GCGood Company· Trust Centre
All systems operational

Good Company
Trust Centre

Good company is good so you also should feel good then everybody feels good that is a good thing happen only for good people during good times

Certifications

Independently audited

Click any certification to see scope, auditor and how to access the underlying report.

SOC2 POWERED BY SWISE

SOC2

Issued by Amaru

Good Certificate

AuditorAmaruScopeWebapp
Attachments

Controls

CC1 CONTROL ENVIRONMENT

  • ✓CC1.1 COSO Principle 1 (Integrity and Ethical Values)
  • ✓CC1.2 COSO Principle 2 (Board Oversight and Independence)
  • ✓CC1.4 COSO Principle 4 (Attracting, Developing, and Retaining Competent Individuals)
  • ✓CC1.3 COSO Principle 3 (Organizational Structure and Responsibilities)
  • ✓CC1.5 COSO Principle 5 (Accountability for Internal Control Responsibilities)
View 2 more CC1 CONTROL ENVIRONMENT controls

CC1 CONTROL ENVIRONMENT

  • ✓CC1.2 COSO Principle 2 (Board Oversight and Independence)
  • ✓CC1.3 COSO Principle 3 (Organizational Structure and Responsibilities)
  • ✓CC1.1 COSO Principle 1 (Integrity and Ethical Values)
  • ✓CC1.4 COSO Principle 4 (Attracting, Developing, and Retaining Competent Individuals)
  • ✓CC1.5 COSO Principle 5 (Accountability for Internal Control Responsibilities)
View 2 more CC1 CONTROL ENVIRONMENT controls

6 Planning (Mandatory Clause)

  • ✓6.1.2 Information security risk assessment: Actions to address risks and opportunities
  • ✓6.2 Information security objectives and planning to achieve them
  • ✓6.1.1 General - Actions to address risks and opportunities
  • ✓6.1.3 Information security risk treatment: Actions to address risks and opportunities
  • ✓6.3 Planning of changes
View 2 more 6 Planning (Mandatory Clause) controls

CC1 CONTROL ENVIRONMENT

  • ✓CC1.5 COSO Principle 5 (Accountability for Internal Control Responsibilities)
  • ✓CC1.1 COSO Principle 1 (Integrity and Ethical Values)
  • ✓CC1.3 COSO Principle 3 (Organizational Structure and Responsibilities)
  • ✓CC1.2 COSO Principle 2 (Board Oversight and Independence)
  • ✓CC1.4 COSO Principle 4 (Attracting, Developing, and Retaining Competent Individuals)
View 2 more CC1 CONTROL ENVIRONMENT controls

Organizational Context (GV.OC)

  • ✓Legal and Regulatory Cybersecurity Management
  • ✓Communication of Stakeholder Expectations
  • ✓Aligned Cybersecurity with Mission
  • ✓Organizational Dependency Understanding
  • ✓Stakeholder-Centric Cybersecurity Approach
View 2 more Organizational Context (GV.OC) controls

Organizational Context (GV.OC)

  • ✓Communication of Stakeholder Expectations
  • ✓Aligned Cybersecurity with Mission
  • ✓Stakeholder-Centric Cybersecurity Approach
  • ✓Organizational Dependency Understanding
  • ✓Legal and Regulatory Cybersecurity Management
View 2 more Organizational Context (GV.OC) controls

4 Context of the organization (Mandatory Clause)

  • ✓4.3 Determining the scope of the information security management system
  • ✓4.4 Information security management system
  • ✓4.2 Understanding the needs and expectations of interested parties
  • ✓4.1 Understanding the organization and its context
View 1 more 4 Context of the organization (Mandatory Clause) controls

CC2 COMMUNICATION AND INFORMATION

  • ✓CC2.3 COSO Principle 15 (External Communication)
  • ✓CC2.1 COSO Principle 13 (Relevant and Quality Information)
  • ✓CC2.2 COSO Principle 14 (Internal Communication of Information)

4 Context of the organization (Mandatory Clause)

  • ✓4.2 Understanding the needs and expectations of interested parties
  • ✓4.3 Determining the scope of the information security management system
  • ✓4.1 Understanding the organization and its context
  • ✓4.4 Information security management system
View 1 more 4 Context of the organization (Mandatory Clause) controls

Risk Management Strategy (GV.RM)

  • ✓Aligning Organizational Cybersecurity Objectives
  • ✓Communicating Risk Appetite and Tolerance
  • ✓Integrating Cybersecurity into Risk Processes
  • ✓Strategic Cybersecurity Response
  • ✓Communication for Cybersecurity Risks
  • ✓Standardize Cybersecurity Risk Prioritization
  • ✓Strategic Opportunities in Cybersecurity Discussions
View 4 more Risk Management Strategy (GV.RM) controls

CC2 COMMUNICATION AND INFORMATION

  • ✓CC2.3 COSO Principle 15 (External Communication)
  • ✓CC2.2 COSO Principle 14 (Internal Communication of Information)
  • ✓CC2.1 COSO Principle 13 (Relevant and Quality Information)

5 Leadership (Mandatory Clause)

  • ✓5.3 Organizational roles, responsibilities and authorities
  • ✓5.1 Leadership and commitment
  • ✓5.2 Policy

CC2 COMMUNICATION AND INFORMATION

  • ✓CC2.2 COSO Principle 14 (Internal Communication of Information)
  • ✓CC2.3 COSO Principle 15 (External Communication)
  • ✓CC2.1 COSO Principle 13 (Relevant and Quality Information)

Risk Management Strategy (GV.RM)

