SOC 2 criteria › CC1 Control environment
SOC 2 CC1.2 explained
The board or equivalent oversight body is independent of management and oversees internal control.
Typical controls that address CC1.2
- Board or advisory oversight of security and risk
- Regular security updates to leadership
Evidence auditors usually ask for
- Board or leadership meeting minutes covering security
- Oversight charter
Keep CC1.2 evidence organised
Korrali Trust keeps your policies, controls and evidence in one workspace, and reuses them to answer customer security questionnaires.
Other CC1 criteria
- CC1.1: The organization shows a commitment to integrity and ethical values.
- CC1.3: Management sets structures, reporting lines, authorities and responsibilities to meet objectives.
- CC1.4: The organization attracts, develops and retains competent people.
- CC1.5: People are held accountable for their internal control responsibilities.
Plain-English summary of the 2017 Trust Services Criteria common criteria. Controls and evidence vary by organisation and auditor.