SOC2-CC2-STAKEHOLDER-COMMS
External Security Communication Process
What this control does
Defined process for communicating security commitments and obligations to customers, partners, and regulators.
Implementation guidance
Maintain a security page (e.g., trust.company.com) documenting your security posture. Include contract provisions for data processing agreements. Define who is authorized to respond to customer security questionnaires and how responses are reviewed.
Requirements satisfied
Why it matters
Absent or inconsistent external security communications create exposure to customer churn, audit failures, and regulatory sanctions when promised security controls are undocumented or misrepresented. Unauthorized or inaccurate responses to security questionnaires can contradict your actual security posture, creating contractual liability and evidence of non-compliance during incidents or audits.
Evidence to collect
- Published security/trust page (URL and dated screenshot) listing implemented controls and certification statuses
- Security communication policy naming authorized responders and required approval workflows for customer questionnaires and RFPs
- Data Processing Agreement (DPA) or contract amendment template that explicitly binds external parties to your documented security obligations
- Email thread or approval log showing review and sign-off on a completed customer security assessment or audit response from the past 12 months
Testing procedure
Request the current security/trust page and verify it names specific controls (e.g., MFA, encryption, incident response SLA) rather than generic statements. Obtain the approval workflow document and trace one recent customer questionnaire response through the named approval chain to confirm authorization and sign-off occurred. Confirm the DPA references your published control commitments (e.g., "controls listed on trust.company.com") to prevent scope misalignment. Review the questionnaire response for factual claims that contradict your control testing results or design documentation.
Common gotchas
Teams often create a security page but never update it when controls change, causing it to contradict current audit findings during customer reviews. Questionnaire responses are frequently prepared by sales or product teams without security review, embedding incorrect or aspirational claims (e.g., "we encrypt in transit" when TLS is disabled for internal traffic) that become contractual obligations.