SOC 2 Controls Explained: CC1-CC9 and the Trust Services Criteria | Osto<\/title>\n<meta name=\"description\" content=\"A plain-English reference to the nine SOC 2 Common Criteria (CC1-CC9), the four optional Trust Services Criteria, where auditors find the most gaps, and how criteria differ from controls.\">\n<style>\n :root{\n --ink:#0e1330;\n --brand:#1c267a;\n --brand-2:#3a46c0;\n --accent:#00c2a8;\n --accent-soft:#e6f7f4;\n --paper:#ffffff;\n --mist:#f4f6fb;\n --line:#e3e7f2;\n --muted:#5a6284;\n --danger:#e2564d;\n --radius:16px;\n --shadow:0 1px 2px rgba(16,19,48,.04),0 12px 40px rgba(16,19,48,.06);\n --maxw:860px;\n }\n *{box-sizing:border-box}\n html{scroll-behavior:smooth}\n body{\n margin:0;\n font-family:-apple-system,BlinkMacSystemFont,\"Segoe UI\",Inter,Roboto,Helvetica,Arial,sans-serif;\n color:var(--ink);background:var(--paper);line-height:1.65;-webkit-font-smoothing:antialiased;\n }\n a{color:var(--brand-2);text-decoration:none}\n a:hover{text-decoration:underline}\n\n .topbar{border-bottom:1px solid var(--line);background:rgba(255,255,255,.9);backdrop-filter:saturate(160%) blur(8px);position:sticky;top:0;z-index:20}\n .topbar-inner{max-width:1120px;margin:0 auto;padding:14px 24px;display:flex;align-items:center;justify-content:space-between;gap:16px}\n .logo{display:flex;align-items:center;gap:9px;font-weight:800;letter-spacing:-.02em;color:var(--brand);font-size:20px}\n .logo-mark{width:26px;height:26px;border-radius:8px;background:linear-gradient(135deg,var(--brand),var(--brand-2));display:grid;place-items:center;color:#fff;font-size:14px;font-weight:800}\n .nav-cta{background:var(--brand);color:#fff;padding:9px 18px;border-radius:10px;font-weight:600;font-size:14px;white-space:nowrap}\n .nav-cta:hover{background:var(--brand-2);text-decoration:none}\n\n .wrap{max-width:var(--maxw);margin:0 auto;padding:0 24px}\n .breadcrumb{font-size:13px;color:var(--muted);padding:26px 0 6px}\n .breadcrumb a{color:var(--muted)}\n .eyebrow{display:inline-block;margin:22px 0 14px;font-size:12px;font-weight:700;letter-spacing:.14em;text-transform:uppercase;color:var(--brand-2);background:var(--mist);padding:6px 12px;border-radius:999px;border:1px solid var(--line)}\n h1{font-size:clamp(30px,5vw,46px);line-height:1.1;letter-spacing:-.03em;margin:0 0 18px;font-weight:800}\n .dek{font-size:19px;color:var(--muted);margin:0 0 8px;max-width:50ch}\n\n .meta{display:flex;flex-wrap:wrap;gap:8px 20px;align-items:center;font-size:13px;color:var(--muted);margin:22px 0 4px;padding-bottom:26px;border-bottom:1px solid var(--line)}\n .meta .dot{width:4px;height:4px;border-radius:50%;background:var(--line)}\n\n .tldr{margin:30px 0;border:1px solid var(--line);background:linear-gradient(180deg,var(--accent-soft),#fff 70%);border-radius:var(--radius);padding:22px 24px}\n .tldr h2{margin:0 0 8px;font-size:13px;letter-spacing:.14em;text-transform:uppercase;color:var(--brand)}\n .tldr p{margin:0 0 10px;font-size:16.5px}\n .tldr p:last-child{margin:0}\n\n h2.sec{font-size:27px;letter-spacing:-.02em;margin:52px 0 14px;font-weight:800;scroll-margin-top:80px}\n h3{font-size:20px;margin:34px 0 10px;letter-spacing:-.01em;font-weight:700}\n p{margin:0 0 16px;font-size:16.5px}\n .lead-in{color:var(--muted)}\n em{font-style:italic}\n\n .jump{background:var(--mist);border:1px solid var(--line);border-radius:var(--radius);padding:20px 24px;margin:30px 0}\n .jump h4{margin:0 0 12px;font-size:13px;letter-spacing:.1em;text-transform:uppercase;color:var(--muted)}\n .jump ol{margin:0;padding-left:20px;columns:2;column-gap:32px}\n .jump li{margin:6px 0;font-size:15px}\n @media(max-width:560px){.jump ol{columns:1}}\n\n .analogy{background:var(--mist);border-radius:var(--radius);padding:20px 22px;margin:22px 0;border:1px solid var(--line);font-size:16.5px}\n .analogy strong{color:var(--brand)}\n\n ul.clean{padding-left:0;list-style:none;margin:16px 0}\n ul.clean li{position:relative;padding:6px 0 6px 30px;font-size:16px;border-bottom:1px solid var(--mist)}\n ul.clean li:last-child{border-bottom:none}\n ul.clean li::before{content:\"\";position:absolute;left:4px;top:14px;width:9px;height:9px;border-radius:3px;background:var(--accent)}\n ul.warn li::before{background:var(--danger)}\n\n \/* TSC cards *\/\n .tsc{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:22px 0}\n .tsc-card{border:1px solid var(--line);border-radius:14px;padding:18px;background:#fff}\n .tsc-card.req{border-color:var(--brand);background:#f6f8ff}\n .tsc-card .tag{font-size:11px;font-weight:700;letter-spacing:.08em;text-transform:uppercase;color:var(--muted)}\n .tsc-card.req .tag{color:var(--brand)}\n .tsc-card h4{margin:6px 0 6px;font-size:16px;color:var(--ink)}\n .tsc-card p{font-size:14px;color:var(--muted);margin:0}\n @media(max-width:720px){.tsc{grid-template-columns:1fr 1fr}}\n @media(max-width:480px){.tsc{grid-template-columns:1fr}}\n\n \/* stat band *\/\n .fig{margin:30px 0;border:1px solid var(--line);border-radius:var(--radius);overflow:hidden;box-shadow:var(--shadow)}\n .fig-head{padding:16px 22px;background:var(--brand);color:#fff;display:flex;align-items:baseline;justify-content:space-between;gap:12px;flex-wrap:wrap}\n .fig-head .ttl{font-weight:700;font-size:15px;letter-spacing:.02em}\n .fig-head .src{font-size:11.5px;color:#b9c0f0}\n .fig-foot{padding:14px 22px;border-top:1px solid var(--line);font-size:12.5px;color:var(--muted);background:#fbfcfe}\n .stat-band{display:grid;grid-template-columns:repeat(3,1fr)}\n .stat-cell{padding:24px 16px;text-align:center;border-right:1px solid var(--line)}\n .stat-cell:last-child{border-right:none}\n .stat-cell .num{font-size:30px;font-weight:800;color:var(--brand);letter-spacing:-.02em;line-height:1.05}\n .stat-cell .num.accent{color:var(--accent)}\n .stat-cell .lab{font-size:12.5px;color:var(--muted);margin-top:8px;line-height:1.4}\n @media(max-width:560px){.stat-band{grid-template-columns:1fr}.stat-cell{border-right:none;border-bottom:1px solid var(--line)}.stat-cell:last-child{border-bottom:none}}\n\n \/* timeline *\/\n .timeline{padding:8px 24px 4px}\n .tl-item{display:grid;grid-template-columns:130px 1fr;gap:16px;padding:14px 0;border-bottom:1px solid var(--mist)}\n .tl-item:last-child{border-bottom:none}\n .tl-date{font-weight:800;color:var(--brand);font-size:14px}\n .tl-what{font-size:14.5px}\n .tl-what b{display:block;margin-bottom:2px}\n @media(max-width:520px){.tl-item{grid-template-columns:1fr;gap:2px}}\n\n .tablewrap{overflow-x:auto;margin:22px 0;border:1px solid var(--line);border-radius:var(--radius);box-shadow:var(--shadow)}\n table{border-collapse:collapse;width:100%;min-width:600px;font-size:14.5px}\n thead th{background:var(--mist);text-align:left;padding:14px 16px;font-size:12.5px;text-transform:uppercase;letter-spacing:.05em;color:var(--muted);border-bottom:1px solid var(--line);font-weight:700}\n thead th.osto{background:var(--brand);color:#fff}\n tbody td{padding:14px 16px;border-bottom:1px solid var(--line);vertical-align:top}\n tbody