Table of Contents

Reach SOC 2 Compliance in 6 Weeks or Less.

  /

  / ISO 27001 Background Checks: Annex A 6.1 Explained

ISO 27001 Background Checks: Annex A 6.1 Explained

Most ISO 27001 auditors will tell you the same thing: background checks are one of the most common controls organisations claim to have, and one of the most common controls that falls apart when you ask for evidence. The control itself, Annex A 6.1 (Screening), is short. The discipline of doing it properly across every hire, contractor, and supplier with sensitive access is anything but.

This guide walks through what Annex A 6.1 requires under the 2022 version of the standard, what changed from 2013, how to design a screening process that holds up under audit, and how to apply the control sensibly in small businesses, startups, and AI-first companies where the headcount is low but the data exposure is high.

Critical Role of Background Checks

What Are ISO 27001 Background Checks?

ISO 27001 background checks are pre-employment and ongoing verification activities used to confirm that anyone with access to an organisation’s information assets is who they claim to be, holds the qualifications they say they hold, and presents no known risk that the role would amplify.

The checks are not punitive. They are a control: a way to reduce the probability that a person granted access to sensitive systems turns out to be someone the organisation would never have hired had it asked the right questions up front.

What Does ISO 27001 Say About Background Checks?

The 2022 version of the standard places the requirement in Annex A 6.1, Screening, under the People Controls theme. The control text is brief and worth reading in full:

“Background verification checks on all candidates to become personnel should be carried out prior to joining the organisation and on an ongoing basis taking into consideration applicable laws, regulations and ethics, and be proportional to the business requirements, the classification of the information to be accessed and the perceived risks.”

Three phrases in that sentence carry most of the weight.

“All candidates to become personnel” is broader than employees alone.

“On an ongoing basis” means screening does not end at hire.

“Proportional” gives organisations room to scale checks to risk — and also takes that room away from anyone who wants to apply identical checks to everyone regardless of role.

Reach SOC 2 Compliance in 6 Weeks or Less

Schedule Your Free SOC 2 Assessment Today

ISO 27001:2022 Annex A 6.1 Screening Explained

The control sits in the People Controls section (A.6.1 through A.6.8), which addresses the human factor of information security across the employee lifecycle. Annex A 6.1 is specifically the pre-access gate. By the time a new hire or contractor touches a production system, the screening required for their role should already be complete and documented.

In practice, this means three things: there must be a written screening policy; the policy must be applied consistently; and evidence of completed checks must exist for every person in scope, not just senior or technical roles.

Who Needs to Comply with Annex A 6.1?

Any organisation pursuing or maintaining ISO 27001 certification needs to evaluate this control. It applies to full-time employees, part-time staff, fixed-term contractors, casual or temporary workers, and selected suppliers whose personnel will be granted access to information systems or facilities. Volunteers and interns are typically in scope as well if they handle anything classified above public.

A 6.1 is not a clause from the main body of the standard (clauses 4 through 10), which means organisations can technically exclude it through the Statement of Applicability if they can justify why it is not relevant. In practice, that justification is almost impossible to make for any organisation with employees or contractors handling customer or production data, and auditors are unlikely to accept it.

Insider Note: Auditors rarely challenge whether you do background checks — they challenge whether you can prove you did them consistently. The most common audit finding under A 6.1 is not a missing policy; it is a screening file with a check listed but no completion date, no result, and no evidence that the result was reviewed before access was granted.

Annex A 6.1 Background Checks

When Do Background Checks Need to Be Conducted?

The default is before access is granted. The standard refers to checks being completed prior to joining the organisation, but for ISO 27001 purposes the practical line is whether the person has access to in-scope systems. If you onboard someone administratively two weeks before they touch any sensitive data, that is fine. If you grant production access on day one, screening must be complete on day one.

Re-screening is also expected on an ongoing basis. This does not mean annual criminal record checks for every employee. Still, it does mean defining the events that trigger a fresh check: role changes that increase access, promotions into privileged positions, or significant changes in the regulatory environment.

