SOC 2 Type II Requirements
Service Organization Control requirements for trust service criteria
-
SOC 2 Report Confidentiality
NDA explicitly covers SOC 2 Type I and Type II reports as confidential information with restricted distribution.
Required -
Security Control Documentation
Protection for security policies, procedures, and control descriptions shared during vendor assessment.
Required -
Penetration Test Results
Heightened confidentiality provisions for vulnerability assessments and penetration testing reports.
Required -
Audit Rights Provisions
Rights to audit or receive third-party attestations of compliance with confidentiality obligations.
Recommended -
Subservice Organization Coverage
Flow-down requirements ensuring subservice organizations meet equivalent confidentiality standards.
Recommended
GDPR Requirements
General Data Protection Regulation requirements for EU personal data
-
Data Processing Agreement (Article 28)
Written agreement with required GDPR clauses for data processors, including processing instructions and security measures.
Required -
Subprocessor Notification
Mechanism for notifying controller of new subprocessors and obtaining approval before engagement.
Required -
Cross-Border Transfer Mechanisms
Standard Contractual Clauses (SCCs) or other approved transfer mechanisms for data leaving the EU.
Required -
Breach Notification (72 Hours)
Processor must notify controller of personal data breaches without undue delay (within 72 hours recommended).
Required -
Data Subject Rights Support
Processor assists controller in responding to data subject access, rectification, and erasure requests.
Required -
Data Deletion Upon Termination
Clear provisions for returning or deleting personal data at contract end with certification.
Required
HIPAA Requirements
Health Insurance Portability and Accountability Act for protected health information
-
Business Associate Agreement (BAA)
HIPAA requires a BAA when business associates access PHI - NDA alone is insufficient.
Required -
PHI Handling Requirements
Specific provisions for minimum necessary standard, permitted uses, and disclosure limitations.
Required -
Security Rule Compliance
Administrative, physical, and technical safeguards for electronic PHI (ePHI).
Required -
Breach Notification (60 Days)
Business associate must notify covered entity of breaches within 60 days (best practice: 24-72 hours).
Required -
Subcontractor Flow-Down
Subcontractors with PHI access must agree to equivalent restrictions.
Required
PCI DSS Requirements
Payment Card Industry Data Security Standard for cardholder data
-
Cardholder Data Environment (CDE) Protection
Specific confidentiality provisions for systems storing, processing, or transmitting cardholder data.
Required -
PCI Compliance Documentation
Protection for Attestation of Compliance (AOC) and Report on Compliance (ROC) documents.
Required -
Third-Party Service Provider Requirements
Written agreement acknowledging service provider responsibility for cardholder data security.
Required -
Incident Response Procedures
Confidentiality for incident response plans and breach procedures.
Recommended
ISO 27001 Requirements
Information Security Management System requirements
-
ISMS Documentation Protection
Confidentiality provisions for information security policies, procedures, and risk assessments.
Required -
Certification and Audit Reports
Protection for ISO 27001 certification documents and audit findings.
Required -
Risk Assessment Confidentiality
Protection for risk assessments, threat analyses, and vulnerability information.
Recommended -
Supplier Relationship Management
Information security requirements in supplier agreements per Annex A.15.
Recommended
CCPA/CPRA Requirements
California Consumer Privacy Act and California Privacy Rights Act
-
Service Provider Agreement
Written contract certifying business purpose limitation and prohibiting sale of personal information.
Required -
Purpose Limitation Clause
Service provider can only process personal information for specified business purposes.
Required -
Consumer Rights Support
Cooperation with consumer access, deletion, and opt-out requests.
Required -
Sensitive Personal Information
Additional protections for sensitive categories under CPRA (effective 2023).
Recommended
📋 Framework Cross-Reference
Which SaaS NDA template addresses each compliance framework?
| Framework | API Integration | Data Processing | Cloud Vendor | Multi-Tenant |
|---|---|---|---|---|
| SOC 2 | ✓ | ✓ | ✓ | ✓ |
| GDPR | Partial | ✓ Full DPA | ✓ | ✓ |
| HIPAA | - | Requires BAA | Requires BAA | Requires BAA |
| PCI DSS | ✓ | ✓ | ✓ | ✓ |
| ISO 27001 | ✓ | ✓ | ✓ | ✓ |
| CCPA | Partial | ✓ | ✓ | ✓ |
Explore Other Industry Packs
⚖️ This Checklist Is Not Legal Advice
This compliance checklist is for informational purposes only and does not constitute legal advice. Compliance requirements vary by jurisdiction, industry, and specific use case. We strongly recommend consulting with a technology attorney to ensure your agreements meet all applicable legal requirements. Request a consultation.