tr:last-child td{border-bottom:none}\n tbody td:first-child{font-weight:600;color:var(--ink)}\n td.osto{background:#f6f8ff;font-weight:600}\n .yes{color:var(--accent);font-weight:700}\n .no{color:var(--danger);font-weight:700}\n\n .callout{border:1px solid var(--line);border-radius:var(--radius);padding:24px;margin:44px 0;background:linear-gradient(135deg,#141b52,#2a34a0);color:#fff;box-shadow:var(--shadow)}\n .callout h3{margin:0 0 8px;color:#fff}\n .callout p{color:#cfd4f5;margin:0 0 18px}\n .callout a.btn{display:inline-block;background:#fff;color:var(--brand);font-weight:700;padding:11px 22px;border-radius:10px;font-size:15px}\n .callout a.btn:hover{text-decoration:none;background:#eef0ff}\n\n .disclaimer{font-size:13.5px;color:var(--muted);background:var(--mist);border:1px solid var(--line);border-radius:12px;padding:16px 18px;margin:34px 0}\n\n .faq{border-top:1px solid var(--line);margin-top:48px;padding-top:8px}\n details{border-bottom:1px solid var(--line);padding:6px 0}\n summary{cursor:pointer;list-style:none;padding:16px 4px;font-weight:600;font-size:17px;display:flex;justify-content:space-between;align-items:center;gap:16px}\n summary::-webkit-details-marker{display:none}\n summary::after{content:\"+\";color:var(--brand-2);font-size:22px;font-weight:400}\n details[open] summary::after{content:\"\u2013\"}\n details p{padding:0 4px 18px;color:var(--muted);margin:0}\n\n footer{border-top:1px solid var(--line);margin-top:60px;background:var(--mist)}\n .foot-inner{max-width:1120px;margin:0 auto;padding:36px 24px;display:flex;flex-wrap:wrap;gap:16px;justify-content:space-between;align-items:center;font-size:14px;color:var(--muted)}\n .foot-inner .logo{font-size:17px}\n\n .related{margin:42px 0 0}\n .related h3{margin-bottom:14px}\n .related-grid{display:grid;grid-template-columns:1fr 1fr;gap:14px}\n .rc{border:1px solid var(--line);border-radius:12px;padding:16px 18px;background:#fff}\n .rc .k{font-size:11px;letter-spacing:.1em;color:var(--brand-2);font-weight:700;text-transform:uppercase}\n .rc a{font-weight:600;color:var(--ink);display:block;margin-top:6px;font-size:15.5px}\n @media(max-width:640px){.related-grid{grid-template-columns:1fr}}\n\n \/* --- bright, clean additions --- *\/\n .bright-strip{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:30px 0}\n .bright-strip .bcard{border-radius:16px;padding:22px 20px;color:#fff}\n .bright-strip .bcard .n{font-size:26px;font-weight:800;line-height:1.1}\n .bright-strip .bcard .l{font-size:13px;margin-top:6px;opacity:.95;font-weight:500}\n .bc-navy{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n .bc-teal{background:linear-gradient(135deg,#00c2a8,#12b3d6)}\n .bc-indigo{background:linear-gradient(135deg,#3a46c0,#5a63d6)}\n @media(max-width:640px){.bright-strip{grid-template-columns:1fr}}\n\n .pillrow{display:flex;gap:10px;flex-wrap:wrap;margin:22px 0}\n .pill{border-radius:999px;padding:9px 16px;font-size:14px;font-weight:600;background:var(--accent-soft);color:#0a7a68;border:1px solid #bfece4}\n .pill.i{background:#eef0ff;color:#3a46c0;border-color:#d6dbff}\n\n .bigcards{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:26px 0}\n .bigcard{border-radius:16px;padding:22px;background:#fff;border:1px solid var(--line);box-shadow:0 8px 30px rgba(16,19,48,.05)}\n .bigcard .ic{width:44px;height:44px;border-radius:12px;display:grid;place-items:center;font-size:20px;font-weight:800;color:#fff;margin-bottom:12px}\n .bigcard h4{margin:0 0 6px;font-size:16px;color:var(--ink)}\n .bigcard p{margin:0;font-size:13.5px;color:var(--muted)}\n @media(max-width:720px){.bigcards{grid-template-columns:1fr}}\n\n .keyrow{display:grid;grid-template-columns:1fr 1fr;gap:0;border-radius:16px;overflow:hidden;border:1px solid var(--line);margin:26px 0}\n .keyrow>div{padding:20px 22px}\n .keyrow .k1{background:#eef0ff}\n .keyrow .k2{background:var(--accent-soft)}\n .keyrow .lab{font-size:11px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;margin-bottom:6px}\n .keyrow .k1 .lab{color:#3a46c0}.keyrow .k2 .lab{color:#0a7a68}\n .keyrow .big{font-size:19px;font-weight:800;color:var(--brand);margin-bottom:4px}\n .keyrow .sm{font-size:13.5px;color:var(--muted)}\n @media(max-width:560px){.keyrow{grid-template-columns:1fr}}\n\n .flow{display:flex;gap:8px;flex-wrap:wrap;align-items:stretch;margin:26px 0}\n .flow .step{flex:1;min-width:130px;border-radius:14px;padding:16px 14px;text-align:center}\n .flow .step .t{font-weight:800;font-size:14px}\n .flow .step .d{font-size:12px;margin-top:4px;opacity:.9}\n .flow .arrow{align-self:center;color:#c3c9e6;font-size:20px;font-weight:700}\n\n\n .ccmap{border:1px solid var(--line);border-radius:16px;overflow:hidden;margin:24px 0;box-shadow:0 8px 30px rgba(16,19,48,.05)}\n .ccmap .cctop{background:linear-gradient(135deg,#1c267a,#3a46c0);color:#fff;text-align:center;padding:12px;font-weight:700;font-size:13.5px}\n .ccmap .ccbody{display:grid;grid-template-columns:1fr 1fr;gap:0}\n .ccmap .cccol{padding:18px 20px}\n .ccmap .cccol.gov{background:#eef0ff}\n .ccmap .cccol.tech{background:#e6f7f4}\n .ccmap .cclab{font-size:11px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;margin-bottom:8px}\n .ccmap .gov .cclab{color:#3a46c0}.ccmap .tech .cclab{color:#0a7a68}\n .ccmap .ccitem{font-size:13px;color:var(--ink);padding:5px 0;display:flex;gap:8px}\n .ccmap .ccitem b{color:var(--brand);flex:none;width:42px}\n @media(max-width:600px){.ccmap .ccbody{grid-template-columns:1fr}}\n .critcard{border:1px solid var(--line);border-radius:14px;padding:16px 18px;background:#fff;box-shadow:0 6px 24px rgba(16,19,48,.04);margin:12px 0}\n .critcard .ct{display:flex;align-items:center;gap:10px;margin-bottom:6px}\n .critcard .code{font-size:12px;font-weight:800;color:#fff;background:linear-gradient(135deg,#1c267a,#3a46c0);padding:3px 9px;border-radius:6px;flex:none}\n .critcard.tech .code{background:linear-gradient(135deg,#00c2a8,#12b3d6);color:#04261b}\n .critcard h4{margin:0;font-size:14.5px;color:var(--ink)}\n .critcard p{margin:4px 0 0;font-size:13px;color:var(--muted)}\n .critcard .asks{font-size:12.5px;color:var(--brand);margin-top:7px;background:var(--mist);padding:8px 11px;border-radius:8px}\n\n\n \/* colored-border callout variants: white fill, medium colored border, four sides *\/\n .bbox{border-radius:14px;background:#fff;padding:16px 20px;margin:22px 0;font-size:14.5px;line-height:1.6}\n .bbox strong{color:var(--brand)}\n .bbox.navy{border:2px solid #1c267a}\n .bbox.indigo{border:2px solid #3a46c0}\n .bbox.teal{border:2px solid #00c2a8}\n .bbox .bt{font-size:11px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;margin-bottom:5px}\n .bbox.navy .bt{color:#1c267a}.bbox.indigo .bt{color:#3a46c0}.bbox.teal .bt{color:#0a7a68}\n\n .callout a[href*=\"book-demo\"]{color:#ffffff !important;font-weight:700;text-decoration:underline}\n .callout a[href*=\"book-demo\"] span{color:#ffffff !important}\n<\/style>\n<\/head>\n<body>\n\n<div class=\"wrap\">\n <p class=\"dek\">A guide to the SOC 2 controls: the nine Common Criteria that define SOC 2 Security, the four optional criteria, and the categories where audit findings most often arise.