Confidentiality is one of the five SOC 2 Trust Services Criteria, and it is also the most misunderstood. Many teams assume it means keeping customer data safe in general, when it actually has a much narrower definition.
Confidentiality applies to information your company has specifically committed, through a contract, NDA or written policy, to protect from unauthorized disclosure. This usually includes trade secrets, pricing models, product roadmaps, customer data that a contract labels confidential, partner information shared under NDA, and system configuration details.
The line most companies get wrong is Confidentiality versus Privacy. Privacy covers personal information tied to an individual. Confidentiality covers business or third-party information you have agreed to protect. Mixing the two can cost weeks of misdirected audit preparation.
When testing this criterion, auditors look at data classification, access restriction and reviews, encryption at rest and in transit, retention and secure disposal, and controls over third-party disclosure. In a SOC 2 Type 2 audit, they sample real instances across the audit period and ask for evidence that each control was followed.
Read the full guide here:
https://accorppartners.com/blogs/soc-2/soc-2-confidentiality-criteria-what-counts-as-confidential-data-and-what-doesnt
Top comments (0)