SOC 2 controls map

Last updated Jun 14, 2026

This page is the authoritative map between Matter's SOC 2 control universe and the artefacts that demonstrate each control is designed, implemented, and operating. Every row carries (a) a control description, (b) one or more evidence pointers into the repo, (c) the owner, and (d) the last review date. Auditors traverse this map at evidence-collection time.

The same control universe is reused for ISO 27001 (see ISO 27001 control map). Shared rows link to the same artefacts to keep the evidence pool unified.

Drift between this page and the repo is detected by the contract test at apps/api/__contracts__/soc2-evidence-coverage.test.ts. Adding a row here without an existing evidence target fails CI.

Trust Services Categories in scope

• CC — Common Criteria. Required for every SOC 2 audit.
• A — Availability. Required.
• PI — Processing Integrity. Required.
• C — Confidentiality. Required.
• P — Privacy. Added from Type II year onward.

Common Criteria — CC1 Control Environment

Common Criteria — CC2 Communication and Information

Common Criteria — CC3 Risk Assessment

Common Criteria — CC4 Monitoring Activities

Common Criteria — CC5 Control Activities

Common Criteria — CC6 Logical and Physical Access Controls

Common Criteria — CC7 System Operations

Common Criteria — CC8 Change Management

Common Criteria — CC9 Risk Mitigation

Availability — A1

Processing Integrity — PI1

Confidentiality — C1

Privacy — P1 (added Type II year)

Review cadence

• Quarterly — CISO walks the table, verifies each evidence pointer still resolves, refreshes the last-review date.
• Pre-audit — full re-validation of every row before fieldwork starts.
• Post-incident — any row whose evidence pointer was touched during incident response gets an extra review pass.

See also

• ISO 27001 control map — shared controls with this page.
• Certification roadmap — target windows and audit cadence.
• Compliance readiness — single-page status snapshot.
• Bug bounty policy — public-facing reporting channel.
• Vulnerability disclosure — coordinated-disclosure protocol.
• Pentest template — annual external + quarterly internal scope.