Statement on Standards for Attestations Engagement (SSAE) No. 18, System and Organization Controls (SOC) Report 2
Short Name
SOC 2
Version
2017 - with revised points of focus 2022
Governing Body
American Institute of Certified Public Accountants (AICPA)
Domains
5
Controls
392 (61 top-level, 331 points of focus)
Security
| Control | Name |
|---|---|
| CC1.1 | Demonstrates commitment to integrity and ethical values |
| CC1.2 | Exercises oversight responsibility |
| CC1.3 | Establishes structure, authority, and responsibility |
| CC1.4 | Demonstrates commitment to competence |
| CC1.5 | Enforces accountability |
| CC2.1 | Uses relevant quality information |
| CC2.2 | Communicates internally |
| CC2.3 | Communicates externally |
| CC3.1 | Specifies suitable objectives |
| CC3.2 | Identifies and analyzes risk |
| CC3.3 | Assesses fraud risk |
| CC3.4 | Identifies and analyzes significant change |
| CC4.1 | Conducts ongoing and/or separate evaluations |
| CC4.2 | Evaluates and communicates deficiencies |
| CC5.1 | Selects and develops control activities |
| CC5.2 | Selects and develops general control activities over technology |
| CC5.3 | Deploys through policies and procedures |
| CC6.1 | |
| CC6.2 | |
| CC6.3 | |
| CC6.4 | |
| CC6.5 | |
| CC6.6 | |
| CC6.7 | |
| CC6.8 | |
| CC7.1 | |
| CC7.2 | |
| CC7.3 | |
| CC7.4 | |
| CC7.5 | |
| CC8.1 | |
| CC9.1 | |
| CC9.2 |