A cloud architect is designing a multi-tenant SaaS application that must achieve SOC 2 Type II compliance. Which security control combination is most directly relevant to demonstrating the availability and confidentiality trust service criteria?

Question

Accepted Answer

A. Monitoring and alerting for uptime SLAs (availability) combined with encryption at rest and in transit plus access controls (confidentiality). SOC 2 Type II requires demonstrating sustained controls over defined trust service criteria. Availability is evidenced through monitoring, alerting, and SLA measurement. Confidentiality is evidenced through encryption and access controls. The CompTIA Cloud+ V4 Security domain lists SOC 2 as a compliance standard and covers security controls, encryption, and IAM as security control mechanisms.

A cloud architect is designing a multi-tenant SaaS application that must achieve SOC 2 Type II compliance. Which security control combination is most directly relevant to demonstrating the availability and confidentiality trust service criteria?

Related Questions

Discussion