SOC 2 common criteria, explained

The 33 common criteria every SOC 2 report covers, with typical controls and evidence.

CC1: Control environment

CC1.1 The organization shows a commitment to integrity and ethical values.
CC1.2 The board or equivalent oversight body is independent of management and oversees internal control.
CC1.3 Management sets structures, reporting lines, authorities and responsibilities to meet objectives.
CC1.4 The organization attracts, develops and retains competent people.
CC1.5 People are held accountable for their internal control responsibilities.

CC2.1 The organization obtains or produces relevant, quality information to support internal control.
CC2.2 Internal control information, including objectives and responsibilities, is communicated internally.
CC2.3 The organization communicates with external parties about matters affecting internal control.

CC3.1 Objectives are specified clearly enough to identify and assess risks.
CC3.2 Risks to objectives are identified and analysed across the organization.
CC3.3 The risk assessment considers the potential for fraud.
CC3.4 Changes that could significantly affect internal control are identified and assessed.

CC4.1 The organization runs ongoing or separate evaluations to check controls are present and working.
CC4.2 Control deficiencies are communicated to those responsible and fixed in time.

CC5.1 Control activities are selected and developed to reduce risks to acceptable levels.
CC5.2 General controls over technology are selected and developed.
CC5.3 Control activities are deployed through policies and procedures.

CC6.1 Logical access to systems and data is restricted using access controls, authentication and encryption.
CC6.2 New users are registered and authorized before access is granted, and access is removed when no longer needed.
CC6.3 Access is granted, changed and removed based on roles and least privilege, with periodic review.
CC6.4 Physical access to facilities and protected assets is restricted to authorized people.
CC6.5 Assets are disposed of securely, and data is removed when no longer needed.
CC6.6 Logical access is protected against threats from outside the system boundary.
CC6.7 Data transmission, movement and removal are restricted to authorized users and processes.
CC6.8 Controls prevent or detect unauthorized or malicious software.

CC7.1 Configurations and vulnerabilities are monitored to detect new weaknesses.
CC7.2 System components are monitored for anomalies that could indicate attacks or errors.
CC7.3 Security events are evaluated to decide whether they are incidents.
CC7.4 Identified incidents are responded to through a defined program.
CC7.5 The organization recovers from incidents and restores operations.

CC8.1 Changes to infrastructure, data, software and procedures are authorized, designed, tested, approved and implemented in a controlled way.