CC1 — Control Environment
The organizational foundation of SOC 2 — the five COSO principles covering commitment to integrity and ethics, board oversight, organizational structure, commitment to competence, and accountability — and what auditors look for in each.
Explore Resource
CC2 — Communication and Information
How organizations must communicate internal control information — internal communication of policies and procedures, external communication of commitments to clients, and the evidence that demonstrates effective communication.
Explore Resource
CC3 — Risk Assessment
The SOC 2 risk assessment requirements — risk identification, risk analysis, fraud risk consideration, and change identification — and how the SOC 2 risk assessment relates to ISO 27001’s risk methodology.
Explore Resource
CC4 — Monitoring Activities
Ongoing and separate evaluations of the system of internal controls — how organizations monitor whether controls are operating effectively, the role of internal audit, and the management review processes that satisfy CC4.
Explore Resource
CC5 — Control Activities
The control activities that mitigate risks identified in CC3 — policies and procedures, technology controls, and how controls are deployed across processes and infrastructure.
Explore Resource
CC6 — Logical and Physical Access
The access control criteria that receive the most auditor scrutiny — logical access security software, authentication including MFA, authorization, access provisioning and deprovisioning, periodic access reviews, and physical access to data centers and offices.
Explore Resource
CC7 — System Operations
Operational controls that detect and address deviations from expected system behavior — vulnerability management, security monitoring (SIEM), malware protection, environmental controls, and incident management from a SOC 2 perspective.
Explore Resource
CC8 & CC9 — Change Management and Risk Mitigation
Change management controls covering the software development and change lifecycle (CC8), and risk mitigation controls covering vendor management and business continuity (CC9) — two criteria that produce the most common Type II findings.
Explore Resource