SOC 2 criteria › CC1 Control environment
SOC 2 CC1.5 explained
People are held accountable for their internal control responsibilities.
Typical controls that address CC1.5
- Policy acknowledgement
- Performance reviews including security duties
- Sanctions policy
Evidence auditors usually ask for
- Acknowledgement records
- Sanctions or disciplinary policy
Keep CC1.5 evidence organised
Korrali Trust keeps your policies, controls and evidence in one workspace, and reuses them to answer customer security questionnaires.
Other CC1 criteria
- CC1.1: The organization shows a commitment to integrity and ethical values.
- CC1.2: The board or equivalent oversight body is independent of management and oversees internal control.
- CC1.3: Management sets structures, reporting lines, authorities and responsibilities to meet objectives.
- CC1.4: The organization attracts, develops and retains competent people.
Plain-English summary of the 2017 Trust Services Criteria common criteria. Controls and evidence vary by organisation and auditor.