SOC 2 criteria › CC9 Risk mitigation
SOC 2 CC9.2 explained
Risks from vendors and business partners are assessed and managed.
Typical controls that address CC9.2
- Vendor risk assessments
- Review of vendor SOC 2 reports
- Subprocessor list
Evidence auditors usually ask for
- Vendor inventory
- Vendor review records
- Contracts with security terms
Keep CC9.2 evidence organised
Korrali Trust keeps your policies, controls and evidence in one workspace, and reuses them to answer customer security questionnaires.
Other CC9 criteria
Plain-English summary of the 2017 Trust Services Criteria common criteria. Controls and evidence vary by organisation and auditor.