What evidence does SOC 2 SOC2-CC1.2 need?

Board or audit committee charter assigning oversight of security and internal control. Minutes showing the board reviewed security, risk and control reports during the period. Board skills matrix and independence assessment

SOC2-CC1.2 of SOC 2, stated here in our words and cited to that clause.

Does it map to the other framework?

The held record carries no reviewed link for this control, and does not invent one.

SOC 2 SOC2-CC1.2 evidence: CC1.2 Board independence and

SOC 2 SOC2-CC1.2: CC1.2 Board independence and oversight of internal control (COSO principle 2)

SOC 2 SOC2-CC1.2 covers CC1.2 Board independence and oversight of internal control (COSO principle 2). The held text names 4 evidence records for it, the first being Board or audit committee charter assigning oversight of security and internal control. The common gap an assessor flags is Board minutes silent on security and risk topics for the whole period.

A governing body that is independent of management oversees how internal control is designed and how it performs. Points of focus: the board accepts defined oversight duties; it keeps and periodically reviews the skills it needs to question management and act; enough members are independent and objective; and where it lacks expertise in any of the five trust services categories (security, availability, confidentiality, processing integrity, privacy) it adds it through a committee or outside advisers.

What evidence supports SOC2-CC1.2?

GovernanceBoard or audit committee charter assigning oversight of security and internal control
GovernanceMinutes showing the board reviewed security, risk and control reports during the period
GovernanceBoard skills matrix and independence assessment
GovernanceEngagement letters or committee terms for outside security or privacy advisers

Where this requirement comes from

This is our own statement of SOC 2 SOC2-CC1.2, read from the copy we hold (issuer free complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.

Common gaps an assessor flags

Board minutes silent on security and risk topics for the whole period
Oversight body is made up only of management, with no independent member
No mechanism to bring in expertise the board lacks

How it maps to ISO 27001:2022

No reviewed link is held for this control.

A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.