In-Depth Guide
The Situation
A team starts SOC 2 and is handed a generic list of requirements.
Where Teams Get Stuck
Generic lists do not say what a requirement means for your cloud setup, identity provider and code repositories.
How RAMP Handles It
RAMP restates each requirement in plain English for your stack, and classifies controls as automated, operational or hybrid with an owner and a frequency.
Three control types
Automated controls come from your infrastructure, operational controls cover business and personnel practice, and hybrid controls combine a workflow with human approval.
Owners and frequencies
Every control needs an owner, a frequency and a defined piece of evidence.
Frequently asked questions
- What is a hybrid control?
- A control where a system workflow and a person both take part, such as a code review enforced by repository settings.
Leadership Action Item
Settle the control list before collecting evidence. Next: Test of Design.
Related GuidesView all guides →