  • ✓Strategic Opportunities in Cybersecurity Discussions
  • ✓Standardize Cybersecurity Risk Prioritization
  • ✓Integrating Cybersecurity into Risk Processes
  • ✓Aligning Organizational Cybersecurity Objectives
  • ✓Communicating Risk Appetite and Tolerance
  • ✓Strategic Cybersecurity Response
  • ✓Communication for Cybersecurity Risks
View 4 more Risk Management Strategy (GV.RM) controls

Identity Management, Authentication, and Access Control (PR.AA)

  • ✓Proofing and Binding Identities to Credentials
  • ✓Management of Physical Asset Access
  • ✓User, Service, and Hardware Identities
  • ✓Identity Assertions Verification
  • ✓Management of Access Permissions
  • ✓Authentication of Users, Services, and Hardware
View 3 more Identity Management, Authentication, and Access Control (PR.AA) controls

C1 Additional Criteria for Confidentiality

  • ✓C1.1 Confidentiality of Information
  • ✓C1.2 Disposal of Confidential Information

C1 Additional Criteria for Confidentiality

  • ✓C1.1 Confidentiality of Information
  • ✓C1.2 Disposal of Confidential Information

C1 Additional Criteria for Confidentiality

  • ✓C1.1 Confidentiality of Information
  • ✓C1.2 Disposal of Confidential Information

5 Leadership (Mandatory Clause)

  • ✓5.1 Leadership and commitment
  • ✓5.2 Policy
  • ✓5.3 Organizational roles, responsibilities and authorities

6 Planning (Mandatory Clause)

  • ✓6.1.3 Information security risk treatment: Actions to address risks and opportunities
  • ✓6.2 Information security objectives and planning to achieve them
  • ✓6.1.1 General - Actions to address risks and opportunities
  • ✓6.1.2 Information security risk assessment: Actions to address risks and opportunities
  • ✓6.3 Planning of changes
View 2 more 6 Planning (Mandatory Clause) controls

Data Security (PR.DS)

  • ✓Protection of Data-in-Transit
  • ✓Protection of Data-at-Rest
  • ✓Protection of Data-in-Use
  • ✓Management and Testing of Data Backups
View 1 more Data Security (PR.DS) controls

Roles, Responsibilities, and Authorities (GV.RR)

  • ✓Ethical Cybersecurity Leadership
  • ✓Resources Aligned with Cybersecurity Strategy
  • ✓Enforcement of Cybersecurity Responsibilities
  • ✓Integration of Cybersecurity into HR Practices
View 1 more Roles, Responsibilities, and Authorities (GV.RR) controls

7 Support (Mandatory Clause)

  • ✓7.5.1 General - Documented information
  • ✓7.3 Awareness
  • ✓7.5.3 Control of documented information - Documented information
  • ✓7.1 Resources
  • ✓7.2 Competence
  • ✓7.4 Communication
  • ✓7.5.2 Creating and updating - Documented information
View 4 more 7 Support (Mandatory Clause) controls

Roles, Responsibilities, and Authorities (GV.RR)

  • ✓Ethical Cybersecurity Leadership
  • ✓Enforcement of Cybersecurity Responsibilities
  • ✓Resources Aligned with Cybersecurity Strategy
  • ✓Integration of Cybersecurity into HR Practices
View 1 more Roles, Responsibilities, and Authorities (GV.RR) controls

CC3 RISK ASSESSMENT

  • ✓CC3.2 COSO Principle 7 (Risk Identification and Assessment)
  • ✓CC3.1 COSO Principle 6 (Clearly Defined Objectives)
  • ✓CC3.3 COSO Principle 8 (Fraud Risk Assessment)
  • ✓CC3.4 COSO Principle 9 (Identification of Changes Impacting Internal Control)
View 1 more CC3 RISK ASSESSMENT controls

CC6 LOGICAL AND PHYSICAL ACCESS CONTROLS

  • ✓CC6.3 Access Authorization and Modification
  • ✓CC6.4 Physical Access Restriction
  • ✓CC6.2 User Registration and Deprovisioning
  • ✓CC6.1 Logical Access Security
  • ✓CC6.6 Logical Access Security Measures
  • ✓CC6.5 Decommissioning of Physical Assets
  • ✓CC6.7 Information Transmission, Movement, and Removal
  • ✓CC6.8 Malicious Software Prevention and Detection
View 5 more CC6 LOGICAL AND PHYSICAL ACCESS CONTROLS controls

7 Support (Mandatory Clause)

  • ✓7.1 Resources
  • ✓7.5.1 General - Documented information
  • ✓7.2 Competence
  • ✓7.4 Communication
  • ✓7.3 Awareness
  • ✓7.5.2 Creating and updating - Documented information
  • ✓7.5.3 Control of documented information - Documented information
View 4 more 7 Support (Mandatory Clause) controls

P4 Privacy Criteria Related to Use, Retention, and Disposal

  • ✓P4.1 Purpose-Bound Personal Information Usage
  • ✓P4.2 Privacy-Aligned Personal Information Retention
  • ✓P4.3 Privacy-Compliant Personal Information Disposal

P4 Privacy Criteria Related to Use, Retention, and Disposal

  • ✓P4.1 Purpose-Bound Personal Information Usage
  • ✓P4.2 Privacy-Aligned Personal Information Retention
  • ✓P4.3 Privacy-Compliant Personal Information Disposal

CC3 RISK ASSESSMENT

  • ✓CC3.2 COSO Principle 7 (Risk Identification and Assessment)
  • ✓CC3.1 COSO Principle 6 (Clearly Defined Objectives)
  • ✓CC3.3 COSO Principle 8 (Fraud Risk Assessment)
  • ✓CC3.4 COSO Principle 9 (Identification of Changes Impacting Internal Control)
View 1 more CC3 RISK ASSESSMENT controls

