The Confidentiality criterion
The Confidentiality criterion requires an organization to protect information designated as confidential based on agreements with external parties or internal policies. It focuses on ensuring that sensitive data is protected from unauthorized disclosure throughout its entire lifecycle.
What it means
While the Security criterion protects against general unauthorized access, Confidentiality specifically targets the protection of data identified as "confidential." This often includes intellectual property, business plans, or client-specific data defined in Non-Disclosure Agreements (NDAs) or Service Level Agreements (SLAs).
In practice, this means you must have a way to identify which data is confidential and apply specific protections to that subset of information. The scope extends beyond technical controls to include legal agreements, employee training, and secure disposal methods.
The primary intent is to ensure that if an organization promises a client or partner that certain data will remain secret, the internal processes and technical safeguards are sufficient to prevent that secret from being leaked or accessed by unauthorized individuals.
How to meet it
- Establish a Data Classification Policy that defines levels of sensitivity (e.g., Public, Internal, Confidential, Restricted).
- Implement encryption for confidential data both at rest (using industry-standard algorithms like AES-256) and in transit (using TLS 1.2+).
- Require all employees, contractors, and third-party vendors to sign Non-Disclosure Agreements (NDAs) before accessing sensitive systems.
- Apply the principle of least privilege via Role-Based Access Control (RBAC), ensuring only personnel with a "need to know" can access confidential datasets.
- Define and implement secure data disposal procedures, such as cryptographic erasure for cloud storage or physical shredding for hard drives.
- Conduct regular training for staff on how to handle, label, and share confidential information according to company policy.
Evidence an auditor asks for
- A formal Data Classification Policy and a corresponding matrix mapping data types to their sensitivity levels.
- Signed NDAs and confidentiality agreements for a sample of current employees and active vendors.
- Technical configuration screenshots or reports proving encryption is enabled on databases, backups, and communication channels.
- Access logs or user lists demonstrating that access to confidential folders/databases is restricted to authorized roles.
- Certificates of destruction or logs showing the secure decommissioning of hardware containing confidential data.
Common pitfalls
- Confusing Confidentiality with Privacy: Organizations often mistake PII (Privacy) for general confidential business data; they are distinct criteria in SOC 2.
- Lack of Classification: Failing to actually label or categorize data, making it impossible to prove that "confidential" data is being treated differently than "public" data.
- Overlooking Third Parties: Implementing strong internal controls but failing to verify that subcontractors and vendors are bound by the same confidentiality obligations via contract.