Confidentiality category
Confidentiality: know it, keep it, destroy it.
Confidentiality adds only two criteria, C1.1 and C1.2, but they reach across the whole life of the data. First you must know which information is confidential and keep it safe for as long as you should. Then you must get rid of it when that time is up.
Back to SOC 2 services01 · What counts
How information becomes “confidential”
Not by feeling. By a duty to limit who sees it, how long you keep it, and who you share it with.
The criteria treat information as confidential when whoever holds it is required to restrict its access, use, retention and disclosure. That duty has to come from somewhere you can point to.
- Customer contracts
- A confidentiality clause or data processing terms that name what you must protect.
- Non-disclosure agreements
- Partner and prospect material you agreed to hold in confidence.
- Laws and regulations
- Rules that restrict who may see certain records.
- Your own classification policy
- Labels you set for internal material such as source code, pricing or plans.
Confidential information can include personal data, but it also covers trade secrets, designs and business plans. That breadth is the main difference from Privacy.
02 · C1.1 and C1.2
The two Confidentiality criteria
One criterion for the life of the data, one for its end.
- C1.1Identify and maintainYou recognise confidential information when it arrives or is created, decide how long to keep it, and protect it from loss in the meantime. Example: a classification step at customer onboarding and a retention schedule.
- C1.2DisposeWhen the retention period ends, you find the information due for destruction and destroy it. Example: a scheduled deletion job plus a written deletion record at contract end.
The protection itself (access control, encryption, transmission) is tested through the common criteria, mainly CC6. C1 adds the parts security alone tends to miss: knowing what is confidential, keeping it as long as you should, and ending it on time.
03 · Lifecycle
Controls along the data's life
Each stage needs a control someone can sample.
| Stage | Illustrative control | What proves it ran |
|---|---|---|
| Arrives or is created | Data is tagged by type and owner at intake | Data inventory entries with dates |
| Stored and used | Access by role; production data kept out of test systems | Access lists, environment configuration |
| Shared | Disclosure only to parties allowed by contract | Subprocessor list, signed agreements |
| Retention ends | Data due for deletion is flagged automatically | Retention job output, ticket |
| Destroyed | Deletion across primary, replicas and backups as committed | Deletion log or customer confirmation |
04 · vs Privacy
Confidentiality and Privacy in two columns
Overlap on personal data; different questions.
Confidentiality
- Any information you must restrict
- Promises usually made to business customers
- Asks: is it protected and destroyed on time?
Privacy
- Personal information only
- Promises made to the individuals themselves
- Asks: notice, consent, access, correction, disclosure
Many B2B companies holding customer data choose Confidentiality and not Privacy, because their promises run to the customer, not to each person in the data.
05 · Evidence & mistakes
What the auditor checks, and where it slips
Deletion is the part teams forget to evidence.
- Classification policy. Approved, with categories that match the data you really hold.
- Data inventory. Where confidential data lives, including exports, analytics copies and backups.
- Retention schedule. How long each type is kept, and the contractual reason.
- Offboarding records. For customers who left during the period: what was deleted, and when.
- Media disposal. Wiping or destruction records for devices that held confidential data.
- Deleting the database, keeping the backups. Contracts often promise deletion everywhere; backups keep the data for their own retention.
- Copies outside the system. Spreadsheets, support tickets and exports that no retention job touches.
- A classification nobody applies. Four labels on paper and none in practice.
- No customer left during the period. Then there is nothing to sample; say so honestly rather than inventing a test.
- OverviewTrust Services CriteriaThe five categories, with CC1 to CC9 read as questions your controls answer.
- SecurityThe Security category, criterion by criterionCC1 to CC9 in plain words, with the evidence each invites.
- AvailabilityThe Availability categoryA1.1 to A1.3: capacity, protection and tested recovery.
- PrivacyThe Privacy categoryP1 to P8: notice, choice, collection, use, access, disclosure, quality, monitoring.
- Processing IntegrityThe Processing Integrity categoryPI1.1 to PI1.5: complete, valid, accurate and timely processing.
Sources: AICPA, TSP section 100, 2017 Trust Services Criteria (revised points of focus), confidentiality category definition and criteria C1.1 and C1.2. Examples are illustrative.
Questions about Confidentiality
We encrypt everything. Isn't that Confidentiality done?
It covers protection, not retention or disposal.
Encryption mostly answers the common criteria. C1.1 also wants you to know which data is confidential and how long to keep it, and C1.2 wants evidence that it is destroyed when that time ends.
Who decides what is confidential?
Your commitments and your own policy.
Contracts, NDAs and laws create the duty; your classification policy turns it into labels people use. The auditor tests against what you committed to, not a generic list.
Do we have to delete data the moment a contract ends?
You must follow what you committed to.
If your terms allow a wind-down period or backup expiry, say so in the contract and the system description. The control is then that deletion happens within the stated window, with a record.
Can we pick Confidentiality without Privacy?
Yes. They are separate categories.
Each category is chosen on its own. Confidentiality fits when your promises are to business customers about their data; Privacy fits promises to individuals.
Keep what you should, delete what you promised.
We build a data inventory and retention schedule your Confidentiality controls can stand on.