9 Performance evaluation (Mandatory Clause)

  • ✓9.2.2 Internal audit programme - Internal audit
  • ✓9.3.3 Management review results - Management review
  • ✓9.3.2 Management review inputs - Management review
  • ✓9.3.1 General - Management review
  • ✓9.1 Monitoring, measurement, analysis and evaluation
  • ✓9.2.1 General -Internal audit
View 3 more 9 Performance evaluation (Mandatory Clause) controls

Policy (GV.PO)

  • ✓Cybersecurity Risk Management Policy
  • ✓Enforcement of Cybersecurity Risk Policy

9 Performance evaluation (Mandatory Clause)

  • ✓9.3.3 Management review results - Management review
  • ✓9.1 Monitoring, measurement, analysis and evaluation
  • ✓9.3.1 General - Management review
  • ✓9.2.1 General -Internal audit
  • ✓9.2.2 Internal audit programme - Internal audit
  • ✓9.3.2 Management review inputs - Management review
View 3 more 9 Performance evaluation (Mandatory Clause) controls

CC3 RISK ASSESSMENT

  • ✓CC3.1 COSO Principle 6 (Clearly Defined Objectives)
  • ✓CC3.2 COSO Principle 7 (Risk Identification and Assessment)
  • ✓CC3.4 COSO Principle 9 (Identification of Changes Impacting Internal Control)
  • ✓CC3.3 COSO Principle 8 (Fraud Risk Assessment)
View 1 more CC3 RISK ASSESSMENT controls

Incident Response Reporting and Communication (RS.CO)

  • ✓Incident Notification to Stakeholders
  • ✓Sharing Information with Stakeholders

Incident Analysis (RS.AN)

  • ✓Integrity of Investigation Records
  • ✓Incident Analysis & Root Cause Establishment
  • ✓Estimation of Incident Magnitude
  • ✓Preservation of Incident Data
View 1 more Incident Analysis (RS.AN) controls

6 People Controls (Sec Control)

  • ✓6.1 Screening (Sec Control)
  • ✓6.6 Confidentiality or non-disclosure agreements (Sec Control)
  • ✓6.5 Responsibilities after termination or change of employment (Sec Control)
  • ✓6.8 Information security event reporting (Sec Control)
  • ✓6.4 Disciplinary process (Sec Control)
  • ✓6.2 Terms and conditions of employment (Sec Control)
  • ✓6.3 Information security awareness, education and training (Sec Control)
  • ✓6.7 Remote working (Sec Control)
View 5 more 6 People Controls (Sec Control) controls

CC4 MONITORING ACTIVITIES

  • ✓CC4.1 COSO Principle 16 (Evaluating Internal Control)
  • ✓CC4.2 COSO Principle 17 (Communicating Internal Control Deficiencies)

Risk Assessment (ID.RA)

  • ✓Identification of Vulnerabilities
  • ✓Prioritizing and Planning Risk Responses
  • ✓Assessment of Threat Impacts and Likelihoods
  • ✓Management of Changes and Exceptions
  • ✓Receipt of Cyber Threat Intelligence
  • ✓Identification of Internal and External Threats
  • ✓Inherent Risk and Prioritizing Responses
  • ✓Vulnerability Disclosure Response Processes
  • ✓Hardware and Software Integrity
  • ✓Assessment of Critical Suppliers
View 7 more Risk Assessment (ID.RA) controls

5 Organizational Controls (Sec Control)

  • ✓5.26 Response to information security incidents (Sec Control)
  • ✓5.29 Information security during disruption (Sec Control)
  • ✓5.2 Information security roles and responsibilities (Sec Control)
  • ✓5.8 Information security in project management (Sec Control)
  • ✓5.3 Segregation of duties (Sec Control)
  • ✓5.19 Information security in supplier relationships (Sec Control)
  • ✓5.1 Policies for information security - (Sec Control)
  • ✓5.33 Protection of records (Sec Control)
  • ✓5.10 Acceptable use of information and other associated assets (Sec Control)
  • ✓5.35 Independent review of information security (Sec Control)
  • ✓5.21 Managing information security in the ICT supply chain (Sec Control)
  • ✓5.22 Monitoring, review and change management of supplier services (Sec Control)
  • ✓5.37 Documented operating procedures (Sec Control)
  • ✓5.36 Compliance with policies, rules and standards for information security (Sec Control)
  • ✓5.14 Information transfer (Sec Control)
  • ✓5.23 Information security for use of cloud services (Sec Control)
  • ✓5.5 Contact with authorities (Sec Control)
  • ✓5.4 Management responsibilities (Sec Control)
  • ✓5.6 Contact with special interest groups (Sec Control)
  • ✓5.7 Threat intelligence (Sec Control)
  • ✓5.9 Inventory of information and other associated assets (Sec Control)
  • ✓5.13 Labelling of information (Sec Control)
  • ✓5.11 Return of assets (Sec Control)
  • ✓5.12 Classification of information (Sec Control)
  • ✓5.17 Authentication information (Sec Control)
  • ✓5.15 Access control (Sec Control)
  • ✓5.16 Identity management (Sec Control)
  • ✓5.18 Access rights (Sec Control)
  • ✓5.20 Addressing information security within supplier agreements (Sec Control)
  • ✓5.27 Learning from information security incidents (Sec Control)
  • ✓5.24 Information security incident management planning and preparation (Sec Control)
  • ✓5.25 Assessment and decision on information security events (Sec Control)
  • ✓5.28 Collection of evidence (Sec Control)
  • ✓5.30 ICT readiness for business continuity (Sec Control)
  • ✓5.31 Legal, statutory, regulatory and contractual requirements (Sec Control)
  • ✓5.32 Intellectual property rights (Sec Control)
  • ✓5.34 Privacy and protection of personal identifiable information (PII) (Sec Control)
View 34 more 5 Organizational Controls (Sec Control) controls

