SOC 2 · CC - Common Criteria (Security)
SOC 2 SOC2-CC1.3: CC1.3 Structures, reporting lines, authorities and responsibilities (COSO principle 3)
SOC 2 SOC2-CC1.3 covers CC1.3 Structures, reporting lines, authorities and responsibilities (COSO principle 3). The held text names 5 evidence records for it, the first being Current organisation chart including security, IT operations, compliance and privacy functions. The common gap an assessor flags is Organisation chart out of date or missing the security function.
Management, overseen by the board, sets up the structures, reporting lines and authority needed to pursue objectives. Points of focus: every structure is considered, including business units, legal entities, locations and outsourced providers; reporting lines are designed so authority can be exercised and information can flow; authority and responsibility are delegated with segregation of duties where needed; requirements for security, availability, confidentiality, privacy and processing integrity shape how roles are defined; and the need to interact with and oversee external parties is built into the structure. The 2022 revision adds, for privacy engagements, that legal and contractual privacy obligations shape how structures, reporting lines and authority are set up.
What evidence supports SOC2-CC1.3?
- Organisation and rolesCurrent organisation chart including security, IT operations, compliance and privacy functions
- Organisation and rolesJob descriptions or RACI naming security and privacy responsibilities
- Organisation and rolesDelegation of authority matrix
- Organisation and rolesDocumented ownership of vendor and outsourced-provider oversight
- Organisation and rolesMapping of privacy laws and contractual privacy terms to the role or office accountable for each (privacy engagements)
Where this requirement comes from
This is our own statement of SOC 2 SOC2-CC1.3, read from the copy we hold (issuer free complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.
Common gaps an assessor flags
- Organisation chart out of date or missing the security function
- Security responsibilities held informally with no written assignment
- Incompatible duties combined with no compensating control
- No named owner for privacy obligations arising from customer contracts or law
How it maps to ISO 27001:2022
- 5.2 high Establishing structures, reporting lines and authorities is precisely assignment of security roles.
A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.