How many policies do you need for SOC 2?

SOC 2 does not set a number. The Trust Services Criteria describe outcomes, such as access being restricted or changes being authorized, and leave it to you to decide how to document them. Published lists differ in length mostly because they split the same topics differently. This set uses 22 short, single-owner policies so each one can be assigned, reviewed and mapped on its own.

Which SOC 2 policies are required?

No specific policy title is required. What the auditor expects is that the controls you describe are defined, approved by management and communicated, and policies are the usual way to show that. The table on this page shows which criteria each policy addresses, so you can check that every criterion in your scope has a written commitment behind it, whatever you call the documents.

Can I combine several policies into one document?

Yes. Some companies merge, for example, backup and business continuity, or authentication and access control. The trade-off is ownership and review: a combined document usually has several owners and changes more often. If you combine policies, keep the criteria mapping so you can still point the auditor at the section that addresses each criterion.

Do Availability and Confidentiality need extra policies?

In this set they are covered by policies that also serve the common criteria: business continuity, backup and logging for Availability, and data classification, retention and privacy for Confidentiality. They only come into play if you put those categories in the scope of your report. The A1 and C1 rows in the series table show exactly which policies carry them.

Is having all 22 policies enough for a SOC 2 report?

No. Policies are the written layer of your controls. The CPA firm tests whether the controls were designed as described and, for a Type II report, whether they operated through the period, using evidence such as access reviews, change approvals and incident records. Approved policies are where that starts, not where it ends.

SOC 2 policies list: all 22, mapped to the criteria

SOC 2 does not prescribe a list of policies or a policy count. The Trust Services Criteria describe outcomes, and policies are how you show management has committed to each one. The set below uses 22 policies, and the table shows every criterion each policy addresses, who owns it and where a free template exists.

Together the 22 policies address all 38 criteria this site maps: the 33 common criteria plus Availability and Confidentiality. Every row links to the full policy text, and every criterion links to a page that explains it in plain words.

The full list

Criteria come from the Policyseed crosswalk, the same data the generator and the Audit Kit spreadsheet use. The ISO 27001 column counts the Annex A controls each policy also documents; see the SOC 2 to ISO 27001 mapping for the detail.

Policy	Owner role	SOC 2 criteria addressed	ISO 27001 Annex A controls	Free companion
P01 Information Security Policy	Security Owner	CC1.1, CC1.2, CC1.3, CC1.5, CC2.2, CC3.1, CC4.1, CC4.2, CC5.1, CC5.3	8	Policy template only
P02 Acceptable Use Policy	Security Owner	CC1.1, CC1.5	5	Policy template only
P03 Access Control Policy	Security Owner	CC3.3, CC5.2, CC6.1, CC6.2, CC6.3	8	User access review template (.xlsx)
P04 Authentication and Password Policy	Security Owner	CC6.1, CC6.6	3	Policy template only
P05 Asset Management Policy	IT/Operations Lead	CC2.1, CC6.5, C1.2	6	Policy template only
P06 Data Classification and Handling Policy	Security Owner	CC6.7, C1.1	10	Policy template only
P07 Data Retention and Disposal Policy	Security Owner	CC6.5, C1.1, C1.2	4	Data retention schedule template (.xlsx)
P08 Encryption and Key Management Policy	Engineering Lead	CC6.1, CC6.7	3	Policy template only
P09 Change Management Policy	Engineering Lead	CC3.4, CC5.2, CC8.1	8	Policy template only
P10 Secure Software Development Policy	Engineering Lead	CC6.8, CC8.1	10	Policy template only
P11 Vulnerability and Patch Management Policy	Engineering Lead	CC4.1, CC6.8, CC7.1	3	Policy template only
P12 Logging and Monitoring Policy	Engineering Lead	CC2.1, CC7.1, CC7.2, CC7.3, A1.1	9	Policy template only
P13 Incident Response Policy	Security Owner	CC2.2, CC2.3, CC4.2, CC7.2, CC7.3, CC7.4, CC7.5	7	Incident response plan template (Word)
P14 Business Continuity and Disaster Recovery Policy	Engineering Lead	CC7.5, CC9.1, A1.1, A1.2, A1.3	5	Business continuity plan template (Word)
P15 Backup and Recovery Policy	Engineering Lead	CC7.5, CC9.1, A1.2, A1.3	2	Policy template only
P16 Vendor and Third-Party Risk Management Policy	Security Owner	CC2.3, CC3.2, CC9.2	7	Vendor security questionnaire (.xlsx)
P17 Risk Assessment and Management Policy	Security Owner	CC1.2, CC1.3, CC2.1, CC3.1, CC3.2, CC3.3, CC3.4, CC4.1, CC4.2, CC5.1, CC9.1	2	Risk register template (.xlsx)
P18 Human Resources Security Policy	People/HR Lead	CC1.1, CC1.4, CC1.5, CC2.2, CC3.3, CC5.3, CC6.2	8	Policy template only
P19 Endpoint and Workstation Security Policy	IT/Operations Lead	CC6.6, CC6.7, CC6.8	11	Policy template only
P20 Network and Infrastructure Security Policy	Engineering Lead	CC5.2, CC6.1, CC6.6, CC7.1, A1.1	9	Policy template only
P21 Physical and Remote Work Security Policy	IT/Operations Lead	CC6.4, CC6.5, A1.2	10	Policy template only
P22 Privacy and Data Protection Policy	Security Owner	CC2.3, CC9.2, C1.1, C1.2	4	Policy template only