CC4 MONITORING ACTIVITIES

  • ✓CC4.2 COSO Principle 17 (Communicating Internal Control Deficiencies)
  • ✓CC4.1 COSO Principle 16 (Evaluating Internal Control)

CC4 MONITORING ACTIVITIES

  • ✓CC4.2 COSO Principle 17 (Communicating Internal Control Deficiencies)
  • ✓CC4.1 COSO Principle 16 (Evaluating Internal Control)

Oversight (GV.OV)

  • ✓Reviewing Cybersecurity Risk Strategy
  • ✓Cybersecurity Strategy for Organization Needs
  • ✓Evaluating Cybersecurity Risk Performance

CC5 CONTROL ACTIVITIES

  • ✓CC5.2 COSO Principle 11 (Technology-based Control Activities)
  • ✓CC5.1 COSO Principle 10 (Control Activities for Risk Mitigation)
  • ✓CC5.3 COSO Principle 12 (Policies and Procedures for Control Activities)

Policy (GV.PO)

  • ✓Cybersecurity Risk Management Policy
  • ✓Enforcement of Cybersecurity Risk Policy

5 Organizational Controls (Sec Control)

  • ✓5.2 Information security roles and responsibilities (Sec Control)
  • ✓5.35 Independent review of information security (Sec Control)
  • ✓5.14 Information transfer (Sec Control)
  • ✓5.23 Information security for use of cloud services (Sec Control)
  • ✓5.21 Managing information security in the ICT supply chain (Sec Control)
  • ✓5.26 Response to information security incidents (Sec Control)
  • ✓5.36 Compliance with policies, rules and standards for information security (Sec Control)
  • ✓5.19 Information security in supplier relationships (Sec Control)
  • ✓5.22 Monitoring, review and change management of supplier services (Sec Control)
  • ✓5.10 Acceptable use of information and other associated assets (Sec Control)
  • ✓5.29 Information security during disruption (Sec Control)
  • ✓5.33 Protection of records (Sec Control)
  • ✓5.37 Documented operating procedures (Sec Control)
  • ✓5.1 Policies for information security - (Sec Control)
  • ✓5.3 Segregation of duties (Sec Control)
  • ✓5.8 Information security in project management (Sec Control)
  • ✓5.5 Contact with authorities (Sec Control)
  • ✓5.4 Management responsibilities (Sec Control)
  • ✓5.6 Contact with special interest groups (Sec Control)
  • ✓5.7 Threat intelligence (Sec Control)
  • ✓5.9 Inventory of information and other associated assets (Sec Control)
  • ✓5.13 Labelling of information (Sec Control)
  • ✓5.11 Return of assets (Sec Control)
  • ✓5.12 Classification of information (Sec Control)
  • ✓5.17 Authentication information (Sec Control)
  • ✓5.15 Access control (Sec Control)
  • ✓5.16 Identity management (Sec Control)
  • ✓5.18 Access rights (Sec Control)
  • ✓5.20 Addressing information security within supplier agreements (Sec Control)
  • ✓5.27 Learning from information security incidents (Sec Control)
  • ✓5.24 Information security incident management planning and preparation (Sec Control)
  • ✓5.25 Assessment and decision on information security events (Sec Control)
  • ✓5.28 Collection of evidence (Sec Control)
  • ✓5.30 ICT readiness for business continuity (Sec Control)
  • ✓5.31 Legal, statutory, regulatory and contractual requirements (Sec Control)
  • ✓5.32 Intellectual property rights (Sec Control)
  • ✓5.34 Privacy and protection of personal identifiable information (PII) (Sec Control)
View 34 more 5 Organizational Controls (Sec Control) controls

6 People Controls (Sec Control)

  • ✓6.5 Responsibilities after termination or change of employment (Sec Control)
  • ✓6.8 Information security event reporting (Sec Control)
  • ✓6.6 Confidentiality or non-disclosure agreements (Sec Control)
  • ✓6.1 Screening (Sec Control)
  • ✓6.4 Disciplinary process (Sec Control)
  • ✓6.2 Terms and conditions of employment (Sec Control)
  • ✓6.3 Information security awareness, education and training (Sec Control)
  • ✓6.7 Remote working (Sec Control)
View 5 more 6 People Controls (Sec Control) controls

CC6 LOGICAL AND PHYSICAL ACCESS CONTROLS

  • ✓CC6.2 User Registration and Deprovisioning
  • ✓CC6.4 Physical Access Restriction
  • ✓CC6.3 Access Authorization and Modification
  • ✓CC6.6 Logical Access Security Measures
  • ✓CC6.1 Logical Access Security
  • ✓CC6.5 Decommissioning of Physical Assets
  • ✓CC6.7 Information Transmission, Movement, and Removal
  • ✓CC6.8 Malicious Software Prevention and Detection
View 5 more CC6 LOGICAL AND PHYSICAL ACCESS CONTROLS controls

CC6 LOGICAL AND PHYSICAL ACCESS CONTROLS

  • ✓CC6.4 Physical Access Restriction
  • ✓CC6.2 User Registration and Deprovisioning
  • ✓CC6.1 Logical Access Security
  • ✓CC6.3 Access Authorization and Modification
  • ✓CC6.6 Logical Access Security Measures
  • ✓CC6.5 Decommissioning of Physical Assets
  • ✓CC6.7 Information Transmission, Movement, and Removal
  • ✓CC6.8 Malicious Software Prevention and Detection
View 5 more CC6 LOGICAL AND PHYSICAL ACCESS CONTROLS controls

