Repeated findings are useful only when they stay accurate. The SOC 2 Confidentiality Default Findings Engine lets an authorized team leader or admin save a reusable starting point against a canonical confidentiality criterion. It reduces repeated typing while leaving the actual observation, evidence, scope, and validation inside each project finding.
What this solves
Confidentiality reviews repeatedly encounter missing classification, broad repository access, weak transmission safeguards, excessive retention, and incomplete disposal evidence. Copying sensitive examples into a template creates unnecessary exposure, while vague phrases such as data is not protected do not tell an owner which lifecycle control requires attention.
Before you begin
- Sign in as a team leader or team admin with access to the local engine.
- Confirm that SOC 2 Confidentiality is the correct Library for the work.
- Choose a recurring issue pattern, not one client-specific finding.
- Remove names, URLs, selectors, credentials, personal data, dates, and evidence from the reusable wording.
- Keep the official AICPA Trust Services Criteria - Confidentiality scope and terminology available for reference.
Step-by-step
- Confirm the confidentiality commitments and information categories in scope.
- Select the precise Confidentiality criterion in the local engine.
- Write the default around the failed lifecycle outcome, not a named dataset.
- Describe the evidence a reviewer would expect without embedding that evidence.
- Add remediation covering classification, access, protection, retention, or disposal as appropriate.
- Add system names, data classes, owners, samples, and dates only in the project finding.
What the default saves
A local default can save the summary, description, remediation guidance, severity behavior, and canonical confidentiality criterion mapping. When a reviewer selects it from New Finding, voiqq prefills those values. The new finding still starts Open with Pending validation and must be changed to match the real observation.
Good patterns to predefine
- Confidential information is not classified or connected to handling requirements.
- Access to a confidential repository is broader than the approved business need.
- Transfer or storage safeguards do not match the organization confidentiality commitment.
- Retention periods are not implemented or reviewed for confidential records.
- Disposal evidence does not show that confidential information was securely removed.
Check your result
- Do not store confidential values, customer names, or access lists in a reusable default.
- Keep Confidentiality and Privacy mappings distinct.
- Avoid absolute legal conclusions.
- Confirm evidence handling follows least privilege.
- Retest access or lifecycle controls before validation.