A few policies carry far more of the mapping than the rest: Risk Assessment and Management Policy (11 criteria), Information Security Policy (10 criteria) and Incident Response Policy (7 criteria). Those are the documents an auditor reads first, so they are worth getting right before the narrower ones.

Policies by criteria series

The same mapping read the other way: for each series of the Trust Services Criteria, the policies that address at least one of its criteria. Use it to check a single area, for example everything that supports logical access (CC6) before an access review walkthrough.

Series	Criteria	Policies
CC1 Control environment	5	Information Security Policy, Acceptable Use Policy, Risk Assessment and Management Policy, Human Resources Security Policy
CC2 Communication and information	3	Information Security Policy, Asset Management Policy, Logging and Monitoring Policy, Incident Response Policy, Vendor and Third-Party Risk Management Policy, Risk Assessment and Management Policy, Human Resources Security Policy, Privacy and Data Protection Policy
CC3 Risk assessment	4	Information Security Policy, Access Control Policy, Change Management Policy, Vendor and Third-Party Risk Management Policy, Risk Assessment and Management Policy, Human Resources Security Policy
CC4 Monitoring activities	2	Information Security Policy, Vulnerability and Patch Management Policy, Incident Response Policy, Risk Assessment and Management Policy
CC5 Control activities	3	Information Security Policy, Access Control Policy, Change Management Policy, Risk Assessment and Management Policy, Human Resources Security Policy, Network and Infrastructure Security Policy
CC6 Logical and physical access controls	8	Access Control Policy, Authentication and Password Policy, Asset Management Policy, Data Classification and Handling Policy, Data Retention and Disposal Policy, Encryption and Key Management Policy, Secure Software Development Policy, Vulnerability and Patch Management Policy, Human Resources Security Policy, Endpoint and Workstation Security Policy, Network and Infrastructure Security Policy, Physical and Remote Work Security Policy
CC7 System operations	5	Vulnerability and Patch Management Policy, Logging and Monitoring Policy, Incident Response Policy, Business Continuity and Disaster Recovery Policy, Backup and Recovery Policy, Network and Infrastructure Security Policy
CC8 Change management	1	Change Management Policy, Secure Software Development Policy
CC9 Risk mitigation	2	Business Continuity and Disaster Recovery Policy, Backup and Recovery Policy, Vendor and Third-Party Risk Management Policy, Risk Assessment and Management Policy, Privacy and Data Protection Policy
A1 Availability	3	Logging and Monitoring Policy, Business Continuity and Disaster Recovery Policy, Backup and Recovery Policy, Network and Infrastructure Security Policy, Physical and Remote Work Security Policy
C1 Confidentiality	2	Asset Management Policy, Data Classification and Handling Policy, Data Retention and Disposal Policy, Privacy and Data Protection Policy

The common criteria (CC1 to CC9) apply to every SOC 2 report. A1 and C1 only apply if you include Availability or Confidentiality in scope, which is why some policies matter more to one company than another.