<\/p>\n\n <div class=\"meta\">\n <span>Osto Security Team<\/span>\n <span class=\"dot\"><\/span>\n <span>8 min read<\/span>\n <span class=\"dot\"><\/span>\n <span>Compliance & Trust<\/span>\n <\/div>\n\n <div class=\"tldr\">\n <h2>TL;DR<\/h2>\n <p>SOC 2 controls are not a fixed checklist. SOC 2 sets criteria your controls must satisfy, and the mandatory Security criterion is defined by nine Common Criteria, CC1 through CC9.<\/p>\n <p>CC1 to CC5 cover governance and internal control. CC6 to CC9 are the technical core: access, operations, change, and risk. CC6 and CC7 are where auditors find the most gaps.<\/p>\n <\/div>\n\n <div class=\"jump\">\n <h4>On this page<\/h4>\n <ol>\n <li><a href=\"#structure\">How controls are structured<\/a><\/li>\n <li><a href=\"#gov\">CC1-CC5: governance<\/a><\/li>\n <li><a href=\"#tech\">CC6-CC9: technical core<\/a><\/li>\n <li><a href=\"#gaps\">Where gaps cluster<\/a><\/li>\n <li><a href=\"#optional\">The 4 optional criteria<\/a><\/li>\n <li><a href=\"#focus\">Criteria vs controls<\/a><\/li>\n <li><a href=\"#osto\">Satisfying them in practice<\/a><\/li>\n <\/ol>\n <\/div>\n\n <h2 class=\"sec\" id=\"structure\">How SOC 2 controls are structured<\/h2>\n <p>SOC 2 does not hand you a list of controls to implement. It gives you criteria, which are objectives your controls have to meet. The criteria sit under the five Trust Services Criteria published by the AICPA. Only Security is mandatory, and it breaks into nine Common Criteria.<\/p>\n\n <div class=\"ccmap\">\n <div class=\"cctop\">Security (mandatory) = 9 Common Criteria<\/div>\n <div class=\"ccbody\">\n <div class=\"cccol gov\">\n <div class=\"cclab\">CC1-CC5 · Governance<\/div>\n <div class=\"ccitem\"><b>CC1<\/b>Control environment<\/div>\n <div class=\"ccitem\"><b>CC2<\/b>Communication & information<\/div>\n <div class=\"ccitem\"><b>CC3<\/b>Risk assessment<\/div>\n <div class=\"ccitem\"><b>CC4<\/b>Monitoring activities<\/div>\n <div class=\"ccitem\"><b>CC5<\/b>Control activities<\/div>\n <\/div>\n <div class=\"cccol tech\">\n <div class=\"cclab\">CC6-CC9 · Technical<\/div>\n <div class=\"ccitem\"><b>CC6<\/b>Logical & physical access<\/div>\n <div class=\"ccitem\"><b>CC7<\/b>System operations<\/div>\n <div class=\"ccitem\"><b>CC8<\/b>Change management<\/div>\n <div class=\"ccitem\"><b>CC9<\/b>Risk mitigation<\/div>\n <\/div>\n <\/div>\n <\/div>\n\n <div class=\"bbox teal\"><div class=\"bt\">The split in one line<\/div>CC1 to CC5 map to the COSO internal-control framework and ask whether your organisation is run in a way that can be trusted with data. CC6 to CC9 are the hands-on security controls.<\/div>\n\n <h2 class=\"sec\" id=\"gov\">CC1-CC5: the governance foundation<\/h2>\n <p>These five SOC 2 controls are less about firewalls and more about whether your organisation is structured to be trusted with data.<\/p>\n\n <div class=\"critcard\"><div class=\"ct\"><span class=\"code\">CC1<\/span><h4>Control environment<\/h4><\/div><p>The tone at the top: structure, roles, accountability, and ethical culture to support security.<\/p><div class=\"asks\"><strong>Asks:<\/strong> Do you have defined roles, committed leadership, background checks, and competent security people?<\/div><\/div>\n <div class=\"critcard\"><div class=\"ct\"><span class=\"code\">CC2<\/span><h4>Communication & information<\/h4><\/div><p>How security information flows, internally to your team and externally to customers and partners.<\/p><div class=\"asks\"><strong>Asks:<\/strong> Are security policies, responsibilities, and expectations clearly communicated to those who need them?<\/div><\/div>\n <div class=\"critcard\"><div class=\"ct\"><span class=\"code\">CC3<\/span><h4>Risk assessment<\/h4><\/div><p>Whether you actively identify, analyse, and plan to treat risks to your systems and data, including fraud risk.<\/p><div class=\"asks\"><strong>Asks:<\/strong> Do you run a real risk assessment, set objectives, and account for how changes affect risk?<\/div><\/div>\n <div class=\"critcard\"><div class=\"ct\"><span class=\"code\">CC4<\/span><h4>Monitoring activities<\/h4><\/div><p>Ongoing evaluation of whether your controls are present and working, and remediation when they are not.<\/p><div class=\"asks\"><strong>Asks:<\/strong> Do you continuously check that controls function, and fix deficiencies you find?<\/div><\/div>\n <div class=\"critcard\"><div class=\"ct\"><span class=\"code\">CC5<\/span><h4>Control activities<\/h4><\/div><p>The bridge from policy to action: the activities, technology, and procedures that carry out security directives.<\/p><div class=\"asks\"><strong>Asks:<\/strong> Are policies translated into concrete control activities, including technology general controls?<\/div><\/div>\n\n <h2 class=\"sec\" id=\"tech\">CC6-CC9: the technical core<\/h2>\n <p>This is where the SOC 2 controls get hands-on. These four are security-specific and cover most of what people picture as security controls.<\/p>\n\n <div class=\"critcard tech\"><div class=\"ct\"><span class=\"code\">CC6<\/span><h4>Logical & physical access<\/h4><\/div><p>The biggest category. Who and what can access your systems and data: authentication, authorisation, encryption, network and physical access.<\/p><div class=\"asks\"><strong>Asks:<\/strong> Is access restricted to the right people, protected by MFA and encryption, and removed promptly when someone leaves?<\/div><\/div>\n <div class=\"critcard tech\"><div class=\"ct\"><span class=\"code\">CC7<\/span><h4>System operations<\/h4><\/div><p>Running systems securely day to day: detecting issues, monitoring, vulnerability management, and incident response.<\/p><div class=\"asks\"><strong>Asks:<\/strong> Do you monitor for anomalies, manage vulnerabilities, and have a working incident response process?<\/div><\/div>\n <div class=\"critcard tech\"><div class=\"ct\"><span class=\"code\">CC8<\/span><h4>Change management<\/h4><\/div><p>How changes to systems and code are requested, reviewed, approved, and deployed without introducing security risk.<\/p><div class=\"asks\"><strong>Asks:<\/strong> Are system and code changes documented, reviewed, and approved before they ship?<\/div><\/div>\n <div class=\"critcard tech\"><div class=\"ct\"><span class=\"code\">CC9<\/span><h4>Risk mitigation<\/h4><\/div><p>Reducing the impact of disruptions and third-party risk, through contingency planning and vendor management.<\/p><div class=\"asks\"><strong>Asks:<\/strong> Do you plan for business disruption and assess the risk your vendors introduce?<\/div><\/div>\n\n <h2 class=\"sec\" id=\"gaps\">Where auditors actually find the gaps<\/h2>\n <p>If you are prioritising, put your energy into CC6 and CC7. Across first-time SOC 2 engagements, these two generate the most exceptions by a wide margin.