Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Frameworks / SOC 2
SOC 2: the php2shell risks it governs
The report SaaS and hosting providers hand their customers; the criteria they will be asked about in the next audit window.
Full name AICPA Trust Services Criteria (2017, revised points of focus 2022) · Publisher AICPA · Version TSC 2017, revised 2022 · the official text
Clauses and controls
| Control | What it asks (paraphrased) | Risks mapped | Owned or regulated by |
|---|---|---|---|
| CC7.1 | Detection and monitoring procedures identify new vulnerabilities and configuration changes | R03-4 Detections built on a proof of concept with the wrong mechanism 12 high | Security lead and AppSec |
| CC7.3 | Security events are evaluated to decide whether they are incidents | no risk mapped | |
| CC7.4 | Identified incidents are responded to under a defined programme | no risk mapped | |
| CC8.1 | Changes, including emergency changes, are authorised, tested and approved | no risk mapped | |
| CC9.2 | Risks from vendors and business partners are assessed and managed | R01-6 Products that embed PHP stay vulnerable while their suppliers investigate 16 high | Suppliers in the NCSC-NL inventory, CTO |