 

Why Background Checks Matter for ISO 27001 Compliance

The control exists because access is the precondition for almost every information security failure. According to the Verizon 2024 Data Breach Investigations Report, 68% of breaches involved a non-malicious human element — and that figure excludes deliberate insider misuse, which is tracked separately. The people inside the perimeter are not the only risk, but they are the most consistent one.

What Impact Does Employee Access Have on Data Security?

A breach does not require a sophisticated attacker. It requires someone with credentials to do something they should not have been able to do, whether through error, manipulation, or intent. The narrower the gate at hiring, the smaller the population of people who can later become a problem. Background checks do not eliminate insider risk, but they raise the cost of getting a job in your organisation under false pretences, which is the entire point.

How Background Check Results Help You Manage Risk and Stay Compliant

Screening results feed directly into the risk management process required elsewhere in ISO 27001. A failed identity check or an undisclosed serious conviction relevant to the role is not just an HR matter — it is a risk decision the organisation must document. As part of any thorough ISO 27001 gap analysis, auditors will look for evidence that screening outcomes were considered, that decisions were defensible, and that the process did not quietly wave people through when results were inconvenient.

Reach SOC 2 Compliance in 6 Weeks or Less

Schedule Your Free SOC 2 Assessment Today

What Do ISO 27001 Background Checks Cover?

The standard does not prescribe a fixed list. It expects the organisation to define what is appropriate, document the rationale, and apply the checks consistently for roles at equivalent risk levels.

Key Verifications Included in Annex A 6.1 Screening

A defensible baseline for most roles typically includes verification of identity (a government-issued document such as a passport or driving licence), confirmation of right to work in the relevant jurisdiction, verification of claimed academic and professional qualifications, employment history covering the most recent years, and two independent references (one professional, one personal or character).

The CV should be reviewed against the verified record. Gaps and inconsistencies are not automatically disqualifying, but they should be explained, and the explanation should be on file. For roles with access to financial systems, payment data, or regulated information, a basic criminal record check is standard. In the UK, this is a Basic DBS check; equivalents exist in most jurisdictions.

Enhanced Vetting Under Annex A 6.1

Roles with significant privileged access, board-level visibility, or contact with vulnerable populations warrant deeper checks. Enhanced vetting can include credit checks (where lawful and relevant), sanctions and politically exposed persons (PEP) screening, open-source and social media review, and Standard or Enhanced DBS checks (or equivalent) where the role legally qualifies.

Enhanced vetting is not a default. It must be justified by the role and the information classification, and applied consistently to every person in that tier—not selectively.

Handling Incomplete Verifications

Not every check will produce a clean, complete result. References go unreturned. Old employers no longer exist. Qualifications are awarded by institutions that have since closed. The standard does not require perfection; it requires that gaps are identified, alternatives are attempted, and unresolved gaps are documented with a risk decision before access is granted. A screening file that says “reference not obtained, alternative reference accepted, approved by [name]” is fine. A screening file that simply leaves the field blank is not.

Pro Tip: Tier your roles before you design your checks.

Create three or four tiers based on the sensitivity of information accessed and the level of system privilege, define the mandatory and optional checks for each tier, and map every job description to a tier. This is the artefact auditors want to see — and it also stops well-meaning managers from quietly skipping checks on hires they happen to like.

How to Perform ISO 27001 Background Checks

The mechanics matter less than the consistency. Auditors are looking for a process, evidence the process was followed, and a way to demonstrate that exceptions were rare and approved.

Develop a Formal Screening Policy

The policy is the foundation. It should state the scope (who is covered), the tiers (what level of check applies to what role), the lawful basis for processing the data, the retention period for screening records, and the named owner of the process. It should reference applicable employment law, data protection law, and any sector-specific regulation.

Organisations that have identified gaps in their current documentation can benefit from engaging internal audit services to benchmark what they have against what the standard expects.

Stay Consistent Across All Roles

Two people hired into equivalent roles should go through equivalent checks. Inconsistency is the fastest route to both a discrimination complaint and an audit finding.

If a check is mandatory for the role, it is mandatory for everyone in that role — no exceptions for referrals, contractors brought in at short notice, or founders who think the rule doesn’t apply to them.

