SOC 2 criteria › CC3 Risk assessment
SOC 2 CC3.1 explained
Objectives are specified clearly enough to identify and assess risks.
Typical controls that address CC3.1
- Documented security objectives
- Scope of the system in the audit
Evidence auditors usually ask for
- Security objectives document
- System description
Keep CC3.1 evidence organised
Korrali Trust keeps your policies, controls and evidence in one workspace, and reuses them to answer customer security questionnaires.
Other CC3 criteria
Plain-English summary of the 2017 Trust Services Criteria common criteria. Controls and evidence vary by organisation and auditor.