SOC 2 · CC - Common Criteria (Security)

SOC 2 SOC2-CC2.1: CC2.1 Relevant, quality information to support internal control (COSO principle 13)

SOC 2 SOC2-CC2.1 covers CC2.1 Relevant, quality information to support internal control (COSO principle 13). The held text names 5 evidence records for it, the first being Data flow diagrams for in-scope systems, internal and external. The common gap an assessor flags is Data flow diagrams missing or not updated after architecture changes.

The organisation obtains or produces relevant, good-quality information and uses it so internal control can function. Points of focus: there is a process to decide what information the control components and objectives need; systems capture data from inside and outside the organisation; relevant data is turned into information; and that information stays produced on time, kept up to date, correct and whole, reachable when needed, secured, capable of verification and kept, and is reviewed for relevance. The 2022 revision adds five points: internal and external data flows are documented and used in control design; system components (infrastructure, software, data, external systems, endpoints and roles) are recorded and kept current as assets; information is classified by its characteristics, such as personal data, customer confidential data or intellectual property, so threats and controls can be identified; people running controls work from reports they can trust to be whole, correct, up to date and valid; and the physical location and custody of assets is tracked, especially where they sit outside the organisation's own premises, such as on vendor equipment or staff-owned phones.