SOC 2 criteria › CC9 Risk mitigation
SOC 2 CC9.1 explained
Risks from potential business disruptions are identified and mitigated.
Typical controls that address CC9.1
- Business continuity plan
- Cyber insurance
- Redundant infrastructure
Evidence auditors usually ask for
- BC/DR plan
- Insurance certificate
Keep CC9.1 evidence organised
Korrali Trust keeps your policies, controls and evidence in one workspace, and reuses them to answer customer security questionnaires.
Other CC9 criteria
Plain-English summary of the 2017 Trust Services Criteria common criteria. Controls and evidence vary by organisation and auditor.