SOC 2 criteria › CC2 Communication and information
SOC 2 CC2.2 explained
Internal control information, including objectives and responsibilities, is communicated internally.
Typical controls that address CC2.2
- Published security policies
- Onboarding security training
- Internal channel for reporting issues
Evidence auditors usually ask for
- Policy portal or wiki
- Training materials
- Internal announcements
Keep CC2.2 evidence organised
Korrali Trust keeps your policies, controls and evidence in one workspace, and reuses them to answer customer security questionnaires.
Other CC2 criteria
Plain-English summary of the 2017 Trust Services Criteria common criteria. Controls and evidence vary by organisation and auditor.