SOC 2 criteria › CC2 Communication and information
SOC 2 CC2.3 explained
The organization communicates with external parties about matters affecting internal control.
Typical controls that address CC2.3
- Public security page or trust center
- Customer notification process
- Terms, privacy policy and support channels
Evidence auditors usually ask for
- Trust center or security page
- Customer communication templates
- Published terms and privacy policy
Keep CC2.3 evidence organised
Korrali Trust keeps your policies, controls and evidence in one workspace, and reuses them to answer customer security questionnaires.
Other CC2 criteria
Plain-English summary of the 2017 Trust Services Criteria common criteria. Controls and evidence vary by organisation and auditor.