| ID | Control | Owner | Source | Frameworks | Tests | |
|---|---|---|---|---|---|---|
| AST-1 |
Asset disposal procedures enforced
Electronic media holding confidential information is purged or destroyed in line with documented practice before any device leaves the studio.
|
Unassigned
|
SSigillara
|
SOC 2 · CC 6.5SOC 2 · C 1.2
|
2/2
|
|
| AST-2 |
Data retention procedures established
Formal retention and disposal procedures guide how company and customer records are kept, reviewed and finally removed from every system.
|
Unassigned
|
SSigillara
|
SOC 2 · CC 5.3SOC 2 · CC 6.5+2
|
2/2
|
|
| AST-3 |
Production inventory maintained
A formal inventory of production system assets is maintained and reconciled each quarter.
|
Unassigned
|
SSigillara
|
SOC 2 · CC 6.1
|
3/3
|
|
| BCD-1 |
Continuity and recovery plans established
Business continuity and disaster recovery plans are documented and set out the communication paths needed to keep critical work running.
|
Unassigned
|
SSigillara
|
SOC 2 · CC 9.1
|
2/2
|
|
| BCD-2 |
Continuity and recovery plans tested
The documented continuity and recovery plan is exercised at least annually against a recorded scenario, with findings logged.
|
Unassigned
|
SSigillara
|
SOC 2 · CC 3.2SOC 2 · CC 7.5
|
3/3
|