SOC 2 criteria › CC1 Control environment
SOC 2 CC1.3 explained
Management sets structures, reporting lines, authorities and responsibilities to meet objectives.
Typical controls that address CC1.3
- Org chart
- Defined security roles and owners
- Job descriptions with security responsibilities
Evidence auditors usually ask for
- Current org chart
- Role and responsibility matrix
Keep CC1.3 evidence organised
Korrali Trust keeps your policies, controls and evidence in one workspace, and reuses them to answer customer security questionnaires.
Other CC1 criteria
- CC1.1: The organization shows a commitment to integrity and ethical values.
- CC1.2: The board or equivalent oversight body is independent of management and oversees internal control.
- CC1.4: The organization attracts, develops and retains competent people.
- CC1.5: People are held accountable for their internal control responsibilities.
Plain-English summary of the 2017 Trust Services Criteria common criteria. Controls and evidence vary by organisation and auditor.