12 implemented. 6 in progress.
If all six essentials are among the implemented controls and all knowledge checks are passed, the score is 1,500 ÷ 18 = 83.33%. The organization can proceed to its declaration.
THE OPEN SOCK TOO STANDARD · V1.0
The next standard is open.
An open standard for business security and compliance. Read it, use it, and share it. Every requirement, lesson, and scoring rule is published.
Current version1.0
Requirements18 controls
Essential controls6 required
Report validity365 days
Sock Too v1.0. Pass six knowledge checks, implement all six essential controls, and score at least 80% across 18 controls. Answers are self-reported, not independently audited.
Built to be adopted.
Open to everyone.
We’re building the kind of standard every company should be able to adopt: clear requirements, practical learning, and results clients can inspect. Start with six lessons, assess your organization, and have an authorized representative sign your report.
A passing report records that your answers meet Sock Too v1.0. We do not audit your systems or inspect evidence. It is not proof of legal compliance or a replacement for another certification.
EVERY RULE IN THE OPEN
How passing works.
Implemented100
In progress50
Not yet0
Answer all 18 controls. Their unrounded average must be at least 80%. Every essential control must be Implemented, and every knowledge check passed. Displayed scores are rounded; eligibility is not.
What your answers mean
Implemented: every condition is met now across the organization. In progress: some conditions are met, coverage is incomplete, or a required test has not happened. Not yet: the practice is not in place. Plans alone do not count as implementation.
All controls apply. Conditional cases are explained in the questions: an owner-only team can document its own training, a stateless service can test a rebuild, and a company without relevant providers can document that finding. Only mark Implemented when all conditions are met.
Reports expire after one year. Renewals require reviewing the lessons, passing the checks again, and reconfirming every answer. Revoke a record promptly if a material change makes it inaccurate.
A score alone does not earn a pass.
Every control has equal weight. The six essential controls are mandatory, regardless of the total. These are Sock Too’s policy choices: a clear baseline with room to improve the remaining practices.
One essential still in progress.
17 implemented controls and one in progress score 1,750 ÷ 18 = 97.22%. If that remaining control is essential, the organization must finish it before attesting.
Displayed averages are rounded. Eligibility uses the unrounded score. The course checks understanding; the assessment records the organization’s own declarations.
The six non-negotiables.
Protect administrative access, maintain systems, prove you can recover, manage data, prepare for incidents, and assign responsibility. Every passing organization must declare all six implemented.
Access & identity
List the accounts that control your hosting, domain, email, code, backups, and customer data. Protect these first: access to one can often be used to take over others.
Privileged MFAEssential
ACCESS-MFAIs MFA enforced for all human administrative access across the organization?
Cover hosting, domains, email administration, source code, backups, and other administrative services. A service without native MFA must sit behind an enforced MFA gateway. Shared recovery codes must be protected. Service accounts are addressed under secret management.
Suggested records and next step
A dated list of administrative services and their MFA enforcement settings, with no secrets included.
List administrative entry points and enforce MFA on each, including recovery access.
Account lifecycle
ACCESS-REVIEWAre human accounts individual, access limited by role, and access reviews performed at least every 90 days?
Also remove access by the end of the final working day or immediately when authorization is withdrawn. An owner-only organization can meet this by reviewing its own accounts and documenting the result.
Suggested records and next step
An access list, latest review date, and a short joiner/leaver checklist.
Assign named accounts, remove unnecessary privileges, and record a dated access review.
Secret management
ACCESS-SECRETSAre passwords unique, secrets stored in protected tools or configuration, and exposed credentials promptly revoked or rotated?
Use a password manager for human credentials. Protect application secrets and narrowly scope service accounts. Credentials must not be stored in source repositories, public documents, or ordinary logs.
Suggested records and next step
Your secret-handling procedure and a record of any credential rotations, without the credentials themselves.
Move credentials into protected storage and document how exposure triggers revocation or rotation.
Systems & updates
Keep a list of your devices, applications, and hosted services. Record an owner, purpose, and any sensitive data for each. Use it to track updates and check what is exposed.
