SOC 2 criteria › CC1 Control environment
SOC 2 CC1.1 explained
The organization shows a commitment to integrity and ethical values.
Typical controls that address CC1.1
- Code of conduct acknowledged by all staff
- Disciplinary process for violations
- Background checks where lawful
Evidence auditors usually ask for
- Signed code of conduct acknowledgements
- Code of conduct document
- Background check records
Keep CC1.1 evidence organised
Korrali Trust keeps your policies, controls and evidence in one workspace, and reuses them to answer customer security questionnaires.
Other CC1 criteria
- CC1.2: The board or equivalent oversight body is independent of management and oversees internal control.
- CC1.3: Management sets structures, reporting lines, authorities and responsibilities to meet objectives.
- CC1.4: The organization attracts, develops and retains competent people.
- CC1.5: People are held accountable for their internal control responsibilities.
Plain-English summary of the 2017 Trust Services Criteria common criteria. Controls and evidence vary by organisation and auditor.