CC7 SYSTEM OPERATIONS

  • ✓CC7.2 Anomaly Detection and Analysis
  • ✓CC7.4 Incident Response
  • ✓CC7.1 Configuration and Vulnerability Monitoring
  • ✓CC7.3 Security Incident Evaluation
  • ✓CC7.5 Incident Recovery
View 2 more CC7 SYSTEM OPERATIONS controls

CC7 SYSTEM OPERATIONS

  • ✓CC7.2 Anomaly Detection and Analysis
  • ✓CC7.4 Incident Response
  • ✓CC7.1 Configuration and Vulnerability Monitoring
  • ✓CC7.3 Security Incident Evaluation
  • ✓CC7.5 Incident Recovery
View 2 more CC7 SYSTEM OPERATIONS controls

CC7 SYSTEM OPERATIONS

  • ✓CC7.2 Anomaly Detection and Analysis
  • ✓CC7.4 Incident Response
  • ✓CC7.1 Configuration and Vulnerability Monitoring
  • ✓CC7.3 Security Incident Evaluation
  • ✓CC7.5 Incident Recovery
View 2 more CC7 SYSTEM OPERATIONS controls

8 Operation (Mandatory Clause)

  • ✓8.1 Operational planning and control
  • ✓8.3 Information security risk treatment
  • ✓8.2 Information security risk assessment

Asset Management (ID.AM)

  • ✓Lifecycle Management of Systems and Assets
  • ✓Data and Metadata Inventory Management
  • ✓Organizational Software, Services, and Systems Management
  • ✓Supplier Services Inventory Management
  • ✓Network Communication and Data Flow Maintenance
  • ✓Organizational Hardware Inventory Management
  • ✓Asset Prioritization
View 4 more Asset Management (ID.AM) controls

8 Operation (Mandatory Clause)

  • ✓8.1 Operational planning and control
  • ✓8.2 Information security risk assessment
  • ✓8.3 Information security risk treatment

Identity Management, Authentication, and Access Control (PR.AA)

  • ✓Proofing and Binding Identities to Credentials
  • ✓User, Service, and Hardware Identities
  • ✓Identity Assertions Verification
  • ✓Management of Access Permissions
  • ✓Authentication of Users, Services, and Hardware
  • ✓Management of Physical Asset Access
View 3 more Identity Management, Authentication, and Access Control (PR.AA) controls

8 Technological controls (Sec Control)

  • ✓8.27 Secure system architecture and engineering principles (Sec Control)
  • ✓8.24 Use of cryptography (Sec Control)
  • ✓8.33 Test information (Sec Control)
  • ✓8.3 Information access restriction (Sec Control)
  • ✓8.17 Clock synchronization (Sec Control)
  • ✓8.14 Redundancy of information processing facilities (Sec Control)
  • ✓8.32 Change management (Sec Control)
  • ✓8.29 Security testing in development and acceptance (Sec Control)
  • ✓8.34 Protection of information systems during audit testing (Sec Control)
  • ✓8.16 Monitoring activities (Sec Control)
  • ✓8.1 User end point devices (Sec Control)
  • ✓8.6 Capacity management (Sec Control)
  • ✓8.15 Logging (Sec Control)
  • ✓8.23 Web filtering (Sec Control)
  • ✓8.19 Installation of software on operational systems (Sec Control)
  • ✓8.22 Segregation of networks (Sec Control)
  • ✓8.18 Use of privileged utility programs (Sec Control)
  • ✓8.2 Privileged access rights (Sec Control)
  • ✓8.11 Data masking (Sec Control)
  • ✓8.4 Access to source code (Sec Control)
  • ✓8.9 Configuration management (Sec Control)
  • ✓8.30 Outsourced development (Sec Control)
  • ✓8.31 Separation of development, test and production environments (Sec Control)
  • ✓8.7 Protection against malware (Sec Control)
  • ✓8.5 Secure authentication (Sec Control)
  • ✓8.10 Information deletion (Sec Control)
  • ✓8.28 Secure coding (Sec Control)
  • ✓8.13 Information backup (Sec Control)
  • ✓8.8 Management of technical vulnerabilities (Sec Control)
  • ✓8.20 Networks security (Sec Control)
  • ✓8.25 Secure development life cycle (Sec Control)
  • ✓8.26 Application security requirements (Sec Control)
  • ✓8.21 Security of network services (Sec Control)
  • ✓8.12 Data leakage prevention (Sec Control)
View 31 more 8 Technological controls (Sec Control) controls

Risk Assessment (ID.RA)

  • ✓Assessment of Threat Impacts and Likelihoods
  • ✓Management of Changes and Exceptions
  • ✓Identification of Internal and External Threats
  • ✓Inherent Risk and Prioritizing Responses
  • ✓Receipt of Cyber Threat Intelligence
  • ✓Identification of Vulnerabilities
  • ✓Prioritizing and Planning Risk Responses
  • ✓Vulnerability Disclosure Response Processes
  • ✓Hardware and Software Integrity
  • ✓Assessment of Critical Suppliers
View 7 more Risk Assessment (ID.RA) controls

Data Security (PR.DS)

  • ✓Protection of Data-in-Transit
  • ✓Protection of Data-at-Rest
  • ✓Protection of Data-in-Use
  • ✓Management and Testing of Data Backups
View 1 more Data Security (PR.DS) controls

A1 Additional Criteria for Availability

  • ✓A1.3 Disaster Recovery Testing
  • ✓A1.1 Capacity Management
  • ✓A1.2 Environmental and Operational Resilience

CC5 CONTROL ACTIVITIES

  • ✓CC5.1 COSO Principle 10 (Control Activities for Risk Mitigation)
  • ✓CC5.2 COSO Principle 11 (Technology-based Control Activities)
  • ✓CC5.3 COSO Principle 12 (Policies and Procedures for Control Activities)

