SOC 2 Common Criteria CC1–CC9 Explained

CC1–CC9 at a Glance

Points of Focus, Not a Fixed Control Count

Each CC category includes criteria and illustrative points of focus. Your organisation designs controls that achieve those criteria. Tool vendors and consultants often publish sample control libraries — treat those as starting points, not an official AICPA headcount.

Evidence Patterns Auditors Expect

• Policies and standards mapped to CC categories
• Access reviews, tickets, and identity logs (CC6)
• Monitoring alerts and incident records (CC7)
• Change tickets and deployment approvals (CC8)
• Vendor due diligence and risk registers (CC9)

How CyberSilo Helps

CSA organises CC-mapped control status and artefacts; ThreatHawk supplies operational monitoring evidence commonly requested under CC7.

Frequently Asked Questions

Are CC1–CC9 the same as the five Trust Services Criteria?

No. CC1–CC9 are the control categories for the Security criterion. The five TSC are Security, Availability, Processing Integrity, Confidentiality, and Privacy.

How many SOC 2 controls does AICPA require?

AICPA publishes criteria and points of focus, not a single mandatory fixed control count. You define controls that address the criteria in scope.

Is CC7 only about SIEM?

CC7 covers system operations including detection of anomalies and incident response. Many organisations use a SIEM as part of that evidence, but the criterion is broader than any one tool.

Related SOC 2 Resources

SOC 2 hub · TSC · Checklist · Policies