SOC 2 criteria › CC2 Communication and information
SOC 2 CC2.1 explained
The organization obtains or produces relevant, quality information to support internal control.
Typical controls that address CC2.1
- System inventory and data flow diagrams
- Centralized logging
- Asset inventory
Evidence auditors usually ask for
- System description
- Asset inventory
- Architecture diagrams
Keep CC2.1 evidence organised
Korrali Trust keeps your policies, controls and evidence in one workspace, and reuses them to answer customer security questionnaires.
Other CC2 criteria
Plain-English summary of the 2017 Trust Services Criteria common criteria. Controls and evidence vary by organisation and auditor.