<\/p>\n\n <div class=\"keyrow\">\n <div class=\"k1\"><div class=\"lab\">CC6 · Access<\/div><div class=\"big\">The usual culprits<\/div><div class=\"sm\">Missing MFA, access not removed when someone leaves, and weak or undocumented access reviews.<\/div><\/div>\n <div class=\"k2\"><div class=\"lab\">CC7 · Operations<\/div><div class=\"big\">The usual culprits<\/div><div class=\"sm\">No real monitoring, unmanaged vulnerabilities, and an incident response process that exists only on paper.<\/div><\/div>\n <\/div>\n\n <h2 class=\"sec\" id=\"optional\">The four optional Trust Services Criteria<\/h2>\n <p>Security (CC1-CC9) is mandatory. The other four are optional. Add them only when your customer commitments or contracts call for them, because each one widens scope.<\/p>\n\n <div class=\"bigcards\">\n <div class=\"bigcard\"><div class=\"ic bc-navy\">A<\/div><h4>Availability<\/h4><p>Whether your system is up and reachable as promised. For uptime and SLA commitments.<\/p><\/div>\n <div class=\"bigcard\"><div class=\"ic bc-indigo\">C<\/div><h4>Confidentiality<\/h4><p>Protecting information meant to stay restricted, like customer business data.<\/p><\/div>\n <div class=\"bigcard\"><div class=\"ic bc-teal\">P<\/div><h4>Processing Integrity<\/h4><p>Whether data is processed completely, accurately, and on time. For fintech and data platforms.<\/p><\/div>\n <div class=\"bigcard\"><div class=\"ic bc-navy\">Pr<\/div><h4>Privacy<\/h4><p>How you collect, use, retain, and dispose of personal information against your commitments.<\/p><\/div>\n <\/div>\n\n <h2 class=\"sec\" id=\"focus\">Criteria, controls, and points of focus<\/h2>\n <p>One more layer worth knowing. Under each criterion sit points of focus: the AICPA’s suggested considerations for what a control satisfying that criterion might address. They are guidance, not a checklist.<\/p>\n\n <div class=\"bbox indigo\"><div class=\"bt\">A widely followed practice<\/div>Support each criterion with at least two or three controls. That way, if one control fails during the audit period, the others still satisfy the criterion and you avoid an exception.<\/div>\n\n <h2 class=\"sec\" id=\"osto\">Satisfying the criteria in practice<\/h2>\n <p>Read back over the SOC 2 controls in CC1 to CC9 and a pattern emerges. Most of these criteria describe security functions that have to genuinely run and produce <a href=\"https:\/\/www.osto.one\/resources\/soc-2-evidence-collection\">evidence<\/a>: access control and MFA, monitoring, change management, vulnerability management, vendor risk. The criteria are the objective; running controls with a clean evidence trail is how you meet them.<\/p>\n\n <div class=\"analogy\"><strong>That is where a single platform changes the math.<\/strong> With Osto, the controls these criteria call for are built in and running: access controls and MFA enforcement, continuous monitoring, VAPT, and change management, with the evidence collected from the same modules. The CC6 and CC7 categories that trip up most first-timers are handled by the platform itself.<\/div>\n\n <div class=\"callout\">\n <h3>Close the CC6 and CC7 gaps before the auditor looks.<\/h3>\n <p>Osto is a one-stop cybersecurity and compliance platform for growing companies. The controls behind CC1-CC9, access, <a href=\"https:\/\/www.osto.one\/resources\/mfa-glossary\">MFA<\/a>, monitoring, <a href=\"https:\/\/www.osto.one\/resources\/vapt-glossary\">VAPT<\/a>, change management, run on one platform, with the evidence collected in the same place, so you can get SOC 2 ready in about 115 days.<\/p>\n <p style=\"margin-top:16px;\"><a href=\"https:\/\/osto.one\/book-demo\/\" style=\"color:#ffffff;font-weight:700;text-decoration:underline;\" target=\"_blank\" rel=\"noopener\"><span style=\"color:#ffffff;\">Book a Demo →<\/span><\/a><\/p>\n <\/div>\n\n <h2 class=\"sec\" id=\"faq\">Frequently asked questions<\/h2>\n\n <details>\n <summary>What are the SOC 2 Common Criteria?<\/summary>\n <p>The nine categories that make up the mandatory Security Trust Services Criterion in every SOC 2 report: CC1 (Control Environment), CC2 (Communication and Information), CC3 (Risk Assessment), CC4 (Monitoring), CC5 (Control Activities), CC6 (Logical and Physical Access), CC7 (System Operations), CC8 (Change Management), and CC9 (Risk Mitigation).<\/p>\n <\/details>\n <details>\n <summary>How many controls are in SOC 2?<\/summary>\n <p>SOC 2 defines criteria rather than a fixed list of controls, so the exact number varies by company. The mandatory Security criterion contains 33 Common Criteria points across CC1-CC9, and you implement whatever set of controls satisfies them for your environment.<\/p>\n <\/details>\n <details>\n <summary>Which criteria cause the most audit findings?<\/summary>\n <p>CC6 (Logical and Physical Access Controls) and CC7 (System Operations) generate the most findings in first-time audits. Recurring causes for CC6 are missing MFA and access not removed when people leave; for CC7 they are weak monitoring and vulnerability management.<\/p>\n <\/details>\n <details>\n <summary>Is Security the only mandatory criterion?<\/summary>\n <p>Yes. Security, made up of the nine Common Criteria (CC1-CC9), is the only mandatory Trust Services Criterion, and most first-time audits cover it alone. The other four (Availability, Confidentiality, Processing Integrity, Privacy) are added only when a contract requires them.<\/p>\n <\/details>\n <details>\n <summary>What are points of focus?<\/summary>\n <p>The AICPA’s suggested considerations under each criterion, describing what a control satisfying that criterion might address. They are guidance to help you design controls, not a mandatory checklist.<\/p>\n <\/details>\n\n<\/div>\n<\/body>\n<\/html>\n","protected":false},"excerpt":{"rendered":"<p>SOC 2 Controls Explained: CC1-CC9 and the Trust Services Criteria | Osto A guide to the SOC 2 controls: the\u2026<\/p>\n","protected":false},"author":8,"featured_media":581,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[],"class_list":["post-580","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog"],"_links":{"self":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/580","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/comments?post=580"}],"version-history":[{"count":1,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/580\/revisions"}],"predecessor-version":[{"id":582,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/580\/revisions\/582"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media\/581"}],"wp:attachment":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media?parent=580"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/categories?post=580"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/tags?post=580"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":580,"date":"2026-08-09T17:36:30","date_gmt":"2026-08-09T17:36:30","guid":{"rendered":"https:\/\/www.osto.one\/resources\/?p=580"},"modified":"2026-08-09T17:36:30","modified_gmt":"2026-08-09T17:36:30","slug":"soc-2-controls-cc1-cc9","status":"publish","type":"post","link":"https:\/\/www.osto.one\/resources\/blog\/soc-2-controls-cc1-cc9\/","title":{"rendered":"SOC 2 Controls Explained: CC1-CC9 and the Trust Services Criteria"},"content":{"rendered":"\n\n\n\n\n\nSOC 2 Controls Explained: CC1-CC9 and the Trust Services Criteria | Osto<\/title>\n<meta name=\"description\" content=\"A plain-English reference to the nine SOC 2 Common Criteria (CC1-CC9), the four optional Trust Services Criteria, where auditors find the most gaps, and how criteria differ from controls.