SOC 2 criteria › CC1 Control environment
SOC 2 CC1.4 explained
The organization attracts, develops and retains competent people.
Typical controls that address CC1.4
- Hiring process with role requirements
- Security awareness training
- Performance reviews
Evidence auditors usually ask for
- Training completion records
- Job descriptions
- Review records
Keep CC1.4 evidence organised
Korrali Trust keeps your policies, controls and evidence in one workspace, and reuses them to answer customer security questionnaires.
Other CC1 criteria
- CC1.1: The organization shows a commitment to integrity and ethical values.
- CC1.2: The board or equivalent oversight body is independent of management and oversees internal control.
- CC1.3: Management sets structures, reporting lines, authorities and responsibilities to meet objectives.
- CC1.5: People are held accountable for their internal control responsibilities.
Plain-English summary of the 2017 Trust Services Criteria common criteria. Controls and evidence vary by organisation and auditor.