CC5 CONTROL ACTIVITIES

  • ✓CC5.1 COSO Principle 10 (Control Activities for Risk Mitigation)
  • ✓CC5.2 COSO Principle 11 (Technology-based Control Activities)
  • ✓CC5.3 COSO Principle 12 (Policies and Procedures for Control Activities)

8 Technological controls (Sec Control)

  • ✓8.6 Capacity management (Sec Control)
  • ✓8.27 Secure system architecture and engineering principles (Sec Control)
  • ✓8.32 Change management (Sec Control)
  • ✓8.16 Monitoring activities (Sec Control)
  • ✓8.17 Clock synchronization (Sec Control)
  • ✓8.3 Information access restriction (Sec Control)
  • ✓8.29 Security testing in development and acceptance (Sec Control)
  • ✓8.34 Protection of information systems during audit testing (Sec Control)
  • ✓8.4 Access to source code (Sec Control)
  • ✓8.11 Data masking (Sec Control)
  • ✓8.33 Test information (Sec Control)
  • ✓8.14 Redundancy of information processing facilities (Sec Control)
  • ✓8.23 Web filtering (Sec Control)
  • ✓8.19 Installation of software on operational systems (Sec Control)
  • ✓8.22 Segregation of networks (Sec Control)
  • ✓8.24 Use of cryptography (Sec Control)
  • ✓8.2 Privileged access rights (Sec Control)
  • ✓8.9 Configuration management (Sec Control)
  • ✓8.30 Outsourced development (Sec Control)
  • ✓8.31 Separation of development, test and production environments (Sec Control)
  • ✓8.1 User end point devices (Sec Control)
  • ✓8.7 Protection against malware (Sec Control)
  • ✓8.18 Use of privileged utility programs (Sec Control)
  • ✓8.15 Logging (Sec Control)
  • ✓8.28 Secure coding (Sec Control)
  • ✓8.5 Secure authentication (Sec Control)
  • ✓8.10 Information deletion (Sec Control)
  • ✓8.8 Management of technical vulnerabilities (Sec Control)
  • ✓8.13 Information backup (Sec Control)
  • ✓8.20 Networks security (Sec Control)
  • ✓8.25 Secure development life cycle (Sec Control)
  • ✓8.26 Application security requirements (Sec Control)
  • ✓8.21 Security of network services (Sec Control)
  • ✓8.12 Data leakage prevention (Sec Control)
View 31 more 8 Technological controls (Sec Control) controls

P4 Privacy Criteria Related to Use, Retention, and Disposal

  • ✓P4.1 Purpose-Bound Personal Information Usage
  • ✓P4.2 Privacy-Aligned Personal Information Retention
  • ✓P4.3 Privacy-Compliant Personal Information Disposal

Incident Analysis (RS.AN)

  • ✓Integrity of Investigation Records
  • ✓Incident Analysis & Root Cause Establishment
  • ✓Estimation of Incident Magnitude
  • ✓Preservation of Incident Data
View 1 more Incident Analysis (RS.AN) controls

Oversight (GV.OV)

  • ✓Reviewing Cybersecurity Risk Strategy
  • ✓Cybersecurity Strategy for Organization Needs
  • ✓Evaluating Cybersecurity Risk Performance

A1 Additional Criteria for Availability

  • ✓A1.1 Capacity Management
  • ✓A1.3 Disaster Recovery Testing
  • ✓A1.2 Environmental and Operational Resilience

7 Physical Controls (Sec Control)

  • ✓7.12 Cabling security (Sec Control)
  • ✓7.10 Storage media (Sec Control)
  • ✓7.8 Equipment siting and protection (Sec Control)
  • ✓7.3 Securing offices, rooms and facilities (Sec Control)
  • ✓7.5 Protecting against physical and environmental threats (Sec Control)
  • ✓7.7 Clear desk and clear screen (Sec Control)
  • ✓7.2 Physical entry (Sec Control)
  • ✓7.4 Physical security monitoring (Sec Control)
  • ✓7.11 Supporting utilities (Sec Control)
  • ✓7.1 Physical security perimeters (Sec Control)
  • ✓7.13 Equipment maintenance (Sec Control)
  • ✓7.9 Security of assets off-premises (Sec Control)
  • ✓7.6 Working in secure areas (Sec Control)
  • ✓7.14 Secure disposal or re-use of equipment (Sec Control)
View 11 more 7 Physical Controls (Sec Control) controls

7 Physical Controls (Sec Control)

  • ✓7.11 Supporting utilities (Sec Control)
  • ✓7.10 Storage media (Sec Control)
  • ✓7.3 Securing offices, rooms and facilities (Sec Control)
  • ✓7.7 Clear desk and clear screen (Sec Control)
  • ✓7.12 Cabling security (Sec Control)
  • ✓7.4 Physical security monitoring (Sec Control)
  • ✓7.5 Protecting against physical and environmental threats (Sec Control)
  • ✓7.8 Equipment siting and protection (Sec Control)
  • ✓7.1 Physical security perimeters (Sec Control)
  • ✓7.2 Physical entry (Sec Control)
  • ✓7.13 Equipment maintenance (Sec Control)
  • ✓7.9 Security of assets off-premises (Sec Control)
  • ✓7.6 Working in secure areas (Sec Control)
  • ✓7.14 Secure disposal or re-use of equipment (Sec Control)
View 11 more 7 Physical Controls (Sec Control) controls

A1 Additional Criteria for Availability

  • ✓A1.1 Capacity Management
  • ✓A1.3 Disaster Recovery Testing
  • ✓A1.2 Environmental and Operational Resilience

CC9 RISK MITIGATION

  • ✓CC9.1 Business Continuity and Resilience
  • ✓CC9.2 Vendor and Partner Risk Management

