SOC 2 criteria › CC3 Risk assessment
SOC 2 CC3.4 explained
Changes that could significantly affect internal control are identified and assessed.
Typical controls that address CC3.4
- Review of major business, technology and vendor changes for risk
- Risk reassessment triggers
Evidence auditors usually ask for
- Change risk reviews
- Updated risk register
Keep CC3.4 evidence organised
Korrali Trust keeps your policies, controls and evidence in one workspace, and reuses them to answer customer security questionnaires.
Other CC3 criteria
Plain-English summary of the 2017 Trust Services Criteria common criteria. Controls and evidence vary by organisation and auditor.