\">\n<style>\n :root{\n --ink:#0e1330;\n --brand:#1c267a;\n --brand-2:#3a46c0;\n --accent:#00c2a8;\n --accent-soft:#e6f7f4;\n --paper:#ffffff;\n --mist:#f4f6fb;\n --line:#e3e7f2;\n --muted:#5a6284;\n --danger:#e2564d;\n --radius:16px;\n --shadow:0 1px 2px rgba(16,19,48,.04),0 12px 40px rgba(16,19,48,.06);\n --maxw:860px;\n }\n *{box-sizing:border-box}\n html{scroll-behavior:smooth}\n body{\n margin:0;\n font-family:-apple-system,BlinkMacSystemFont,\"Segoe UI\",Inter,Roboto,Helvetica,Arial,sans-serif;\n color:var(--ink);background:var(--paper);line-height:1.65;-webkit-font-smoothing:antialiased;\n }\n a{color:var(--brand-2);text-decoration:none}\n a:hover{text-decoration:underline}\n\n .topbar{border-bottom:1px solid var(--line);background:rgba(255,255,255,.9);backdrop-filter:saturate(160%) blur(8px);position:sticky;top:0;z-index:20}\n .topbar-inner{max-width:1120px;margin:0 auto;padding:14px 24px;display:flex;align-items:center;justify-content:space-between;gap:16px}\n .logo{display:flex;align-items:center;gap:9px;font-weight:800;letter-spacing:-.02em;color:var(--brand);font-size:20px}\n .logo-mark{width:26px;height:26px;border-radius:8px;background:linear-gradient(135deg,var(--brand),var(--brand-2));display:grid;place-items:center;color:#fff;font-size:14px;font-weight:800}\n .nav-cta{background:var(--brand);color:#fff;padding:9px 18px;border-radius:10px;font-weight:600;font-size:14px;white-space:nowrap}\n .nav-cta:hover{background:var(--brand-2);text-decoration:none}\n\n .wrap{max-width:var(--maxw);margin:0 auto;padding:0 24px}\n .breadcrumb{font-size:13px;color:var(--muted);padding:26px 0 6px}\n .breadcrumb a{color:var(--muted)}\n .eyebrow{display:inline-block;margin:22px 0 14px;font-size:12px;font-weight:700;letter-spacing:.14em;text-transform:uppercase;color:var(--brand-2);background:var(--mist);padding:6px 12px;border-radius:999px;border:1px solid var(--line)}\n h1{font-size:clamp(30px,5vw,46px);line-height:1.1;letter-spacing:-.03em;margin:0 0 18px;font-weight:800}\n .dek{font-size:19px;color:var(--muted);margin:0 0 8px;max-width:50ch}\n\n .meta{display:flex;flex-wrap:wrap;gap:8px 20px;align-items:center;font-size:13px;color:var(--muted);margin:22px 0 4px;padding-bottom:26px;border-bottom:1px solid var(--line)}\n .meta .dot{width:4px;height:4px;border-radius:50%;background:var(--line)}\n\n .tldr{margin:30px 0;border:1px solid var(--line);background:linear-gradient(180deg,var(--accent-soft),#fff 70%);border-radius:var(--radius);padding:22px 24px}\n .tldr h2{margin:0 0 8px;font-size:13px;letter-spacing:.14em;text-transform:uppercase;color:var(--brand)}\n .tldr p{margin:0 0 10px;font-size:16.5px}\n .tldr p:last-child{margin:0}\n\n h2.sec{font-size:27px;letter-spacing:-.02em;margin:52px 0 14px;font-weight:800;scroll-margin-top:80px}\n h3{font-size:20px;margin:34px 0 10px;letter-spacing:-.01em;font-weight:700}\n p{margin:0 0 16px;font-size:16.5px}\n .lead-in{color:var(--muted)}\n em{font-style:italic}\n\n .jump{background:var(--mist);border:1px solid var(--line);border-radius:var(--radius);padding:20px 24px;margin:30px 0}\n .jump h4{margin:0 0 12px;font-size:13px;letter-spacing:.1em;text-transform:uppercase;color:var(--muted)}\n .jump ol{margin:0;padding-left:20px;columns:2;column-gap:32px}\n .jump li{margin:6px 0;font-size:15px}\n @media(max-width:560px){.jump ol{columns:1}}\n\n .analogy{background:var(--mist);border-radius:var(--radius);padding:20px 22px;margin:22px 0;border:1px solid var(--line);font-size:16.5px}\n .analogy strong{color:var(--brand)}\n\n ul.clean{padding-left:0;list-style:none;margin:16px 0}\n ul.clean li{position:relative;padding:6px 0 6px 30px;font-size:16px;border-bottom:1px solid var(--mist)}\n ul.clean li:last-child{border-bottom:none}\n ul.clean li::before{content:\"\";position:absolute;left:4px;top:14px;width:9px;height:9px;border-radius:3px;background:var(--accent)}\n ul.warn li::before{background:var(--danger)}\n\n \/* TSC cards *\/\n .tsc{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:22px 0}\n .tsc-card{border:1px solid var(--line);border-radius:14px;padding:18px;background:#fff}\n .tsc-card.req{border-color:var(--brand);background:#f6f8ff}\n .tsc-card .tag{font-size:11px;font-weight:700;letter-spacing:.08em;text-transform:uppercase;color:var(--muted)}\n .tsc-card.req .tag{color:var(--brand)}\n .tsc-card h4{margin:6px 0 6px;font-size:16px;color:var(--ink)}\n .tsc-card p{font-size:14px;color:var(--muted);margin:0}\n @media(max-width:720px){.tsc{grid-template-columns:1fr 1fr}}\n @media(max-width:480px){.tsc{grid-template-columns:1fr}}\n\n \/* stat band *\/\n .fig{margin:30px 0;border:1px solid var(--line);border-radius:var(--radius);overflow:hidden;box-shadow:var(--shadow)}\n .fig-head{padding:16px 22px;background:var(--brand);color:#fff;display:flex;align-items:baseline;justify-content:space-between;gap:12px;flex-wrap:wrap}\n .fig-head .ttl{font-weight:700;font-size:15px;letter-spacing:.02em}\n .fig-head .src{font-size:11.5px;color:#b9c0f0}\n .fig-foot{padding:14px 22px;border-top:1px solid var(--line);font-size:12.5px;color:var(--muted);background:#fbfcfe}\n .stat-band{display:grid;grid-template-columns:repeat(3,1fr)}\n .stat-cell{padding:24px 16px;text-align:center;border-right:1px solid var(--line)}\n .stat-cell:last-child{border-right:none}\n .stat-cell .num{font-size:30px;font-weight:800;color:var(--brand);letter-spacing:-.02em;line-height:1.05}\n .stat-cell .num.accent{color:var(--accent)}\n .stat-cell .lab{font-size:12.5px;color:var(--muted);margin-top:8px;line-height:1.4}\n @media(max-width:560px){.stat-band{grid-template-columns:1fr}.stat-cell{border-right:none;border-bottom:1px solid var(--line)}.stat-cell:last-child{border-bottom:none}}\n\n \/* timeline *\/\n .timeline{padding:8px 24px 4px}\n .tl-item{display:grid;grid-template-columns:130px 1fr;gap:16px;padding:14px 0;border-bottom:1px solid var(--mist)}\n .tl-item:last-child{border-bottom:none}\n .tl-date{font-weight:800;color:var(--brand);font-size:14px}\n .tl-what{font-size:14.5px}\n .tl-what b{display:block;margin-bottom:2px}\n @media(max-width:520px){.tl-item{grid-template-columns:1fr;gap:2px}}\n\n .tablewrap{overflow-x:auto;margin:22px 0;border:1px solid var(--line);border-radius:var(--radius);box-shadow:var(--shadow)}\n table{border-collapse:collapse;width:100%;min-width:600px;font-size:14.5px}\n thead th{background:var(--mist);text-align:left;padding:14px 16px;font-size:12.5px;text-transform:uppercase;letter-spacing:.05em;color:var(--muted);border-bottom:1px