The SOC 2 Privacy Default Findings Engine is a requirement-aware template layer for AICPA Trust Services Criteria - Privacy. It helps a team define consistent starting language for recurring findings while the normal project remains the source of truth for scope, evidence, ownership, remediation progress, validation, and reports.
Library and standards scope
The SOC 2 Privacy criteria address notice, choice and consent, collection, use and retention, access, disclosure, data quality, and monitoring against the service organization privacy commitments. The category concerns personal information and should be scoped carefully rather than treated as a generic security checklist.
Global, local, and project layers
- Global defaults are standards-based templates published by voiqq platform owners for a system Library.
- Local defaults belong to the signed-in workspace administrator and can override editable wording without changing the global source.
- A project finding receives copied template values and then becomes an independent record.
- Later global changes do not silently rewrite a local override or a finding already created in a project.
- Status is Open and validation is Pending when the reusable default is applied, unless an authorized project workflow later changes them.
Fields and canonical mapping
Each template is owned by a canonical privacy criterion in the SOC 2 Privacy Library. The reusable record contains a stable identifier, summary, description, remediation guidance, severity key, mapped values, source Library, and display order. The visible wording can be edited locally, while the background requirement identity continues to support filters, reports, imports, and New Finding suggestions.
Create or customize a default
- Confirm the project privacy commitments, data lifecycle, and criterion scope.
- Open the Privacy local engine and choose the exact criterion.
- Write a default that describes the control or evidence gap without personal information.
- Add remediation that identifies the expected privacy-process outcome.
- Keep legal interpretation and jurisdiction-specific deadlines out of generic defaults.
- Add actual data categories, systems, owners, requests, and dates in the authorized project finding.
Writing rules for reusable findings
Write the summary as a concise statement of the recurring failure. Use the description to explain the expected behavior, likely impact, or control concern in neutral language. Use remediation to describe the desired outcome rather than a patch tied to one framework or customer. Store actual results, reproduction steps, affected assets, evidence, people, dates, measurements, samples, and environment details in the project finding.
Suitable template subjects
- A privacy notice does not accurately describe an in-scope collection or use practice.
- Consent or choice is not recorded or respected for the applicable processing activity.
- Personal information is retained beyond the approved schedule without documented justification.
- Access or correction requests are not completed within the organization process target.
- Third-party disclosures are not supported by the required authorization and monitoring evidence.
Use a default in a project
Open New Finding inside a project configured with SOC 2 Privacy. Choose Template mode or select a prepared template after choosing the applicable privacy criterion. voiqq prefills the reusable values. Review every field, add the real evidence and context, and save the finding. Comments, attachments, assignments, history, validation, sharing, exports, and reports then use the same normal project workflow.
Accuracy and safety checks
- Minimize personal information in findings and attachments.
- Do not present a template as legal advice.
- Keep Privacy and Confidentiality criteria distinct.
- Review access permissions before sharing privacy projects.
- Validate the implemented process and supporting evidence.