SOC 2 | Analog Informatics

Trust Services Criteria

Criteria	What the Kit Does
CC1 Control environment	Governance and oversight stay with the organization. The Assessment Binder stores the record.
CC2 Communication and information	Training and attestation records that people received and signed policy material.
CC3 Risk assessment	Current State Compliance records findings. Risk decisions stay with the organization.
CC4 Monitoring activities	Continuous configuration compliance monitoring and the Assessment Binder.
CC5 Control activities	Privileged access, least privilege, and approvals on kit paths.
CC6 Logical and physical access	Logical access through Privileged Identity Management, Privileged Access Management, and Privileged User Management. Physical access stays with the organization.
CC7 System operations	Audit, alerts, Incident Response, and continuous monitoring.
CC8 Change management	Configuration compliance records the approved baseline and findings. Change approval workflow is planned.
CC9 Risk mitigation	Vendor and business risk stay with the organization. Incident Response supports response.
A1 Availability	Capacity and recovery stay with the organization. High-availability database failover is available on customer-supplied hosts.
C1 Confidentiality	Validated cryptography and the document sharing vault on kit paths.
PI1 Processing integrity	Input validation and audit of privileged actions on kit paths.
P1 to P8 Privacy	Account correction and removal in the kit. Notice, consent, and request handling stay with the organization.

Evidence feeds, partner tools, and migration help are on Partners and Migration.