Run Regular Risk Assessments

Roles change, regulations change, and the threat landscape changes. Review the screening policy at least annually, and trigger an interim review when the organisation adds new categories of data, enters a new regulated market, or significantly changes its access model.

Prioritise Privacy and Data Protection

Background checks involve personal data, and in many jurisdictions, special category data such as criminal convictions. Under GDPR compliance frameworks — including the UK GDPR and the Data Protection Act 2018 — criminal offence data is governed by Article 10 and Schedule 1, and it requires a specific lawful basis, not just consent.

The Information Commissioner’s Office has been clear that consent is rarely the right basis in an employment context, because the power imbalance undermines the “freely given” requirement.

Candidates must be told in advance what will be checked, why, how long the data will be kept, and what their rights are.

Records should be retained only as long as necessary — typically the duration of employment plus a defined retention period — and unsuccessful candidates’ data should be deleted within six to twelve months unless a specific legal basis justifies longer.

Integrate Screening with Your HR Process

Screening should be a step in the standard hiring workflow, not a parallel exercise managed by IT or security in isolation. The HR system should record the tier, the checks required, the completion status, and the date access was approved. Where a third-party screening provider is used, the HR record should still capture the outcome — not just a reference to the vendor’s portal.

Communicate Background Check Requirements to Candidates

Candidates should know at the application stage that the role requires screening and what the screening involves. This avoids late-stage withdrawal of offers, gives candidates the opportunity to disclose anything that might come up, and helps establish the lawful basis for processing the data. Transparency here is not just good practice — it is a legal requirement in most jurisdictions.

Reach SOC 2 Compliance in 6 Weeks or Less

Schedule Your Free SOC 2 Assessment Today

Applicability to Small Businesses, Tech Startups, and AI Companies

Smaller organisations sometimes assume Annex A 6.1 is overkill at their scale. It is not. The control is proportionate by design, but it is still required — and small organisations often have weaker compensating controls, which makes screening more important rather than less.

ISO 27001 Background Checks for Small Businesses

For a 15-person professional services firm, a baseline tier covering identity, right to work, qualification verification, and two references is usually sufficient for non-privileged roles. Anyone with administrative access to client data, finance systems, or production environments should additionally undergo a Basic DBS check (or local equivalent) and a more detailed reference review. The key is proportionality — scaling checks to actual risk rather than defaulting to the same level for everyone or applying nothing at all.

ISO 27001 Background Checks for Tech Startups

Tech startups frequently grant production access broadly because the team is small and the work is fluid. This makes the privileged-access tier larger in proportion than at a larger firm. A pragmatic baseline is to treat every engineer with production access as a privileged hire and apply enhanced checks accordingly. Founders and senior hires should not be exempt — the control applies to everyone, and an unscreened founder is exactly the kind of finding that lingers in audit reports and becomes a case study in what not to do.

ISO 27001 Background Checks for AI Companies

AI companies face a specific variant of the problem. Training data and model weights can be the most valuable assets in the organisation, and the engineers, researchers, and annotators with access to them often work across model development, evaluation, and deployment in ways that blur the usual access boundaries.

Screening should account for the full range of people who can read training data, modify model code, or export weights — including contracted research partners and annotation vendors. Confidentiality and IP assignment terms in the contract are necessary but not sufficient; the screening control sits upstream of them.

Worth Knowing: Insider threat research

Insider threat research — including data summarised in Wikipedia's overview of insider threats and explored in depth by the Cybersecurity and Infrastructure Security Agency (CISA) — consistently finds that insider incidents are most damaging when the actor had been given elevated access without commensurate vetting. The cost of the check is trivial compared to the cost of the incident.

ISO 27001 Background Check Policy: What to Include

A screening policy does not need to be long. It needs to be specific, evidence-based, and consistently applied.

How to Write an Annex A 6.1 Screening Policy

A workable structure has seven sections.

  1. Purpose and scope state what the policy covers and who it applies to.
  2. Roles and responsibilities name the owner (typically the HR lead, with security sign-off).
  3. Tiers and checks define the screening levels and what each includes.
  4. Process describes the workflow from offer to access approval.
  5. Records and retention specify what is kept, where, and for how long.
  6. Legal basis and candidate rights set out the data protection position.
  7. Exceptions and approvals state who can authorise a deviation and how it must be recorded.

