Confidentiality / Privacy
Confidential information is protected in transit and at rest using approved encryption, access control, segmentation, logging, and key-management practices.
Use this guide to put the control into operation, decide what records to retain, and check that an auditor can trace the evidence back to the work your team performed.
Maintained by GreenHat Security · Reviewed August 21, 2026
Confidential information is protected in transit and at rest through approved encryption, access control, segmentation, logging, and key-management practices that cover production data, backups, exports, and internal service paths.
First SOC 2 program
Use managed cloud encryption for databases, object storage, disks, and backups; enforce modern transport security at public and administrative endpoints; keep secrets and keys in managed services; and restrict access through centralized identities. Retain configuration and validation results for the systems that matter most.
As the company scales
Define approved cryptographic configurations, centralize keys with ownership and separation, automate coverage checks across cloud and application estates, monitor key use and configuration drift, and manage any exception with scope, compensating safeguards, and expiry.
Use classifications and data flows to identify stores, backups, file transfers, APIs, internal service calls, administrative paths, exports, and vendor connections carrying confidential information.
You should end up with: A protection-scope map with data, system, owner, and transit or storage path.
Define acceptable transport protocols, at-rest encryption, key ownership, access restrictions, logging, rotation approach, and exception approval for the relevant technologies.
You should end up with: An approved encryption and key-management standard with system mappings.
Configure encryption for databases, object stores, volumes, backups, queues, analytics stores, and other scoped repositories using managed keys where suitable.
You should end up with: Provider or system configuration records for each sampled repository.
Enforce approved transport protection for public, partner, administrative, and internal connections, and redirect or block insecure paths.
You should end up with: Endpoint and service configuration plus current protocol test results.
Assign key owners, separate key administration from routine data access where practical, restrict identities, enable activity logging, and review unusual or failed use.
You should end up with: Key access policy, administrator list, activity logs, and review record.
Compare live configurations with the scoped system list, investigate uncovered assets or weak paths, and document any temporary exception with owner and expiry.
You should end up with: A dated coverage report and remediation or exception records.
Build the evidence set in three layers: what defines the control, who approved or reviewed it, and what proves it operated. Collect operating records when the work happens so they remain dated, attributable, correctly scoped, and traceable to the underlying activity.
Before sharing, remove unrelated personal or customer data, never expose passwords, tokens, or secret values, preserve enough source context to authenticate the record, and use the secure exchange approved for the engagement.
Dated proof that the control actually ran, such as tickets, logs, settings, exports, reports, and test results.
Confirm what the record proves
Shows the live at-rest protection, encryption state, key association, and coverage for scoped databases, storage, disks, queues, analytics, and backups.
Include this context
resource identifier and environment
Include this context
data classification or scope
Include this context
encryption state and method
Include this context
key identifier and ownership
Include this context
configuration observation time
Include this context
exception status
Weak evidence to avoid
A cloud marketing page stating encryption is available, without live resource identifiers, settings, keys, environments, or export time.
Confirm what the record proves
Shows that public, partner, administrative, and material internal endpoints enforce the approved transport protocols, certificates, and insecure-connection behavior.
Include this context
endpoint or service identifier
Include this context
environment and connection path
Include this context
protocol and cipher policy
Include this context
certificate identity and expiry
Include this context
redirect or rejection behavior
Include this context
test timestamp and result
Weak evidence to avoid
A successful browser padlock screenshot for the marketing site that says nothing about APIs, admin paths, internal services, protocols, or expiry.
Confirm what the record proves
Shows which human and service identities can access confidential stores, protected paths, and key administration, and the roles or conditions governing that access.
Include this context
resource or key scope
Include this context
identity or group
Include this context
role and permissions
Include this context
access basis or owner
Include this context
effective date
Include this context
review or removal status
Weak evidence to avoid
A screenshot of one administrator group with no member export, resource scope, permissions, service identities, or review date.
Confirm what the record proves
Shows key ownership, creation, access, rotation, disablement, and monitored use for the keys protecting scoped confidential information.
Include this context
key identifier and protected resources
Include this context
key owner and administrators
Include this context
creation and rotation history
Include this context
status and expiry where applicable
Include this context
usage or administrative activity
Include this context
review date and result
Weak evidence to avoid
A settings page showing automatic rotation enabled without key scope, owner, administrator access, actual history, or activity review.
Type 1
Live encryption, transport, access, segmentation, logging, and key configuration for every scoped confidential store and path on the examination date, with all active exceptions and expiring certificates or keys.
Type 2
Every scoped confidential-data repository, backup, queue, analytics store, export path, public or administrative endpoint, material internal connection, and protecting key active during the review period, together with every configuration change, key lifecycle event, coverage review, and exception affecting them.
Start with classified repositories and current data flows, reconcile them to cloud, database, backup, endpoint, connection, and key inventories, and compare configuration scans in the period; investigate every uncovered store or path, unowned key, weak result, unexplained change, and expired exception.
Use this checklist to prepare for procedures an auditor may perform. The exact steps and sample selection depend on your engagement scope and the service auditor's professional judgment.
Determine whether the control is designed to achieve this result: Confidential information is protected in transit and at rest through approved encryption, access control, segmentation, logging, and key-management practices that cover production data, backups, exports, and internal service paths.
Compare the documented owner with the intended role (Privacy Owner / CISO / Data Owners), then compare dated records with the stated cadence: Ongoing; periodic review by privacy/data owner.
Start with classified repositories and current data flows, reconcile them to cloud, database, backup, endpoint, connection, and key inventories, and compare configuration scans in the period; investigate every uncovered store or path, unowned key, weak result, unexplained change, and expired exception.
Live encryption, transport, access, segmentation, logging, and key configuration for every scoped confidential store and path on the examination date, with all active exceptions and expiring certificates or keys.
Every scoped confidential-data repository, backup, queue, analytics store, export path, public or administrative endpoint, material internal connection, and protecting key active during the review period, together with every configuration change, key lifecycle event, coverage review, and exception affecting them.
Dated proof that the control actually ran, such as tickets, logs, settings, exports, reports, and test results.
For each selected record, confirm it demonstrates Shows the live at-rest protection, encryption state, key association, and coverage for scoped databases, storage, disks, queues, analytics, and backups.
For each selected record, confirm it demonstrates Shows that public, partner, administrative, and material internal endpoints enforce the approved transport protocols, certificates, and insecure-connection behavior.
For each selected record, confirm it demonstrates Shows which human and service identities can access confidential stores, protected paths, and key administration, and the roles or conditions governing that access.
For each selected record, confirm it demonstrates Shows key ownership, creation, access, rotation, disablement, and monitored use for the keys protecting scoped confidential information.
Use the categories that apply to this control: connect any policy or design artifact to its approval or review record, then trace a selected operating record through execution, result, and any exception or remediation.
These identifiers help you navigate related Trust Services Criteria. They do not reproduce the criteria or prove that this control fully addresses them in your environment.
Confirm final scope, mappings, and testing expectations with your service auditor. SOC 2® is an AICPA trademark; GreenHat Security is not affiliated with or endorsed by AICPA.