solid var(--line);font-weight:700}\n thead th.osto{background:var(--brand);color:#fff}\n tbody td{padding:14px 16px;border-bottom:1px solid var(--line);vertical-align:top}\n tbody tr:last-child td{border-bottom:none}\n tbody td:first-child{font-weight:600;color:var(--ink)}\n td.osto{background:#f6f8ff;font-weight:600}\n .yes{color:var(--accent);font-weight:700}\n .no{color:var(--danger);font-weight:700}\n\n .callout{border:1px solid var(--line);border-radius:var(--radius);padding:24px;margin:44px 0;background:linear-gradient(135deg,#141b52,#2a34a0);color:#fff;box-shadow:var(--shadow)}\n .callout h3{margin:0 0 8px;color:#fff}\n .callout p{color:#cfd4f5;margin:0 0 18px}\n .callout a.btn{display:inline-block;background:#fff;color:var(--brand);font-weight:700;padding:11px 22px;border-radius:10px;font-size:15px}\n .callout a.btn:hover{text-decoration:none;background:#eef0ff}\n\n .disclaimer{font-size:13.5px;color:var(--muted);background:var(--mist);border:1px solid var(--line);border-radius:12px;padding:16px 18px;margin:34px 0}\n\n .faq{border-top:1px solid var(--line);margin-top:48px;padding-top:8px}\n details{border-bottom:1px solid var(--line);padding:6px 0}\n summary{cursor:pointer;list-style:none;padding:16px 4px;font-weight:600;font-size:17px;display:flex;justify-content:space-between;align-items:center;gap:16px}\n summary::-webkit-details-marker{display:none}\n summary::after{content:\"+\";color:var(--brand-2);font-size:22px;font-weight:400}\n details[open] summary::after{content:\"\u2013\"}\n details p{padding:0 4px 18px;color:var(--muted);margin:0}\n\n footer{border-top:1px solid var(--line);margin-top:60px;background:var(--mist)}\n .foot-inner{max-width:1120px;margin:0 auto;padding:36px 24px;display:flex;flex-wrap:wrap;gap:16px;justify-content:space-between;align-items:center;font-size:14px;color:var(--muted)}\n .foot-inner .logo{font-size:17px}\n\n .related{margin:42px 0 0}\n .related h3{margin-bottom:14px}\n .related-grid{display:grid;grid-template-columns:1fr 1fr;gap:14px}\n .rc{border:1px solid var(--line);border-radius:12px;padding:16px 18px;background:#fff}\n .rc .k{font-size:11px;letter-spacing:.1em;color:var(--brand-2);font-weight:700;text-transform:uppercase}\n .rc a{font-weight:600;color:var(--ink);display:block;margin-top:6px;font-size:15.5px}\n @media(max-width:640px){.related-grid{grid-template-columns:1fr}}\n\n \/* --- bright, clean additions --- *\/\n .bright-strip{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:30px 0}\n .bright-strip .bcard{border-radius:16px;padding:22px 20px;color:#fff}\n .bright-strip .bcard .n{font-size:26px;font-weight:800;line-height:1.1}\n .bright-strip .bcard .l{font-size:13px;margin-top:6px;opacity:.95;font-weight:500}\n .bc-navy{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n .bc-teal{background:linear-gradient(135deg,#00c2a8,#12b3d6)}\n .bc-indigo{background:linear-gradient(135deg,#3a46c0,#5a63d6)}\n @media(max-width:640px){.bright-strip{grid-template-columns:1fr}}\n\n .pillrow{display:flex;gap:10px;flex-wrap:wrap;margin:22px 0}\n .pill{border-radius:999px;padding:9px 16px;font-size:14px;font-weight:600;background:var(--accent-soft);color:#0a7a68;border:1px solid #bfece4}\n .pill.i{background:#eef0ff;color:#3a46c0;border-color:#d6dbff}\n\n .bigcards{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:26px 0}\n .bigcard{border-radius:16px;padding:22px;background:#fff;border:1px solid var(--line);box-shadow:0 8px 30px rgba(16,19,48,.05)}\n .bigcard .ic{width:44px;height:44px;border-radius:12px;display:grid;place-items:center;font-size:20px;font-weight:800;color:#fff;margin-bottom:12px}\n .bigcard h4{margin:0 0 6px;font-size:16px;color:var(--ink)}\n .bigcard p{margin:0;font-size:13.5px;color:var(--muted)}\n @media(max-width:720px){.bigcards{grid-template-columns:1fr}}\n\n .keyrow{display:grid;grid-template-columns:1fr 1fr;gap:0;border-radius:16px;overflow:hidden;border:1px solid var(--line);margin:26px 0}\n .keyrow>div{padding:20px 22px}\n .keyrow .k1{background:#eef0ff}\n .keyrow .k2{background:var(--accent-soft)}\n .keyrow .lab{font-size:11px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;margin-bottom:6px}\n .keyrow .k1 .lab{color:#3a46c0}.keyrow .k2 .lab{color:#0a7a68}\n .keyrow .big{font-size:19px;font-weight:800;color:var(--brand);margin-bottom:4px}\n .keyrow .sm{font-size:13.5px;color:var(--muted)}\n @media(max-width:560px){.keyrow{grid-template-columns:1fr}}\n\n .flow{display:flex;gap:8px;flex-wrap:wrap;align-items:stretch;margin:26px 0}\n .flow .step{flex:1;min-width:130px;border-radius:14px;padding:16px 14px;text-align:center}\n .flow .step .t{font-weight:800;font-size:14px}\n .flow .step .d{font-size:12px;margin-top:4px;opacity:.9}\n .flow .arrow{align-self:center;color:#c3c9e6;font-size:20px;font-weight:700}\n\n\n .ccmap{border:1px solid var(--line);border-radius:16px;overflow:hidden;margin:24px 0;box-shadow:0 8px 30px rgba(16,19,48,.05)}\n .ccmap .cctop{background:linear-gradient(135deg,#1c267a,#3a46c0);color:#fff;text-align:center;padding:12px;font-weight:700;font-size:13.5px}\n .ccmap .ccbody{display:grid;grid-template-columns:1fr 1fr;gap:0}\n .ccmap .cccol{padding:18px 20px}\n .ccmap .cccol.gov{background:#eef0ff}\n .ccmap .cccol.tech{background:#e6f7f4}\n .ccmap .cclab{font-size:11px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;margin-bottom:8px}\n .ccmap .gov .cclab{color:#3a46c0}.ccmap .tech .cclab{color:#0a7a68}\n .ccmap .ccitem{font-size:13px;color:var(--ink);padding:5px 0;display:flex;gap:8px}\n .ccmap .ccitem b{color:var(--brand);flex:none;width:42px}\n @media(max-width:600px){.ccmap .ccbody{grid-template-columns:1fr}}\n .critcard{border:1px solid var(--line);border-radius:14px;padding:16px 18px;background:#fff;box-shadow:0 6px 24px rgba(16,19,48,.04);margin:12px 0}\n .critcard .ct{display:flex;align-items:center;gap:10px;margin-bottom:6px}\n .critcard .code{font-size:12px;font-weight:800;color:#fff;background:linear-gradient(135deg,#1c267a,#3a46c0);padding:3px 9px;border-radius:6px;flex:none}\n .critcard.tech .code{background:linear-gradient(135deg,#00c2a8,#12b3d6);color:#04261b}\n .critcard h4{margin:0;font-size:14.5px;color:var(--ink)}\n .critcard p{margin:4px 0 0;font-size:13px;color:var(--muted)}\n .critcard .asks{font-size:12.5px;color:var(--brand);margin-top:7px;background:var(--mist);padding:8px 11px;border-radius:8px}\n\n\n \/* colored-border callout variants: white fill, medium colored border, four sides *\/\n .bbox{border-radius:14px;background:#fff;padding:16px 20px;margin:22px 0;font-size:14.5px;line-height:1.6}\n .bbox strong{color:var(--brand)}\n .bbox.navy{border:2px solid #1c267a}\n .bbox.indigo{border:2px solid #3a46c0}\n .bbox.teal{border:2px solid #00c2a8}\n .bbox .bt{font-size:11px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;margin-bottom:5px}\n .bbox.navy .bt{color:#1c267a}.bbox.indigo .bt{color:#3a46c0}.bbox.teal .bt{color:#0a7a68}\n\n .callout a[href*=\"book-demo\"]{color:#ffffff !important;font-weight:700;text-decoration:underline}\n .callout a[href*=\"book-demo\"] span{color:#ffffff !important}\n<\/style>\n<\/head>\n<body>\n\n<div class=\"wrap\">\n <p class=\"dek\">A guide to the SOC 2 controls: the nine Common Criteria that define SOC 2 Security, the four optional criteria, and the categories where audit findings most often arise.