Key Considerations When Documenting Your Background Check Process

The policy should reference but not duplicate other documents: the data protection notice given to candidates, the supplier vetting policy, and the access control policy. It should name a review cadence — typically annual — and a trigger list for interim reviews.

It should be approved at the right level of seniority and stored where the auditor can find it without being asked twice. Being aware of the common pitfalls in ISO 27001 documentation at this stage will save significant remediation effort later.

Ownership of Annex A 6.1

The control is most often owned by the HR manager, with information security or compliance providing oversight. This works because HR holds the candidate relationship, the lawful basis, and the records — while security and compliance hold the tiering logic, the risk decisions, and the access approval.

Both functions should be visible in the policy, and neither should be able to approve access without the other’s input, where the role sits in an elevated tier.

 

What Changed from ISO 27001:2013 to ISO 27001:2022

In the 2013 version, screening sat at Annex A 7.1.1 within a 14-domain structure. The 2022 update consolidated the 114 controls of 2013 into 93 controls under four themes (Organisational, People, Physical, Technological), and screening moved to A 6.1 within the People theme.

The substantive requirement has not changed dramatically. The control text was tightened, the requirement for ongoing screening was made more explicit, and the proportionality language was strengthened.

Organisations certified under 2013 and transitioning to 2022 should expect their existing screening process to map across without major rework — but they should refresh the policy to reference the new control number and confirm that ongoing-screening triggers are explicitly documented rather than implied.

Reach SOC 2 Compliance in 6 Weeks or Less

Schedule Your Free SOC 2 Assessment Today

Related ISO 27001:2022 Controls Relevant to Background Checks

Screening does not stand alone. Several other Annex A controls connect to it directly, and understanding those relationships helps when mapping evidence across your ISMS documentation.

A 6.2 — Terms and Conditions of Employment

Employment contracts must state the information security responsibilities of the role. Screening confirms suitability for the role; the contract documents what the role then requires of the person filling it. Both need to exist, and both need to be in place before access is granted.

A 6.3 — Information Security Awareness, Education, and Training

Screening establishes a baseline of trust at hire. Training maintains and builds on it through the employment relationship. Both are required by the standard, and neither replaces the other — a well-screened employee who receives no security awareness training is still a risk.

A 6.6 — Confidentiality or Non-Disclosure Agreements

NDAs and confidentiality terms apply to everyone in scope of screening, including contractors and selected suppliers. The screening record and the signed NDA together evidence that the organisation has done what it can to protect information at the human layer.

A 5.15 — Access Control

Access control assumes the person being granted access has been vetted appropriately. Annex A 5.15 and A 6.1 are paired controls in practice: one defines who can have access, the other confirms the person is suitable to be that who.

An access control policy that grants privileged access without reference to screening status is incomplete regardless of how sophisticated the technical controls are.

Frequently Asked Questions: ISO 27001 Background Checks

Are Background Checks Mandatory for ISO 27001 Certification?

A 6.1 can technically be excluded through the Statement of Applicability, but in practice, it almost never is. Auditors will expect a documented justification for exclusion, and most organisations with employees handling in-scope data cannot make that justification credibly. Treat the control as mandatory unless you have a very specific and documented reason why it does not apply.

Every role with access to in-scope information or systems. The level of check varies with the risk tier, but the requirement to screen does not skip categories of staff. There is no carve-out for short-term contractors, interns, or senior leadership — if anything, those groups often warrant closer attention.

There is no fixed interval mandated by the standard. The control requires ongoing screening, but this can be event-driven — role changes, promotions to privileged access, changes in regulatory requirements — rather than purely time-driven.

Some organisations re-verify identity and right to work annually; others rely on defined trigger events. Either approach is acceptable provided it is documented and applied consistently.

Yes, for any contractor or third-party personnel granted access to in-scope information or systems. The depth of the check can be delegated to the supplier under contract, but the obligation to confirm that screening was completed sits with the certified organisation. “Our supplier handles that” is not sufficient without evidence that the supplier actually did it.

