SOC 2 confidentiality criteria

The SOC 2 confidentiality criteria, SOC 2 C1.1 and C1.2, ask you to identify the information you have committed to keep confidential, protect it while you hold it, and dispose of it when your commitments say you must. Include Confidentiality when customers trust you with business data, contracts or intellectual property under confidentiality terms.

The requirement in plain English

Confidentiality is one of the four optional categories, with two criteria of its own. It applies to information you have promised, by contract or by law, to keep from people not entitled to see it.

Identify and protect (SOC 2 C1.1)

You know which information is confidential, where it is, and how long you may keep it. That starts with your commitments: the confidentiality and data-handling clauses in customer contracts, and any legal duties. You classify the information, label or tag it where that helps, and restrict who and what can reach it.

Dispose (SOC 2 C1.2)

When the retention period ends, or a customer leaves and asks for deletion, you dispose of the information in a way that stops it being recovered, and you keep a record that you did.

How it meets the common criteria

Two common criteria already cover parts of this. SOC 2 CC6.5 asks you to remove the ability to read data before you dispose of an asset, and SOC 2 CC6.7 asks you to protect information in transit and on removable media. The confidentiality criteria tie those controls to your specific commitments and add the retention and disposal schedule.

This is guidance to help you understand the requirement, not legal advice.

What good looks like

A 35-person analytics company in Cambridge holds customers’ sales data under contracts that set a retention period and require deletion within a set time after termination. Its Information Classification Policy defines four levels and puts customer data at the highest. Engineers can reach production data only through a controlled, logged route, and test environments use generated data, not copies of production.

The Data Retention and Erasure Policy has a schedule that lists each kind of confidential information, where it lives, how long it is kept and the trigger for disposal. When a customer leaves, an offboarding ticket deletes their data from the production database, the analytics warehouse and the backups as they age out, and a destruction record notes what was deleted, how and when. Every year the data protection lead checks a sample of departed customers against the systems to confirm nothing remains, and staff confirm they have read the classification policy after each new version.

Evidence an auditor expects

The criteria name no documents; these are what SOC 2 auditors usually sample for C1.

• Classification policy and scheme: approved, with customer data placed in it.
• Inventory of confidential information: where it is held, and its owners.
• Retention schedule: periods and disposal triggers that match your contracts.
• Access restrictions: who can reach confidential data, with access reviews.
• Disposal requests and destruction records: a sample of departed customers, each with evidence of deletion on time.
• Non-disclosure terms: in staff and supplier contracts.
• Test-data practice: evidence that production data is not copied to lower environments, or is masked when it is.

Common mistakes

Deleting from production and forgetting the copies

Data deleted from the main database lives on in the warehouse, the logs, exports on laptops and backups. Map every copy before you promise deletion, and say in your commitments how backups age out.

A retention schedule nobody follows

A schedule that says “seven years” with no owner or trigger produces no disposal records, so C1.2 has nothing to sample. Give each line an owner and an event that starts the clock.

Production data in test environments

Copying real customer data to test is a common finding. Use generated or masked data, and record the exceptions you approve.

Suppliers who keep a copy

Your support desk, analytics tool and email provider may all hold customer information. If their contracts say nothing about confidentiality and deletion, your commitment stops at your own systems. Check each supplier that holds confidential data, put matching terms in its contract, and include it in the supplier reviews SOC 2 CC9.2 already asks for.

Treating confidentiality as only encryption

Encryption protects data at rest and in transit, but not from a user with too much access. Pair it with access restriction and review.

How Sted helps

Related guides and terms

• The SOC 2 hub: when to add Confidentiality to Security.
• SOC 2 privacy criteria: the category for personal information, and how the two overlap.
• SOC 2 security and the common criteria: CC6.5 and CC6.7, which Confidentiality builds on.
• Access reviews: checking who can reach confidential data.
• Supplier due diligence: confidentiality and deletion terms for suppliers who hold your customers’ data.
• Control: the controls you choose to meet each criterion.

Frequently asked questions