Who owns which policies

Each policy names one owner role: the person who keeps the text current and runs its procedures. In a small company one person often holds several roles; what matters is that the approver is someone other than the owner.

Security Owner (10). Information Security Policy, Acceptable Use Policy, Access Control Policy, Authentication and Password Policy, Data Classification and Handling Policy, Data Retention and Disposal Policy, Incident Response Policy, Vendor and Third-Party Risk Management Policy, Risk Assessment and Management Policy, Privacy and Data Protection Policy
Engineering Lead (8). Encryption and Key Management Policy, Change Management Policy, Secure Software Development Policy, Vulnerability and Patch Management Policy, Logging and Monitoring Policy, Business Continuity and Disaster Recovery Policy, Backup and Recovery Policy, Network and Infrastructure Security Policy
IT/Operations Lead (3). Asset Management Policy, Endpoint and Workstation Security Policy, Physical and Remote Work Security Policy
People/HR Lead (1). Human Resources Security Policy

For the order to write them in and a realistic timeline, see SOC 2 policies for startups.

Why 22, and why other lists differ

Lists of SOC 2 policies you find elsewhere differ mostly in how they split topics, not in what they cover. One list may fold backups into business continuity or passwords into access control; another may add a code of conduct or a separate confidentiality policy. None of these are wrong. What an auditor checks is that each criterion in scope has a documented, approved commitment, that the commitment matches what you actually do, and that you have evidence it operated.

This set keeps each topic in its own short policy so that one person can own it and one review can update it. If you prefer fewer documents, keep the mapping above and point each criterion at the section that now holds it.

From the list to evidence

SOC 2 evidence checklist: the records each criterion usually needs, linked to the same policies.
SOC 2 controls list: the controls that sit between a policy and its evidence.
SOC 2 gap assessment template: a worksheet with one row per criterion to track what is in place.
Free SOC 2 templates: the registers, plans and records that sit under the policies.

Frequently asked questions

How many policies do you need for SOC 2?: SOC 2 does not set a number. The Trust Services Criteria describe outcomes, such as access being restricted or changes being authorized, and leave it to you to decide how to document them. Published lists differ in length mostly because they split the same topics differently. This set uses 22 short, single-owner policies so each one can be assigned, reviewed and mapped on its own.
Which SOC 2 policies are required?: No specific policy title is required. What the auditor expects is that the controls you describe are defined, approved by management and communicated, and policies are the usual way to show that. The table on this page shows which criteria each policy addresses, so you can check that every criterion in your scope has a written commitment behind it, whatever you call the documents.
Can I combine several policies into one document?: Yes. Some companies merge, for example, backup and business continuity, or authentication and access control. The trade-off is ownership and review: a combined document usually has several owners and changes more often. If you combine policies, keep the criteria mapping so you can still point the auditor at the section that addresses each criterion.
Do Availability and Confidentiality need extra policies?: In this set they are covered by policies that also serve the common criteria: business continuity, backup and logging for Availability, and data classification, retention and privacy for Confidentiality. They only come into play if you put those categories in the scope of your report. The A1 and C1 rows in the series table show exactly which policies carry them.
Is having all 22 policies enough for a SOC 2 report?: No. Policies are the written layer of your controls. The CPA firm tests whether the controls were designed as described and, for a Type II report, whether they operated through the period, using evidence such as access reviews, change approvals and incident records. Approved policies are where that starts, not where it ends.

Policyseed provides governance policy templates and AI tailoring. It is not legal advice and not a compliance guarantee. Management adopts the policies; the CPA firm performs the SOC 2 examination.