Maintain a screening register that records, for each person in scope: the role tier, the checks required, the date each check was completed, the outcome, the name of the reviewer, and the date access was approved.

The underlying evidence — signed reference letters, DBS certificates, qualification verifications — should be stored securely with appropriate access controls and retention rules applied.

Adverse findings should never trigger automatic disqualification. The standard, and the Rehabilitation of Offenders Act 1974 in the UK along with comparable laws elsewhere, requires that adverse information is assessed for relevance to the role. A historical conviction unrelated to the responsibilities of the position is rarely a basis for refusal. A pattern of dishonesty in a role with financial access is a different matter. The decision, the reasoning, and the approval should all be documented.

Important: Blanket policies that exclude all candidates with any adverse finding are unlawful in most jurisdictions and are an audit finding waiting to happen. The control requires a defensible, individual assessment — not a blanket filter.

Closing Note

Annex A 6.1 is a short control that asks something straightforward: confirm the people you are about to trust are people worth trusting, document what you checked, and keep doing it as roles and risks change.

The organisations that pass this control cleanly are not the ones with the most exhaustive checks. They are the ones who decided what proportionate means for them, wrote it down, and applied it the same way to every hire.

Axipro Author

Picture of Pedro Dias

Pedro Dias

Pedro has been writing online for over 10 years. With experience in all things programming, cyber security, and compliance, he is our editor-in-chief at Axipro.

Blog Highlights

Explore More Articles

Researchers who buy second-hand drives off online marketplaces keep finding the same thing: live data.  A widely cited study by Blancco Technology Group found that 42% of used drives sold on eBay still held recoverable information, including financial records and personal data the previous owners assumed was long gone. The drives were not hacked; they were thrown away by organizations that treated deleting a file as the same thing as destroying it. Secure data disposal is where many compliance programs fail. ISO 27001, SOC 2, and GDPR all demand it, but they describe it in different languages, enforce it through different mechanisms, and punish failure in very different ways.  This article sets out what each framework requires, where the requirements overlap, and how to run a single disposal program that satisfies all three at once. Why Secure Data Disposal Matters Across Compliance Frameworks Disposal is the last link in the data lifecycle, and the easiest one to skip. An organization can run flawless access controls, encryption, and monitoring for years and still cause a reportable breach the moment one unwiped laptop leaves the building. A recoverable drive in a recycling skip is functionally identical to an open database on the internet, and auditors and regulators know it. Most disposal failures are unforced errors: a control that was already written into policy but never carried through to the actual hardware. The gap between having a disposal policy and proving this specific drive was destroyed is exactly where audits and breach investigations live. Defining Secure Data Disposal: Key Terms and Concepts What Is Secure Data Disposal? Secure data disposal is the end-to-end process of removing data and the equipment that holds it from active use, in a way that prevents its recovery. It covers the full lifecycle end: deletion of data while a system is still live, sanitisation of media that will be reused, physical destruction of media that will not, and the safe handling of equipment that is recycled, returned to a lessor, or sold. Disposal is the goal. The methods are how you get there. What Is Secure Data Destruction? Secure data destruction is the subset of disposal that