# SOC 2: the php2shell risks it governs

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

Each SOC 2 clause or control the GRC desk cites, the php2shell risks mapped to it and who owns them.

[Frameworks](../index.html) / SOC 2

# SOC 2: the php2shell risks it governs

The report SaaS and hosting providers hand their customers; the criteria they will be asked about in the next audit window.

**Full name** AICPA Trust Services Criteria (2017, revised points of focus 2022) · **Publisher** AICPA · **Version** TSC 2017, revised 2022 · [the official text](https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022)

## Clauses and controls

| Control | What it asks (paraphrased) | Risks mapped | Owned or regulated by |
|---|---|---|---|
| **CC7.1** | Detection and monitoring procedures identify new vulnerabilities and configuration changes | [R03-4 Detections built on a proof of concept with the wrong mechanism](../../../grc/risks/r03-4/index.html) **12** high | [Security lead and AppSec](../../../grc/stakeholders/security-lead/index.html) |
| **CC7.3** | Security events are evaluated to decide whether they are incidents | *no risk mapped* |  |
| **CC7.4** | Identified incidents are responded to under a defined programme | *no risk mapped* |  |
| **CC8.1** | Changes, including emergency changes, are authorised, tested and approved | *no risk mapped* |  |
| **CC9.2** | Risks from vendors and business partners are assessed and managed | [R01-6 Products that embed PHP stay vulnerable while their suppliers investigate](../../../grc/risks/r01-6/index.html) **16** high | [Suppliers in the NCSC-NL inventory](../../../grc/stakeholders/inventory-suppliers/index.html), [CTO](../../../grc/stakeholders/cto/index.html) |


---
site v0.8.1 · data as of 2026-10-22T11:34Z · vault commit 200d08971937 · https://php.oct.2026.newsroom.sgit.ai/grc/frameworks/soc2/index.html