# SOC 2 policy list for small teams

> **Review with counsel before use.** This is a planning list, not a set of policies and not legal or audit advice. The AICPA publishes the Trust Services Criteria, not a required policy list, and your auditor tests the controls you describe. Confirm the set with your auditor.
>
> List from AccuSights, https://accusights.com/templates. The criteria groups (CC1 to CC9) are from the AICPA 2017 Trust Services Criteria with the 2022 revised points of focus.

---

Every policy below should be approved by leadership, reviewed at least once a year, and acknowledged by staff at hire and yearly. Keep the approval record and the acknowledgments: they are the evidence.

## The core set most small companies need

| Policy | What it covers | Criteria | Owner | Approved | Next review |
|---|---|---|---|---|---|
| Information security policy | Direction, roles, the commitment from leadership | CC1, CC2, CC5 | | | |
| Acceptable use policy | What staff may do with company systems and data | CC1, CC5 | | | |
| Access control policy | Granting, reviewing and removing access; MFA; least privilege | CC6 | | | |
| Change management policy | Code and infrastructure changes reviewed before production | CC8 | | | |
| Incident response policy and plan | Detecting, escalating, handling and learning from incidents | CC7 | | | |
| Vendor management policy | Reviewing critical vendors and keeping their SOC reports on file | CC9 | | | |
| Data classification and retention policy | What data you hold, who may see it, how long you keep it, how it is destroyed | CC6, C1 | | | |
| Business continuity and disaster recovery policy | Keeping the service running and restoring it, with tests | CC9, A1 | | | |

## Often added, depending on scope and auditor

| Policy | What it covers | Criteria | Owner | Approved | Next review |
|---|---|---|---|---|---|
| Risk assessment policy | How risks are identified, scored, treated and reviewed | CC3 | | | |
| Code of conduct | Integrity and ethical values, and how to report concerns | CC1 | | | |
| Security awareness training policy | Training at hire and yearly, with completion records | CC1, CC2 | | | |
| Encryption policy | Data at rest and in transit, key management | CC6 | | | |
| Vulnerability management policy | Scanning schedule and fix timelines by severity | CC7 | | | |
| Logging and monitoring policy | What is logged, how long it is kept, who reviews alerts | CC7 | | | |
| Physical security policy | Office access, or reliance on your data center provider's report | CC6 | | | |
| Backup policy | What is backed up, how often, and restore tests | A1 | | | |
| Privacy policy and notice | Consent, access and deletion requests, sharing with vendors | P series | | | |

C1, A1 and P apply only when Confidentiality, Availability or Privacy is in your report's scope.

## Evidence to keep for each policy

- [ ] The approved version, with the approver and date
- [ ] Past versions
- [ ] Staff acknowledgments at hire and yearly
- [ ] A review record each year, even when nothing changed

The full control list is in the SOC 2 compliance checklist: https://accusights.com/guides/soc-2/checklist