renders media permanently unusable or its contents mathematically irretrievable. Shredding a drive, pulverising it, incinerating it, or destroying the encryption keys that make an encrypted disk readable are all forms of destruction. Destruction is one route to disposal, and it is the right route when the data is highly sensitive, or the media will never be reused. Secure Data Disposal vs. Secure Data Destruction: What Is the Difference? The distinction matters more than it looks. Disposal is the outcome you owe to every framework: data gone, unrecoverable, equipment handled appropriately. Destruction is just one of the methods. You can dispose of data without destroying the hardware by sanitising a drive thoroughly enough to reuse it. Confusing the two leads to two classic mistakes: destroying assets that could have been securely wiped and reused, and assuming a quick deletion counts as disposal when it does not. Important: Emptying the recycle bin, formatting a drive, or hitting delete does not dispose of data under any of these frameworks. Standard deletion only removes the pointer to the data; the bits remain until they are overwritten. Every framework discussed here expects the data to be unrecoverable, which is a far higher bar than not visible. What ISO 27001 Requires for Secure Data Disposal ISO/IEC 27001 handles disposal through a small cluster of Annex A controls that auditors read as a single process rather than in isolation. The two controls that do most of the work are 7.14 and 8.10. For a deeper look at how these controls fit into a broader compliance program, see our ISO 27001 implementation guide. ISO 27001 Annex A 7.14: Secure Disposal or Re-Use of Equipment Annex A 7.14 is a physical control. Before any equipment is disposed of or reused, the organisation must check whether it holds information assets or licensed software and ensure those are permanently erased or the media physically destroyed. It applies to servers, laptops, desktops, mobile devices, printers, network gear, and any storage media: if it ever processed information, it is in scope. The control replaces the older 2013 clause 11.2.7 and adds explicit expectations around removing identifying markings and handling end-of-occupancy scenarios. ISO 27001 Control 8.10: Information Deletion Annex A 8.10 is a technological control, and it focuses on the data rather than the box. It requires information stored in systems, devices, or media to be deleted when it is no longer required, and rendered unrecoverable. The cleanest way to keep these straight: 8.10 governs the data while it is in use or reaches its retention limit; 7.14 governs the hardware at end of life. Most retention-driven deletion sits under 8.10; most decommissioning sits under 7.14. ISO 27001 Control 8.12: Data Leakage Prevention and Its Role in Disposal Control 8.12 is rarely filed under disposal, but improperly discarded media is one of the oldest data leakage channels there is. A drive that leaves your control with recoverable data on it is a leak, regardless of how it left. Treating disposal as part of your leakage prevention posture forces the right question at the right time: what could walk out the door on this device, and has it actually been removed? Physical Destruction and Irretrievable Erasure Under ISO 27001 ISO 27001 offers two broad routes: physically destroy media that holds information, or erase and overwrite it so retrieval by a malicious party is precluded. The standard cross-references ISO/IEC 27040 for detailed sanitisation methods. The unifying requirement is that recovery should be impractical, not merely inconvenient. Deletion alone never satisfies this. Overwriting, Full-Disk Encryption, and Other Approved Methods Overwriting user-accessible storage with multiple passes is acceptable for many sensitivity levels. Full-disk encryption changes the economics of disposal entirely: if a device is encrypted from day one and the keys are properly managed, secure disposal can be as simple as destroying the keys, a technique known as

