SOC 2 criteria › CC3 Risk assessment
SOC 2 CC3.2 explained
Risks to objectives are identified and analysed across the organization.
Typical controls that address CC3.2
- Annual risk assessment
- Risk register with likelihood and impact
- Risk owners
Evidence auditors usually ask for
- Risk assessment report
- Risk register
Keep CC3.2 evidence organised
Korrali Trust keeps your policies, controls and evidence in one workspace, and reuses them to answer customer security questionnaires.
Other CC3 criteria
Plain-English summary of the 2017 Trust Services Criteria common criteria. Controls and evidence vary by organisation and auditor.