PI1.1 Quality information about processing objectives, data definitions and specifications

Relevant, good-quality information about processing objectives, including what the processed data means and what products and services are specified to do, is obtained or generated, used and communicated to support use of the products and services. Points of focus: the information specifications needed to use products and services are identified; where data is supplied as part of a service or a reporting obligation, its definition is available to users and covers the population included, the nature of each element, sources, units of measure, accuracy and precision, uncertainty, the date or period observed and the inclusion and exclusion factors, is complete and accurate, and any metadata needed to understand it is described; and for goods, the information users need is available, clearly identifiable and validated.

Source: SOC 2 (2017 Trust Services Criteria), PI1.1. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open SOC 2 (2017 Trust Services Criteria) in the compliance library.

These are criteria, not controls: you design controls that meet them, and which criteria are in scope follows the categories your report covers (Security always; Availability, Confidentiality, Processing Integrity and Privacy only if chosen). A Type 2 report tests that the controls operated across the period, so the evidence asked for is samples across that period, not one copy.