SOC 2 security controls list: what you need to know

Running a SOC 2 program without understanding its core controls is like setting sail without a compass—you’ll drift aimlessly and end up off course. In this deep dive, I’ll unpack the nine Common Criteria (CC1–CC9) that anchor every SOC 2 security report. You’ll see what each control demands, why it matters in real-world terms, and how to weave them into your everyday operations so auditors nod in approval instead of furrowing their brows.

Laying the groundwork with governance and risk assessment controls

Before you can lock down servers or write incident playbooks, you need a solid foundation built on culture, communication, and risk awareness. These core controls ensure your security efforts aren’t just paperwork but part of your organizational DNA.

CC1 Control Environment

Control Environment sets the tone from the top by cementing integrity, ethical values, and governance. Imagine announcing a zero-tolerance policy for cheating, then rewarding the biggest rule-breakers—your credibility evaporates. A robust control environment means leadership walks the talk and security values bleed into board meetings.

CC2 Information and Communication

Information and Communication makes sure the right details reach the right people at the right time. It’s like giving firefighters a live feed of the blaze rather than a smoke signal—they can act fast before the whole building goes up. If your teams rely on outdated spreadsheets or “reply-all” email chains, critical vulnerabilities may slip through unnoticed.

CC3 Risk Assessment

Risk Assessment forces you to scan the horizon for incoming threats—internal or external—and adjust your sails accordingly. Skipping regular risk assessments is like ignoring changing tides until your ship runs aground. By actively reviewing risk in the context of new projects or market shifts, you avoid nasty surprises.

PRO TIP

Use a simple risk matrix template that rates impact and likelihood on one page. When stakeholders can eyeball risks at a glance, risk discussions move from snooze-fest to strategic planning.

Turning policies into practice with monitoring and control activities

Having policies is only half the battle. You need mechanisms that put those policies into action and catch deviations before they snowball into breaches.

CC4 Monitoring Activities

Monitoring Activities are your security’s CCTV, flagging control failures and anomalies in real time. If you wait for quarterly reviews, you’re playing security whack-a-mole—by the time you spot one threat, dozens more have popped up. Continuous monitoring helps you detect patterns and nip issues in the bud.

CC5 Control Activities

Control Activities are the checkpoints that ensure policies get enforced—think approvals, reconciliations, and verifications. Without these gates, rogue changes slip through like stilettos in a no-shoes club. Formalizing your control activities prevents operational drift and documents your defense in depth.

CC6 Logical and Physical Access Controls

Logical and Physical Access Controls lock down who can enter your digital vaults and server rooms. You wouldn’t leave your front door wide open, so don’t let admin credentials roam free. Granular access reviews and badge logs keep both the keyboard warriors and physical intruders at bay.

PRO TIP

Schedule automated quarterly reviews of access rights using your identity management tool. Deprovisioning stale accounts cuts the attack surface without extra headcount.

Ensuring system reliability and change safety

Security isn’t a one-time project. Your environment evolves, and your controls must flex without snapping. These next controls maintain resilience and integrity amid ongoing operations.

CC7 System Operations

System Operations covers daily maintenance like backups, incident handling, and antivirus updates. Think of it as regular oil changes and tune-ups—forgetting them invites catastrophic engine failure. Documented procedures and routine tests prove to auditors you’re not just pretending to care about uptime.

CC8 Change Management

Change Management ensures every tweak to your infrastructure or applications passes through a formal, secure pipeline. Uncontrolled changes breed “configuration drift,” like a game of telephone where instructions mutate into security gaps. A disciplined change process gives you traceability and rollback options.

CC9 Risk Mitigation

Risk Mitigation means staying vigilant about emerging threats and third-party risks while fixing known control gaps. It’s the ongoing pruning that prevents your security posture from growing wild and unmanageable. Without remediation deadlines, “known issues” linger like weeds.

PRO TIP

Link each risk in your register to a JIRA ticket with a hard due date. Visibility and deadlines convert passive risk logs into active security improvements.

Extending your compliance scope with optional criteria

While CC1–CC9 form the non-negotiable core, adding Availability, Processing Integrity, Confidentiality, or Privacy lets you tailor SOC 2 to your business needs. Mapping optional criteria to existing controls avoids doubling efforts and shows stakeholders you’ve thought beyond just “Security.”

PRO TIP

When scoping optional criteria, cross-reference your CC6 access reviews for Confidentiality and CC7 backup tests for Availability to maximize audit efficiency.

Rallying call to action

You’ve now got the blueprint for CC1 through CC9, and you know how optional criteria can elevate your SOC 2 report. Pick one control you feel weakest on—maybe it’s messy change management or spotty monitoring—and visibly improve it this week. Celebrate that win, then tackle the next. Before you know it, your SOC 2 program will be the envy of auditors and the backbone of your security success.