<\/p>\n\n <div class=\"meta\">\n <span>Osto Security Team<\/span>\n <span class=\"dot\"><\/span>\n <span>8 min read<\/span>\n <span class=\"dot\"><\/span>\n <span>Compliance & Trust<\/span>\n <\/div>\n\n <div class=\"tldr\">\n <h2>TL;DR<\/h2>\n <p>SOC 2 controls are not a fixed checklist. SOC 2 sets criteria your controls must satisfy, and the mandatory Security criterion is defined by nine Common Criteria, CC1 through CC9.<\/p>\n <p>CC1 to CC5 cover governance and internal control. CC6 to CC9 are the technical core: access, operations, change, and risk. CC6 and CC7 are where auditors find the most gaps.<\/p>\n <\/div>\n\n <div class=\"jump\">\n <h4>On this page<\/h4>\n <ol>\n <li><a href=\"#structure\">How controls are structured<\/a><\/li>\n <li><a href=\"#gov\">CC1-CC5: governance<\/a><\/li>\n <li><a href=\"#tech\">CC6-CC9: technical core<\/a><\/li>\n <li><a href=\"#gaps\">Where gaps cluster<\/a><\/li>\n <li><a href=\"#optional\">The 4 optional criteria<\/a><\/li>\n <li><a href=\"#focus\">Criteria vs controls<\/a><\/li>\n <li><a href=\"#osto\">Satisfying them in practice<\/a><\/li>\n <\/ol>\n <\/div>\n\n <h2 class=\"sec\" id=\"structure\">How SOC 2 controls are structured<\/h2>\n <p>SOC 2 does not hand you a list of controls to implement. It gives you criteria, which are objectives your controls have to meet. The criteria sit under the five Trust Services Criteria published by the AICPA. Only Security is mandatory, and it breaks into nine Common Criteria.<\/p>\n\n <div class=\"ccmap\">\n <div class=\"cctop\">Security (mandatory) = 9 Common Criteria<\/div>\n <div class=\"ccbody\">\n <div class=\"cccol gov\">\n <div class=\"cclab\">CC1-CC5 · Governance<\/div>\n <div class=\"ccitem\"><b>CC1<\/b>Control environment<\/div>\n <div class=\"ccitem\"><b>CC2<\/b>Communication & information<\/div>\n <div class=\"ccitem\"><b>CC3<\/b>Risk assessment<\/div>\n <div class=\"ccitem\"><b>CC4<\/b>Monitoring activities<\/div>\n <div class=\"ccitem\"><b>CC5<\/b>Control activities<\/div>\n <\/div>\n <div class=\"cccol tech\">\n <div class=\"cclab\">CC6-CC9 · Technical<\/div>\n <div class=\"ccitem\"><b>CC6<\/b>Logical & physical access<\/div>\n <div class=\"ccitem\"><b>CC7<\/b>System operations<\/div>\n <div class=\"ccitem\"><b>CC8<\/b>Change management<\/div>\n <div class=\"ccitem\"><b>CC9<\/b>Risk mitigation<\/div>\n <\/div>\n <\/div>\n <\/div>\n\n <div class=\"bbox teal\"><div class=\"bt\">The split in one line<\/div>CC1 to CC5 map to the COSO internal-control framework and ask whether your organisation is run in a way that can be trusted with data. CC6 to CC9 are the hands-on security controls.<\/div>\n\n <h2 class=\"sec\" id=\"gov\">CC1-CC5: the governance foundation<\/h2>\n <p>These five SOC 2 controls are less about firewalls and more about whether your organisation is structured to be trusted with data.<\/p>\n\n <div class=\"critcard\"><div class=\"ct\"><span class=\"code\">CC1<\/span><h4>Control environment<\/h4><\/div><p>The tone at the top: structure, roles, accountability, and ethical culture to support security.<\/p><div class=\"asks\"><strong>Asks:<\/strong> Do you have defined roles, committed leadership, background checks, and competent security people?<\/div><\/div>\n <div class=\"critcard\"><div class=\"ct\"><span class=\"code\">CC2<\/span><h4>Communication & information<\/h4><\/div><p>How security information flows, internally to your team and externally to customers and partners.<\/p><div class=\"asks\"><strong>Asks:<\/strong> Are security policies, responsibilities, and expectations clearly communicated to those who need them?<\/div><\/div>\n <div class=\"critcard\"><div class=\"ct\"><span class=\"code\">CC3<\/span><h4>Risk assessment<\/h4><\/div><p>Whether you actively identify, analyse, and plan to treat risks to your systems and data, including fraud risk.<\/p><div class=\"asks\"><strong>Asks:<\/strong> Do you run a real risk assessment, set objectives, and account for how changes affect risk?<\/div><\/div>\n <div class=\"critcard\"><div class=\"ct\"><span class=\"code\">CC4<\/span><h4>Monitoring activities<\/h4><\/div><p>Ongoing evaluation of whether your controls are present and working, and remediation when they are not.<\/p><div class=\"asks\"><strong>Asks:<\/strong> Do you continuously check that controls function, and fix deficiencies you find?<\/div><\/div>\n <div class=\"critcard\"><div class=\"ct\"><span class=\"code\">CC5<\/span><h4>Control activities<\/h4><\/div><p>The bridge from policy to action: the activities, technology, and procedures that carry out security directives.<\/p><div class=\"asks\"><strong>Asks:<\/strong> Are policies translated into concrete control activities, including technology general controls?<\/div><\/div>\n\n <h2 class=\"sec\" id=\"tech\">CC6-CC9: the technical core<\/h2>\n <p>This is where the SOC 2 controls get hands-on. These four are security-specific and cover most of what people picture as security controls.<\/p>\n\n <div class=\"critcard tech\"><div class=\"ct\"><span class=\"code\">CC6<\/span><h4>Logical & physical access<\/h4><\/div><p>The biggest category. Who and what can access your systems and data: authentication, authorisation, encryption, network and physical access.<\/p><div class=\"asks\"><strong>Asks:<\/strong> Is access restricted to the right people, protected by MFA and encryption, and removed promptly when someone leaves?<\/div><\/div>\n <div class=\"critcard tech\"><div class=\"ct\"><span class=\"code\">CC7<\/span><h4>System operations<\/h4><\/div><p>Running systems securely day to day: detecting issues, monitoring, vulnerability management, and incident response.<\/p><div class=\"asks\"><strong>Asks:<\/strong> Do you monitor for anomalies, manage vulnerabilities, and have a working incident response process?<\/div><\/div>\n <div class=\"critcard tech\"><div class=\"ct\"><span class=\"code\">CC8<\/span><h4>Change management<\/h4><\/div><p>How changes to systems and code are requested, reviewed, approved, and deployed without introducing security risk.<\/p><div class=\"asks\"><strong>Asks:<\/strong> Are system and code changes documented, reviewed, and approved before they ship?<\/div><\/div>\n <div class=\"critcard tech\"><div class=\"ct\"><span class=\"code\">CC9<\/span><h4>Risk mitigation<\/h4><\/div><p>Reducing the impact of disruptions and third-party risk, through contingency planning and vendor management.<\/p><div class=\"asks\"><strong>Asks:<\/strong> Do you plan for business disruption and assess the risk your vendors introduce?