SOC 2 criteria › CC4 Monitoring activities
SOC 2 CC4.1 explained
The organization runs ongoing or separate evaluations to check controls are present and working.
Typical controls that address CC4.1
- Internal control reviews
- Automated control monitoring
- Penetration tests and vulnerability scans
Evidence auditors usually ask for
- Internal audit or review reports
- Monitoring dashboards
- Pentest report
Keep CC4.1 evidence organised
Korrali Trust keeps your policies, controls and evidence in one workspace, and reuses them to answer customer security questionnaires.
Other CC4 criteria
Plain-English summary of the 2017 Trust Services Criteria common criteria. Controls and evidence vary by organisation and auditor.