SOC 2 criteria › CC8 Change management
SOC 2 CC8.1 explained
Changes to infrastructure, data, software and procedures are authorized, designed, tested, approved and implemented in a controlled way.
Typical controls that address CC8.1
- Pull request review
- Branch protection
- CI testing
- Change approval for infrastructure
Evidence auditors usually ask for
- Branch protection settings
- Sample pull requests with approvals
- Change management policy
Keep CC8.1 evidence organised
Korrali Trust keeps your policies, controls and evidence in one workspace, and reuses them to answer customer security questionnaires.
Plain-English summary of the 2017 Trust Services Criteria common criteria. Controls and evidence vary by organisation and auditor.