Supported and patched systemsEssential
SYSTEMS-UPDATESAre the organization’s systems supported, with a process meeting Sock Too's critical and routine security-update timelines?
Assess known critical or actively exploited issues affecting internet-facing systems within 72 hours of awareness; patch or isolate within seven days. Apply other security updates within 30 days, or record a risk decision and mitigation. Suspected active compromise triggers immediate incident response.
Suggested records and next step
System support status, update settings, recent patch records, and any documented exceptions for routine updates.
Remove or isolate unsupported systems and assign an owner to the critical and routine patch process.
Inventory and device protection
SYSTEMS-INVENTORYDo you maintain a current asset inventory and protect work devices with encryption, screen locks, and appropriate platform protections?
Include hosted services and devices holding organization data. Review the inventory at least every 90 days and on material changes. Restrict administrative exposure and remove unneeded services.
Suggested records and next step
An asset inventory, its last review date, and a device/security configuration checklist.
Create an inventory, assign owners, and check encryption, locking, and exposed administration.
Controlled changes
SYSTEMS-CHANGESDo significant production changes have an owner, a check or test, a recovery plan, and a change record?
A short checklist or deployment record is sufficient. Test with nonproduction data where practical, and know how to roll back or restore before making the change.
Suggested records and next step
A recent change ticket or deployment record showing validation and rollback or recovery steps.
Add validation and recovery steps to your production change checklist.
Backups & recovery
Back up the data and configuration you need to recover. Keep copies separate from the live system, then test that you can restore them.
Separate copies and tested recoveryEssential
BACKUPS-RESTOREDo you keep separate recoverable copies of critical data/configuration and have a successful recovery test from the last 180 days?
Restrict access so ordinary account compromise cannot freely destroy all copies. A stateless service may use a tested rebuild from separately stored code and configuration. Record the test date and outcome; an untested plan is In progress.
Suggested records and next step
Backup or rebuild coverage plus a dated, successful restore/rebuild test record.
Make a separate recoverable copy and complete a documented restore or rebuild test.
Backup monitoring
BACKUPS-MONITORAre backup or rebuild-material checks scheduled, failures reviewed, and recovery targets documented?
Set acceptable data loss and downtime targets. Make frequency and retention consistent with those targets, and assign an owner to investigate failures.
Suggested records and next step
Recovery targets, backup schedule, and a recent check or failure-resolution record.
Write recovery targets and assign someone to check backup failures and coverage.
Protected recovery materials
BACKUPS-PROTECTIONAre recovery materials protected in transit and at rest, retained for a defined period, and accompanied by accessible recovery instructions?
Limit permissions, protect recovery keys, and ensure the instructions can be reached during an outage. Define expiration for old backup copies and account for it in your retention practice.
Suggested records and next step
Backup permissions and retention settings, plus an accessible recovery runbook without public secrets.
Protect backup access and document retention, recovery keys, and outage-safe instructions.
Data & privacy
Know what personal and confidential data you hold, why you need it, who can access it, and when it should be deleted.
Data inventory and retentionEssential
PRIVACY-INVENTORYHave you documented the data you handle, its purposes and locations, and an implemented retention/deletion practice?
Include personal and confidential data in applications, logs, exports, vendors, and backups. Record justified cases of no collection. A retention policy with no implementation is In progress.
Suggested records and next step
A data inventory and retention schedule, plus a recent deletion or retention check.
Map your data and implement a retention/deletion routine that matches the documented schedule.
Data minimization and protection
PRIVACY-PROTECTIONDo you minimize data collection, restrict data access by role, and protect sensitive transfers and storage?
Use secure network transport and appropriate storage protection. Avoid unnecessary personal data or secrets in logs and test environments. Cover the whole organization.
Suggested records and next step
Data-access settings, transport/storage configuration, and a check of collection and logging practices.
Remove unnecessary fields and logging, and check access, transport, and storage protection.
Privacy communication and requests
PRIVACY-REQUESTSDo you accurately explain your data practices and have an owner and process for privacy requests and applicable obligations?