<\/div><\/div>\n\n <h2 class=\"sec\" id=\"gaps\">Where auditors actually find the gaps<\/h2>\n <p>If you are prioritising, put your energy into CC6 and CC7. Across first-time SOC 2 engagements, these two generate the most exceptions by a wide margin.<\/p>\n\n <div class=\"keyrow\">\n <div class=\"k1\"><div class=\"lab\">CC6 · Access<\/div><div class=\"big\">The usual culprits<\/div><div class=\"sm\">Missing MFA, access not removed when someone leaves, and weak or undocumented access reviews.<\/div><\/div>\n <div class=\"k2\"><div class=\"lab\">CC7 · Operations<\/div><div class=\"big\">The usual culprits<\/div><div class=\"sm\">No real monitoring, unmanaged vulnerabilities, and an incident response process that exists only on paper.<\/div><\/div>\n <\/div>\n\n <h2 class=\"sec\" id=\"optional\">The four optional Trust Services Criteria<\/h2>\n <p>Security (CC1-CC9) is mandatory. The other four are optional. Add them only when your customer commitments or contracts call for them, because each one widens scope.<\/p>\n\n <div class=\"bigcards\">\n <div class=\"bigcard\"><div class=\"ic bc-navy\">A<\/div><h4>Availability<\/h4><p>Whether your system is up and reachable as promised. For uptime and SLA commitments.<\/p><\/div>\n <div class=\"bigcard\"><div class=\"ic bc-indigo\">C<\/div><h4>Confidentiality<\/h4><p>Protecting information meant to stay restricted, like customer business data.<\/p><\/div>\n <div class=\"bigcard\"><div class=\"ic bc-teal\">P<\/div><h4>Processing Integrity<\/h4><p>Whether data is processed completely, accurately, and on time. For fintech and data platforms.<\/p><\/div>\n <div class=\"bigcard\"><div class=\"ic bc-navy\">Pr<\/div><h4>Privacy<\/h4><p>How you collect, use, retain, and dispose of personal information against your commitments.<\/p><\/div>\n <\/div>\n\n <h2 class=\"sec\" id=\"focus\">Criteria, controls, and points of focus<\/h2>\n <p>One more layer worth knowing. Under each criterion sit points of focus: the AICPA’s suggested considerations for what a control satisfying that criterion might address. They are guidance, not a checklist.<\/p>\n\n <div class=\"bbox indigo\"><div class=\"bt\">A widely followed practice<\/div>Support each criterion with at least two or three controls. That way, if one control fails during the audit period, the others still satisfy the criterion and you avoid an exception.<\/div>\n\n <h2 class=\"sec\" id=\"osto\">Satisfying the criteria in practice<\/h2>\n <p>Read back over the SOC 2 controls in CC1 to CC9 and a pattern emerges. Most of these criteria describe security functions that have to genuinely run and produce <a href=\"https:\/\/www.osto.one\/resources\/soc-2-evidence-collection\">evidence<\/a>: access control and MFA, monitoring, change management, vulnerability management, vendor risk. The criteria are the objective; running controls with a clean evidence trail is how you meet them.<\/p>\n\n <div class=\"analogy\"><strong>That is where a single platform changes the math.<\/strong> With Osto, the controls these criteria call for are built in and running: access controls and MFA enforcement, continuous monitoring, VAPT, and change management, with the evidence collected from the same modules. The CC6 and CC7 categories that trip up most first-timers are handled by the platform itself.<\/div>\n\n <div class=\"callout\">\n <h3>Close the CC6 and CC7 gaps before the auditor looks.<\/h3>\n <p>Osto is a one-stop cybersecurity and compliance platform for growing companies. The controls behind CC1-CC9, access, <a href=\"https:\/\/www.osto.one\/resources\/mfa-glossary\">MFA<\/a>, monitoring, <a href=\"https:\/\/www.osto.one\/resources\/vapt-glossary\">VAPT<\/a>, change management, run on one platform, with the evidence collected in the same place, so you can get SOC 2 ready in about 115 days.<\/p>\n <p style=\"margin-top:16px;\"><a href=\"https:\/\/osto.one\/book-demo\/\" style=\"color:#ffffff;font-weight:700;text-decoration:underline;\" target=\"_blank\" rel=\"noopener\"><span style=\"color:#ffffff;\">Book a Demo →<\/span><\/a><\/p>\n <\/div>\n\n <h2 class=\"sec\" id=\"faq\">Frequently asked questions<\/h2>\n\n <details>\n <summary>What are the SOC 2 Common Criteria?<\/summary>\n <p>The nine categories that make up the mandatory Security Trust Services Criterion in every SOC 2 report: CC1 (Control Environment), CC2 (Communication and Information), CC3 (Risk Assessment), CC4 (Monitoring), CC5 (Control Activities), CC6 (Logical and Physical Access), CC7 (System Operations), CC8 (Change Management), and CC9 (Risk Mitigation).<\/p>\n <\/details>\n <details>\n <summary>How many controls are in SOC 2?<\/summary>\n <p>SOC 2 defines criteria rather than a fixed list of controls, so the exact number varies by company. The mandatory Security criterion contains 33 Common Criteria points across CC1-CC9, and you implement whatever set of controls satisfies them for your environment.<\/p>\n <\/details>\n <details>\n <summary>Which criteria cause the most audit findings?<\/summary>\n <p>CC6 (Logical and Physical Access Controls) and CC7 (System Operations) generate the most findings in first-time audits. Recurring causes for CC6 are missing MFA and access not removed when people leave; for CC7 they are weak monitoring and vulnerability management.<\/p>\n <\/details>\n <details>\n <summary>Is Security the only mandatory criterion?<\/summary>\n <p>Yes. Security, made up of the nine Common Criteria (CC1-CC9), is the only mandatory Trust Services Criterion, and most first-time audits cover it alone. The other four (Availability, Confidentiality, Processing Integrity, Privacy) are added only when a contract requires them.<\/p>\n <\/details>\n <details>\n <summary>What are points of focus?<\/summary>\n <p>The AICPA’s suggested considerations under each criterion, describing what a control satisfying that criterion might address. They are guidance to help you design controls, not a mandatory checklist.<\/p>\n <\/details>\n\n<\/div>\n<\/body>\n<\/html>\n","protected":false},"excerpt":{"rendered":"<p>SOC 2 Controls Explained: CC1-CC9 and the Trust Services Criteria | Osto A guide to the SOC 2 controls: the\u2026<\/p>\n","protected":false},"author":8,"featured_media":581,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[],"class_list":["post-580","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog"],"_links":{"self":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/580","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/comments?post=580"}],"version-history":[{"count":1,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/580\/revisions"}],"predecessor-version":[{"id":582,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/580\/revisions\/582"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media\/581"}],"wp:attachment":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media?parent=580"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/categories?post=580"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/tags?post=580"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}