SOC2-CC2.2 CC2.2 Internal communication of objectives and control responsibilities (COSO principle 14)
SOC2-CC2.2 in SOC 2 (the AICPA 2017 Trust Services Criteria with the revised points of focus). All SOC 2 controls held. Open SOC 2 on the standards site.
The control as we hold it
CC2.2 Internal communication of objectives and control responsibilities (COSO principle 14). Information needed for internal control, including objectives and control duties, is communicated inside the organisation. Points of focus: a process lets all personnel understand and carry out their control duties; management and the board exchange what each needs; separate channels such as a whistle-blowing line exist when normal routes fail; the method suits timing, audience and content; people who design, run or monitor controls are told their responsibilities and changes to them; staff know how to report failures, incidents and concerns; objectives and changes are communicated promptly; a.
Reviewed and closest counterparts in the other frameworks
Reviewed rows come from a released pair; a closest match is the nearest held text and is not a reviewed row.
HIPAA Security Rule
- 164.308(a)(5)(i) Security Awareness and Training (Standard) (closest match)
- 164.308(a)(5)(ii)(A) Security Reminders (Addressable) (closest match)
- 164.316(b)(2)(ii) Availability (Documentation) (closest match)
NIST SP 800-53 Rev 5
- NIST800-AT-1 AT-1 Policy and Procedures (closest match)
- NIST800-AT-2 AT-2 Literacy Training and Awareness (closest match)
- NIST800-AT-3 AT-3 Role-based Training (closest match)
- NIST800-PL-4 PL-4 Rules of Behavior (closest match)
- NIST800-PL-7 PL-7 Concept of Operations (closest match)
- NIST800-PM-1 PM-1 Information Security Program Plan (closest match)
- NIST800-PM-18 PM-18 Privacy Program Plan (closest match)
- NIST800-PT-1 PT-1 Policy and Procedures (closest match)
What an auditor commonly asks for
General guidance for this control area (domain: CC - Common Criteria (Security)), in our words, not a statement of the standard and not binding on an assessor.
- the board or management oversight record
- the risk assessment and its treatment
- the access-review and change-approval records
- the monitoring, logging and incident records