A business continuity plan that has never been tested is, to a SOC 2 auditor, a document and nothing more. The Availability criteria do not award credit for a polished plan sitting in a shared drive. They ask for evidence that you ran the plan, watched it work or fail, recorded what happened, and fixed what broke. That gap — between having a plan and proving it works — is where most availability findings originate. Business continuity plan testing for SOC 2 is the exercise that turns your plan into auditable evidence. It maps directly to Availability criterion A1.3, one of the few SOC 2 controls that explicitly requires you to test something rather than merely document it. This guide covers what counts as a valid test, the test types auditors accept, a step-by-step process, the exact evidence you need, and the mistakes that turn a routine review into a finding. What Is Business Continuity Plan Testing in the Context of SOC 2? Business continuity plan (BCP) testing is the structured validation of whether your organization can keep critical operations running — and restore them within defined targets — during a disruption. In a SOC 2 context, the testing is not freeform. It must produce dated, traceable evidence that the recovery procedures in your plan actually work, that the people involved know their roles, and that systems and data come back within your stated recovery objectives.   Why SOC 2 Requires Business Continuity Plan Testing SOC 2 is an attestation against the AICPA’s Trust Services Criteria, and the Availability category exists specifically for organizations that make uptime or resilience commitments to customers. A plan you never exercise cannot demonstrate operating effectiveness over the audit period — which is the entire point of a Type 2 examination. Testing is the control that converts a static plan into a recurring, observable activity an auditor can sample. SOC 2 Trust Services Criteria and BCP Testing Requirements Availability is one of the five Trust Services Criteria, and it is optional, included only when your service commitments warrant it. When in scope, it is built around three sub-criteria: A1.1 addresses capacity management. A1.2 addresses recovery infrastructure and backup processes. A1.3 addresses the testing of recovery procedures. BCP testing lives squarely in A1.3, with A1.2 supplying the backups and infrastructure that the test validates. Availability Criteria A1.2 and A1.3 Explained Per the AICPA’s Trust Services Criteria, A1.2 requires the entity to design, implement, operate, and monitor environmental protections, recovery infrastructure, and data backup processes that meet its availability objectives. In plain terms: you need real backups, stored away from production, with recovery infrastructure ready to use. A1.3 then requires the entity to test recovery plan procedures supporting system recovery to meet its objectives. The two work as a pair: A1.2 builds the capability, A1.3 proves it functions. Important: The most common A1.3 gap is not a missing test. It is a test that never validated the recovery objectives. Teams run a tabletop, write “no issues found,” and move on — but the plan claims a 4-hour RTO that no one ever measured against an actual restore. If your plan states recovery targets, your test evidence must show whether you met them. A test that does not measure against your RTO and RPO leaves the most important question unanswered.   What Auditors Look for During a BCP Test Review Auditors want proof that the test happened, proof that it was meaningful, and proof that it led somewhere. Concretely, that means a test plan with a defined scenario, a dated record of execution with participants, results measured against your recovery objectives, a list of gaps or issues found, and evidence that those issues were remediated. A test that finds nothing and changes nothing is treated with suspicion — because real tests almost always surface something.   Types of Business Continuity Plan Tests Accepted for SOC 2 SOC 2 does not mandate a specific test type. It expects the rigor of the test to match the criticality of what you are protecting. The four common approaches sit on a spectrum from low-effort, low-disruption to high-effort, high-assurance. Tabletop Exercises A tabletop exercise is a facilitated discussion where key personnel talk through a disruption scenario and their responses. It is cheap, fast, and excellent for confirming that people understand their roles and that the plan reads coherently. Its limit is obvious: nobody actually recovers anything. For many organizations a tabletop is a legitimate annual test, especially in the first audit cycle, but auditors expect more rigor as a program matures. Walkthrough and Simulation Tests A simulation applies a specific scenario and asks the team to perform recovery actions, not just describe them. It is more involved than a tabletop and far better at exposing the gaps that only appear when people touch the tools. Simulations are where teams discover that a runbook references a system that was decommissioned, or that the on-call engineer lacks the access the plan assumes. Full Interruption Tests A full interruption test shuts down primary systems and shifts operations entirely to the recovery environment. It is the most comprehensive validation available and the only one that proves your failover genuinely works end to end. It also carries real operational risk, so it demands thorough planning and is usually reserved for mature programs and the most critical systems. Parallel Testing Parallel testing activates recovery systems alongside production without taking the primary offline, then compares the two to confirm the recovery environment performs as expected. It delivers much of the assurance of a full interruption test while sparing the business the disruption. For most SaaS and cloud-hosted services, parallel testing of failover and restore is the sweet spot between confidence and risk. How to Test Your Business Continuity Plan for SOC 2 Compliance The sequence below aligns with the contingency planning process in NIST’s Contingency Planning Guide, SP 800-34, which auditors widely treat as authoritative for resilience practices. Each step produces an artifact, and the artifacts together form

