CC2 addresses the information and communication systems that support the functioning of internal controls. In practical terms: do employees know what the security policies are? Do they know how to report a security issue? Do clients and external parties receive appropriate information about the organization’s security commitments? And when something goes wrong, is there a defined communication path?
CC2 is sometimes treated as a formality in SOC 2 readiness programs — “we have policies, therefore we communicate information.” Auditors test CC2 more actively than this assumption suggests. They want to see evidence that security-relevant information actually reaches the people who need it, at the frequency required, in a format they can act on.
Internal Communication Requirements
The internal communication dimension of CC2 covers how the organization ensures that personnel with internal control responsibilities understand those responsibilities. This includes the security awareness training program, the accessibility of security policies, the mechanism for employees to ask security questions or report concerns, and the communication of changes to policies and procedures.
| CC2 Internal Requirement | Acceptable Evidence | Common Gap |
|---|---|---|
| Security awareness training | Training platform completion records showing all employees completed annual training; onboarding training for new hires | Training completed but completion records not retained; training content not updated to reflect current threats |
| Policy accessibility | Security policy library accessible to all employees (e.g., intranet, wiki, HRIS); policy acknowledgment log | Policies exist but are stored in a location only the security team can access |
| Security reporting mechanism | Documented channel for employees to report security incidents or concerns (e.g., [email protected], Slack channel, ticketing system) | Reporting channel exists but is not communicated to employees in onboarding or training |
| Policy change notification | Evidence that employees are notified when policies are materially updated | Policy updated but employees not re-acknowledged; no change communication record |
External Communication Requirements
CC2 also covers the organization’s communication with external parties — primarily clients, but also regulators, sub-processors, and other relevant external stakeholders. This includes how the organization communicates its security commitments (typically through system descriptions, privacy notices, and security pages), how it notifies clients of security incidents that affect them, and how it handles external security inquiries.
| IMPORTANT | Client security incident notification is a CC2 requirement that organizations frequently underestimate. If a security incident affects client data, SOC 2 requires that clients be notified. The notification procedure — who decides to notify, within what timeframe, through what channel — must be documented before the audit. Evidence of actual notifications (even anonymized) will be reviewed in a Type II audit. |
The external communication artifacts auditors request include: the organization’s security or trust page (the public-facing statement of security practices), data processing agreements or security addenda shared with clients, the incident notification procedure, and any records of security communications sent to clients or regulators during the audit period.
Practical CC2 Implementation
The most efficient way to satisfy CC2 is to treat it as an operational communication practice rather than a compliance documentation exercise. An annual security awareness training with a completion tracker, policies stored in an employee-accessible location with an acknowledgment log, a published security page on the company website, and a documented incident notification procedure — these four elements cover the majority of CC2 requirements with minimal overhead.
| BITLION INSIGHT | Organizations often discover that CC2 is already substantially satisfied — they just haven’t retained the evidence. If you run annual security training through a platform like KnowBe4 or Proofpoint, those completion records exist. If you notify clients of incidents over email, those emails exist. The work is not creating new communications — it’s ensuring those communications are discoverable and organized for audit review. |