Provide an accessible contact or request channel. The owner must identify relevant contractual and legal requirements rather than treating Sock Too as a substitute for them.
Suggested records and next step
Your privacy explanation, request contact, and an internal request-handling checklist.
Publish an accurate data-practices explanation and assign a privacy-request owner and process.
Incident readiness
Choose who handles security incidents and how to reach them. Write down the response steps and keep the plan somewhere you can access during an outage.
Owned incident responseEssential
RESPONSE-PLANDo you have an accessible incident plan with a named owner, reporting/escalation contacts, and containment, recovery, and communication steps?
Include a backup or external escalation contact and a way to reach the plan during an outage. The plan must identify who evaluates notification obligations.
Suggested records and next step
A current response plan and contact list stored somewhere reachable during an incident.
Write a short incident plan, name an owner and escalation contact, and make it accessible during outages.
Logs and alert handling
RESPONSE-DETECTIONAre relevant security logs and available alerts enabled, protected, and reviewed by an owner at least weekly?
Respond to urgent alerts promptly. Retain relevant security events for at least 30 days unless an identified obligation requires different handling. Include privileged activity and unusual sign-ins where supported.
Suggested records and next step
Logging/alert configuration, retention settings, and a recent activity review.
Enable useful security events and alerts, set retention, and assign a review and response owner.
Practiced response
RESPONSE-EXERCISEHave you practiced an incident scenario within the last year and assigned follow-up actions from the exercise?
A documented tabletop conversation is enough; do not create a real incident. A solo operator can walk through the plan with their escalation contact or record a structured self-exercise.
Suggested records and next step
A dated scenario, decisions made, gaps identified, and owners for follow-up actions.
Run a short incident walkthrough and record improvements, owners, and due dates.
People & partners
Assign a security owner and document the practices your team follows. Keep track of risks, vendor access, and the commitments you have made to customers.
Security ownership and reviewEssential
PEOPLE-OWNERIs a security owner assigned, with documented baseline practices, material risks, and an annual/material-change review process?
The owner may be the founder. Record your initial review before attesting and identify owners for open improvements. A calendar reminder alone without an initial baseline is In progress.
Suggested records and next step
A named owner, organization-wide baseline, dated initial or annual review, and a short risk/action list.
Name the owner, document the organization-wide baseline and material risks, and complete the initial review.
Practical security awareness
PEOPLE-TRAININGDo all people with system access receive security and privacy guidance before access and refresh it at least annually?
Include credential protection, suspicious requests, incident reporting, and data handling. An owner-only organization can use this course plus a review of its own procedures; record that completion before answering Implemented.
Suggested records and next step
Training topics, completion records, and the local reporting/data-handling instructions provided.
Train everyone with access and record completion and the next refresh date.
Providers and obligations
PEOPLE-VENDORSDo you inventory and review relevant providers and track the security/privacy obligations applicable to your organization?
Review providers before use and at least annually, including access, data handling, security information, and exit options. If there are none, document the review and finding. Assign an owner to relevant contractual and other obligations.
Suggested records and next step
A provider list and review, relevant commitments, and their responsible owner.
List relevant providers and obligations, review their risks, and assign follow-up owners.
A public record, with a clear lifecycle.
Issue: pass the checks, meet the controls, and sign the declaration. The report records your answers, score, version, signatory, and dates.
Maintain: keep the declared practices in place. A material change that makes the report inaccurate means it should be revoked.
Correct or renew: complete fresh checks and reconfirm the answers. Issued reports keep their original declarations; a new assessment produces a new report. Reports expire after 365 days.
Check a certificate or find contact information for questions about a record.
The specification behind the standard.
Sock Too covers everyday business security: access, systems, backups, data, incidents, and ownership. Read and reuse the full standard, alongside any industry-specific requirements your business needs.
Read the full requirements before you start. Your report includes the standard version, your answers, and your score.
Download the specificationFurther reading
Useful resources for further reading. These organizations do not endorse Sock Too.