Frameworks · Global
CC8.1 asks that changes are authorised, tested, approved and implemented. Aspian Cloud evidences that per change, for every change in the period, including the ones that went around the process.
- Instrument
- 2017 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy (with Revised Points of Focus – 2022), TSP Section 100
- In force
- Criteria unchanged since 2017; revised points of focus issued September 2022
- For
- SaaS companies selling to enterprises, and anyone a customer asks for a SOC 2 report.
| Clause | What it requires | Evidenced by |
|---|---|---|
| CC8.1 | Changes to infrastructure, data, software and procedures are authorised, designed or acquired, configured, documented, tested, approved and implemented to meet objectives.Source: presencis.com | The change record: work item, risk, approvals bound to the change, tests and scans, deploy and live-version check. The audit package lists every change in the period. |
| CC6.1 / CC6.2 / CC6.3 | Logical access is restricted to authorised users; access is registered and authorised before being granted, and modified or removed based on roles and least privilege.Source: tcsa.in | The access register and engagement records: who could approve and deploy, when each grant began and ended, with proof each removal took effect. |
| CC7.2 | System components are monitored for anomalies that indicate malicious acts, errors or failures, and those anomalies are analysed as potential security events.Source: tcsa.in | Drift items: anything running that has no approved change, opened within minutes with who, what and when, and how it was resolved. |
| CC9.2 | Risks arising from vendors and business partners are assessed and managed.Source: ce.prod.cloudaware.com | Supplier engagements and scorecards: risk level, scoped identities, baseline checks and change failure rate per supplier. |
Clause references and requirements were read on 8 November 2026. The standard is paywalled or the official site refused access, so references were confirmed from reputable secondary sources. Aspian Cloud evidences these clauses; it doesn’t make you compliant, and your assessor decides.
Want the mapping for a framework we don’t list? Ask us. A new framework is a data file, not a code change.
See what shipped without approval in your last 90 days.
Install the GitHub App and the scan arrives in minutes: every repo scored, every unreviewed merge and unapproved deploy named. Nothing is blocked until you choose.
Ship like a startup. Prove it like a bank.