include this context
approver and revision date
Weak evidence to avoid
A definition of sensitivity labels with no actionable storage, sharing, access, retention, or disposal behavior.
Records showing that an accountable person reviewed, approved, challenged, or accepted the work.
Confirm what the record proves
Shows that data owners compared current schemas, uses, commitments, and repositories with assigned classifications and corrected drift.
Include this context
reviewed population and snapshot date
Include this context
data owner and reviewer
Include this context
current and changed classification
Include this context
reason for decision
Include this context
handling impact
Include this context
completion date
Weak evidence to avoid
A yearly approval of the classification policy without a reviewed data population, changed classifications, or handling follow-up.
Type 1
The classification inventory, data map, and handling rules effective on the examination date, including unclassified, disputed, and remediation items for current customer data and telemetry repositories.
Type 2
Every new or materially changed customer-data set, telemetry schema, repository, support export, analytics use, integration, or non-production copy during the review period, plus each quarterly production classification review and annual supporting-data review due in the period.
Reconcile current databases, storage, log indexes, warehouse tables, event schemas, support locations, and active integrations to the classification inventory; compare period schema and data-use changes to review records and resolve every unclassified or mismatched item.
Use this checklist to prepare for procedures an auditor may perform. The exact steps and sample selection depend on your engagement scope and the service auditor's professional judgment.
Determine whether the control is designed to achieve this result: Customer data and telemetry receive a clear classification based on sensitivity, commitments, privacy considerations, and operational use, and the classification drives how the data is accessed, transferred, retained, and protected.
Compare the documented owner with the intended role (Engineering / Infrastructure / Data Owner), then compare dated records with the stated cadence: Quarterly for production/customer-impacting; annually for supporting assets.
Reconcile current databases, storage, log indexes, warehouse tables, event schemas, support locations, and active integrations to the classification inventory; compare period schema and data-use changes to review records and resolve every unclassified or mismatched item.
The classification inventory, data map, and handling rules effective on the examination date, including unclassified, disputed, and remediation items for current customer data and telemetry repositories.
Every new or materially changed customer-data set, telemetry schema, repository, support export, analytics use, integration, or non-production copy during the review period, plus each quarterly production classification review and annual supporting-data review due in the period.
Documents that define the control, its scope, ownership, and expected way of working.
For each selected record, confirm it demonstrates Shows the assigned sensitivity of each customer-data or telemetry set, the owner’s decision, and the context needed to apply handling rules.
For each selected record, confirm it demonstrates Shows where classified customer data and telemetry originate, reside, move, and leave, including operational copies outside the primary database.
For each selected record, confirm it demonstrates Shows the access, encryption, transfer, sharing, logging, retention, disposal, and non-production treatment expected for each classification.
Records showing that an accountable person reviewed, approved, challenged, or accepted the work.
For each selected record, confirm it demonstrates Shows that data owners compared current schemas, uses, commitments, and repositories with assigned classifications and corrected drift.
Use the categories that apply to this control: connect any policy or design artifact to its approval or review record, then trace a selected operating record through execution, result, and any exception or remediation.
These identifiers help you navigate related Trust Services Criteria. They do not reproduce the criteria or prove that this control fully addresses them in your environment.
Confirm final scope, mappings, and testing expectations with your service auditor. SOC 2® is an AICPA trademark; GreenHat Security is not affiliated with or endorsed by AICPA.