A SOC 2 auditor will not ask whether you have an incident reporting policy. They will ask you to pull a specific incident from the last twelve months and walk them through it: when it was detected, who classified it, when it was escalated, who was notified, and how it was closed. The policy is the easy part. The part that fails audits is the gap between what the document says and what the timestamps actually show. Incident reporting sits at the center of the SOC 2 System Operations criteria, and it is one of the most frequently exception-flagged areas in Type 2 reports. The reason is consistent: teams treat reporting as paperwork generated after the fire is out, rather than as a controlled process that produces evidence at every step. This guide breaks down how to build a reporting process that an auditor can test, sample, and sign off on without a finding. What Is the Incident Reporting Process in SOC 2? The incident reporting process is the documented, repeatable sequence your organization follows from the moment a security event is detected to the moment the incident is formally closed and archived. It governs how events are logged, classified, escalated, communicated, and recorded. Reporting is not a single notification email. It is the connective tissue that links detection, response, and post-incident review into an auditable chain. How SOC 2 Defines a Security Incident SOC 2 does not hand you a rigid statutory definition. It works through the AICPA’s Trust Services Criteria, which frame an incident around a failure, or potential failure, of the system to meet the organization’s service commitments and security objectives. In practice, a security incident is any event that compromises, or could compromise, the confidentiality, integrity, or availability of systems or data. The criteria expect you to define this threshold yourself and apply it consistently, which is precisely what auditors test against. What Qualifies as a Reportable Security Incident Under SOC 2? An event becomes reportable when it crosses the threshold your own policy sets. The distinction matters. A blocked phishing email is a security event. A user who clicked the link and entered credentials is a reportable incident. SOC 2 rewards organizations that draw this line explicitly, because a clear definition is what makes consistent triage possible. Vague language like “significant events will be reported” invites the auditor to ask who decides what counts as significant, and on what basis. Examples of Security Incidents Relevant to SOC 2 Common reportable incidents include unauthorized access to production systems, credential compromise, malware or ransomware infection, data exfiltration or accidental disclosure, denial-of-service events affecting availability, lost or stolen devices holding company data, and misconfigurations that expose data to the public. Vendor and subprocessor breaches that touch your data belong on this list, too, since the criteria extend your responsibility into the supply chain. How Incident Severity Levels Are Established and Classified Severity classification drives everything downstream: how fast you respond, who gets pulled in, and which notification clocks start ticking. Most mature programs use a tiered scheme tied to business impact rather than technical noise. The point is not the labels you choose but the fact that the labels map to defined response times and escalation paths, and that the mapping is documented before an incident occurs, not invented during one. Auditors quietly judge your maturity by how few P1s you declare and how consistently you apply the tiers. A program that labels everything critical looks panicked; one that never escalates looks asleep. The strongest signal is a severity matrix with response-time SLAs next to each tier, and ticket history showing the tiers were actually applied as written. SOC 2 Incident Reporting Requirements There is no single “incident reporting requirement” in SOC 2. The obligation is distributed across several Common Criteria, and the auditor assembles a picture from all of them. Understanding which criteria govern reporting tells you exactly what evidence to keep. Which SOC 2 Trust Services Criteria Govern Incident Reporting? Incident reporting lives mainly in the CC7 (System Operations) series. CC7.2 covers monitoring system components to detect anomalies that may signal an incident. CC7.3 requires you to evaluate detected events to determine whether they are incidents and to take action. CC7.4 governs the response itself, including containment, eradication, and communication. CC7.5 addresses recovery and remediation. Communication obligations also reach into CC2.2 and CC2.3, which deal with internal and external information flow, and third-party incidents implicate CC9.2 on vendor risk. These are points of focus, not a checklist, but auditors use them to frame their testing. For a deeper look at how these criteria map to your broader compliance program, see our SOC 2 compliance guide. What Evidence Do Auditors Expect From Your Incident Reporting Process? Auditors want artifacts with time references, not assertions. That means incident tickets showing detection and closure timestamps, severity classifications with the name of who assigned them, escalation records, communication logs, and post-incident review notes. In a Type 2 examination they will trace one real incident end to end. Evidence pulled from a staging environment, or any artifact with no clear date, gets challenged immediately. Who Is Responsible for Reporting Security Incidents? Everyone reports; a defined role decides. SOC 2 expects that all staff know how to raise a suspected incident, and that a named function, often a security lead or incident commander, owns the determination of severity and the decision to escalate. The auditor will look for evidence that this ownership is real: a RACI chart is fine, but ticket history showing the right person actually classified and closed incidents is better. Step-by-Step SOC 2 Incident Reporting Process The following sequence maps cleanly to the lifecycle in NIST’s Computer Security Incident Handling Guide (SP 800-61), which auditors widely recognize as authoritative. NIST withdrew Revision 2 in April 2025 and released Revision 3, which reorganizes the lifecycle around the six functions of the Cybersecurity Framework 2.0. The underlying steps below remain the same; the framing simply shifts toward continuous risk management.