10 Improvement (Mandatory Clause)

  • ✓10.2 Nonconformity and corrective action
  • ✓10.1 Continual improvement

Incident Recovery Communication (RC.CO)

  • ✓Communication of Recovery Progress
  • ✓Public Updates on Incident Recovery

Incident Recovery Communication (RC.CO)

  • ✓Public Updates on Incident Recovery
  • ✓Communication of Recovery Progress

CC9 RISK MITIGATION

  • ✓CC9.1 Business Continuity and Resilience
  • ✓CC9.2 Vendor and Partner Risk Management

10 Improvement (Mandatory Clause)

  • ✓10.2 Nonconformity and corrective action
  • ✓10.1 Continual improvement

CC9 RISK MITIGATION

  • ✓CC9.1 Business Continuity and Resilience
  • ✓CC9.2 Vendor and Partner Risk Management

P2 Privacy Criteria Related to Choice and Consent

  • ✓P2.1 Privacy Choices and Consent:

Asset Management (ID.AM)

  • ✓Organizational Software, Services, and Systems Management
  • ✓Network Communication and Data Flow Maintenance
  • ✓Data and Metadata Inventory Management
  • ✓Lifecycle Management of Systems and Assets
  • ✓Organizational Hardware Inventory Management
  • ✓Supplier Services Inventory Management
  • ✓Asset Prioritization
View 4 more Asset Management (ID.AM) controls

P2 Privacy Criteria Related to Choice and Consent

  • ✓P2.1 Privacy Choices and Consent:

Continuous Monitoring (DE.CM)

  • ✓Physical Environment Monitoring
  • ✓External Service Provider Monitoring
  • ✓Computing Hardware and Software Monitoring
  • ✓Personnel and Technology Event Monitoring
  • ✓Network Event Monitoring
View 2 more Continuous Monitoring (DE.CM) controls

P2 Privacy Criteria Related to Choice and Consent

  • ✓P2.1 Privacy Choices and Consent:

P1 Privacy Criteria Related to Notice and Communication of Objectives Related to Privacy

  • ✓P1.1 Privacy Notice

Cybersecurity Supply Chain Risk Management (GV.SC)

  • ✓Post-Agreement Cybersecurity Risk Management
  • ✓Supplier Prioritization
  • ✓Risk Planning for Third-Party Relationships
  • ✓Coordination of Cybersecurity Roles
  • ✓Cybersecurity Supply Chain Risk Management
  • ✓Integration of Supply Chain Risk Management
  • ✓Cybersecurity Risk Requirements in Supply Chain
  • ✓Supplier Risk Assessment and Response
  • ✓Inclusion of Third Parties in Incident Planning
  • ✓Supply Chain Security Practices
View 7 more Cybersecurity Supply Chain Risk Management (GV.SC) controls

P1 Privacy Criteria Related to Notice and Communication of Objectives Related to Privacy

  • ✓P1.1 Privacy Notice

P1 Privacy Criteria Related to Notice and Communication of Objectives Related to Privacy

  • ✓P1.1 Privacy Notice

Incident Response Reporting and Communication (RS.CO)

  • ✓Sharing Information with Stakeholders
  • ✓Incident Notification to Stakeholders

P5 Privacy Criteria Related to Access

  • ✓P5.1 Managed Data Subject Access to Personal Information
  • ✓P5.2 Managed Data Subject Access to Personal Information

Continuous Monitoring (DE.CM)

  • ✓Physical Environment Monitoring
  • ✓Personnel and Technology Event Monitoring
  • ✓External Service Provider Monitoring
  • ✓Network Event Monitoring
  • ✓Computing Hardware and Software Monitoring
View 2 more Continuous Monitoring (DE.CM) controls

P5 Privacy Criteria Related to Access

  • ✓P5.1 Managed Data Subject Access to Personal Information
  • ✓P5.2 Managed Data Subject Access to Personal Information

P5 Privacy Criteria Related to Access

  • ✓P5.1 Managed Data Subject Access to Personal Information
  • ✓P5.2 Managed Data Subject Access to Personal Information

Cybersecurity Supply Chain Risk Management (GV.SC)

  • ✓Inclusion of Third Parties in Incident Planning
  • ✓Coordination of Cybersecurity Roles
  • ✓Supplier Prioritization
  • ✓Cybersecurity Supply Chain Risk Management
  • ✓Risk Planning for Third-Party Relationships
  • ✓Cybersecurity Risk Requirements in Supply Chain
  • ✓Supplier Risk Assessment and Response
  • ✓Post-Agreement Cybersecurity Risk Management
  • ✓Integration of Supply Chain Risk Management
  • ✓Supply Chain Security Practices
View 7 more Cybersecurity Supply Chain Risk Management (GV.SC) controls

CC8 CHANGE MANAGEMENT

  • ✓CC8.1 Managing Changes

CC8 CHANGE MANAGEMENT

  • ✓CC8.1 Managing Changes

CC8 CHANGE MANAGEMENT

  • ✓CC8.1 Managing Changes

Incident Recovery Plan Execution (RC.RP)

  • ✓Recovery Actions Selection and Prioritization
  • ✓Post-Incident Operational Norms
  • ✓Incident Response Recovery Plan Execution
  • ✓Incident Recovery Documentation
  • ✓Verification of Restoration Asset Integrity
  • ✓Verification and Restoration of Assets
View 3 more Incident Recovery Plan Execution (RC.RP) controls

Incident Recovery Plan Execution (RC.RP)

  • ✓Recovery Actions Selection and Prioritization
  • ✓Incident Response Recovery Plan Execution
  • ✓Incident Recovery Documentation
  • ✓Verification of Restoration Asset Integrity
  • ✓Post-Incident Operational Norms
  • ✓Verification and Restoration of Assets
View 3 more Incident Recovery Plan Execution (RC.RP) controls

