SOC 2 · CC - Common Criteria (Security)
SOC 2 SOC2-CC3.1: CC3.1 Objectives specified clearly enough to assess risk (COSO principle 6)
SOC 2 SOC2-CC3.1 covers CC3.1 Objectives specified clearly enough to assess risk (COSO principle 6). The held text names 4 evidence records for it, the first being For the system in scope, documented service commitments and system requirements. The common gap an assessor flags is Objectives too vague to assess risk against.
Objectives are defined precisely enough that risks to them can be identified and assessed. Points of focus: operations objectives reflect management's choices and risk tolerances, include performance goals and guide resource allocation; external financial reporting objectives follow suitable accounting principles, consider materiality and reflect real activity; external non-financial reporting objectives follow applicable laws and recognised frameworks with suitable precision; internal reporting gives management accurate, sufficiently precise information; compliance objectives absorb legal minimums and tolerances; and sub-objectives for security, availability, confidentiality, privacy and processing integrity are set to support the overall objectives.
What evidence supports SOC2-CC3.1?
- Risk assessmentFor the system in scope, documented service commitments and system requirements
- Risk assessmentSecurity and availability objectives with measurable targets (for example uptime, recovery time)
- Risk assessmentRisk appetite or tolerance statement approved by management
- Risk assessmentMapping of legal and contractual requirements to compliance objectives
Where this requirement comes from
This is our own statement of SOC 2 SOC2-CC3.1, read from the copy we hold (issuer free complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.
Common gaps an assessor flags
- Objectives too vague to assess risk against
- Service commitments in contracts not reflected in internal objectives
- No stated risk tolerance
How it maps to ISO 27001:2022
No reviewed link is held for this control.
A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.