C1.1 Identifying and maintaining confidential information

Confidential information is identified and kept in line with the organisation's confidentiality objectives. Points of focus: procedures define confidential information and identify and designate it when received or created, and set how long it is kept; it is protected from erasure or destruction during that period; and, added in 2022, it is kept no longer than the identified purpose needs unless a law or regulation requires otherwise.

Source: SOC 2 (2017 Trust Services Criteria), C1.1. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open SOC 2 (2017 Trust Services Criteria) in the compliance library.

These are criteria, not controls: you design controls that meet them, and which criteria are in scope follows the categories your report covers (Security always; Availability, Confidentiality, Processing Integrity and Privacy only if chosen). A Type 2 report tests that the controls operated across the period, so the evidence asked for is samples across that period, not one copy.