Incident Management (RS.MA)

  • ✓Incident Categorization and Prioritization
  • ✓Incident Escalation
  • ✓Incident Report Validation
  • ✓Incident Recovery Criteria Application
  • ✓Incident Response Coordination
View 2 more Incident Management (RS.MA) controls

PI1 Additonal Criteria for Processing Integrity

  • ✓PI1.5 Information Storage and Retention Controls
  • ✓PI1.4 System Output Controls
  • ✓PI1.1 Information Quality and Communication
  • ✓PI1.3 System Processing Controls
  • ✓PI1.2 System Input Controls
View 2 more PI1 Additonal Criteria for Processing Integrity controls

PI1 Additonal Criteria for Processing Integrity

  • ✓PI1.4 System Output Controls
  • ✓PI1.1 Information Quality and Communication
  • ✓PI1.5 Information Storage and Retention Controls
  • ✓PI1.2 System Input Controls
  • ✓PI1.3 System Processing Controls
View 2 more PI1 Additonal Criteria for Processing Integrity controls

PI1 Additonal Criteria for Processing Integrity

  • ✓PI1.4 System Output Controls
  • ✓PI1.1 Information Quality and Communication
  • ✓PI1.5 Information Storage and Retention Controls
  • ✓PI1.2 System Input Controls
  • ✓PI1.3 System Processing Controls
View 2 more PI1 Additonal Criteria for Processing Integrity controls

Incident Management (RS.MA)

  • ✓Incident Categorization and Prioritization
  • ✓Incident Escalation
  • ✓Incident Report Validation
  • ✓Incident Recovery Criteria Application
  • ✓Incident Response Coordination
View 2 more Incident Management (RS.MA) controls

Incident Mitigation (RS.MI)

  • ✓Incident Containment
  • ✓Incident Eradication

P3 Privacy Criteria Related to Collection

  • ✓P3.1 Aligned Personal Information Collection
  • ✓P3.2 Transparent Consent Management for Personal Information

Incident Mitigation (RS.MI)

  • ✓Incident Eradication
  • ✓Incident Containment

P3 Privacy Criteria Related to Collection

  • ✓P3.1 Aligned Personal Information Collection
  • ✓P3.2 Transparent Consent Management for Personal Information

P3 Privacy Criteria Related to Collection

  • ✓P3.1 Aligned Personal Information Collection
  • ✓P3.2 Transparent Consent Management for Personal Information

Improvement (ID.IM)

  • ✓Operational Processes
  • ✓Incident Response and Cybersecurity Plans
  • ✓Identifying Improvements from Evaluations
  • ✓Security Tests and Exercises
View 1 more Improvement (ID.IM) controls

Improvement (ID.IM)

  • ✓Incident Response and Cybersecurity Plans
  • ✓Operational Processes
  • ✓Identifying Improvements from Evaluations
  • ✓Security Tests and Exercises
View 1 more Improvement (ID.IM) controls

Awareness and Training (PR.AT)

  • ✓Providing Awareness and Training for Specialized Roles
  • ✓Providing Awareness and Training for General Tasks

Awareness and Training (PR.AT)

  • ✓Providing Awareness and Training for Specialized Roles
  • ✓Providing Awareness and Training for General Tasks

Platform Security (PR.PS)

  • ✓Generation and Availability of Log Records
  • ✓Maintenance of Software
  • ✓Unauthorized Software Prevention
  • ✓Configuration Management Practices
  • ✓Maintenance of Hardware
  • ✓Secure Software Development Integration
View 3 more Platform Security (PR.PS) controls

Platform Security (PR.PS)

  • ✓Generation and Availability of Log Records
  • ✓Unauthorized Software Prevention
  • ✓Maintenance of Software
  • ✓Configuration Management Practices
  • ✓Maintenance of Hardware
  • ✓Secure Software Development Integration
View 3 more Platform Security (PR.PS) controls

Technology Infrastructure Resilience (PR.IR)

  • ✓Network and Environment Protection
  • ✓Resource Capacity Maintenance
  • ✓Technology Asset Protection
  • ✓Resilience Mechanism Implementation
View 1 more Technology Infrastructure Resilience (PR.IR) controls

Technology Infrastructure Resilience (PR.IR)

  • ✓Network and Environment Protection
  • ✓Resource Capacity Maintenance
  • ✓Technology Asset Protection
  • ✓Resilience Mechanism Implementation
View 1 more Technology Infrastructure Resilience (PR.IR) controls

Adverse Event Analysis (DE.AE)

  • ✓Adverse Event Information Provision
  • ✓Cyber Threat Integration
  • ✓Incident Declaration
  • ✓Information Correlation
  • ✓Impact and Scope Understanding
  • ✓Potential Adverse Event Analysis
View 3 more Adverse Event Analysis (DE.AE) controls

Adverse Event Analysis (DE.AE)

  • ✓Potential Adverse Event Analysis
  • ✓Cyber Threat Integration
  • ✓Adverse Event Information Provision
  • ✓Impact and Scope Understanding
  • ✓Information Correlation
  • ✓Incident Declaration
View 3 more Adverse Event Analysis (DE.AE) controls
Compliance scope

Which products are covered?

Here you'll find which certifications apply to each Good Company product. Cells marked N/A are out of scope; In progress means an audit is currently underway.
ProductSOC 2
API✓
Webapp✓
Resources

Documents & reports

Public documents are downloadable directly. Sensitive reports are released via an access request — usually approved within one business day.

📄
Compliance
Screenshot 2026-01-16 at 3.31.png
47.0 KB 🔒 Request only
📄
Compliance
Screenshot 2026-03-04 at 1.31.png
3.9 KB 🌐 Public

Request access