SOC 2 criteria › CC5 Control activities
SOC 2 CC5.3 explained
Control activities are deployed through policies and procedures.
Typical controls that address CC5.3
- Approved policy set
- Annual policy review
- Procedures for key processes
Evidence auditors usually ask for
- Policies with approval and review dates
- Procedure documents
Keep CC5.3 evidence organised
Korrali Trust keeps your policies, controls and evidence in one workspace, and reuses them to answer customer security questionnaires.
Other CC5 criteria
Plain-English summary of the 2017 Trust Services Criteria common criteria. Controls and evidence vary by organisation and auditor.