SOC 2 · CC - Common Criteria (Security)

SOC 2 SOC2-CC3.2: CC3.2 Identifying and analysing risks to objectives (COSO principle 7)

SOC 2 SOC2-CC3.2 covers CC3.2 Identifying and analysing risks to objectives (COSO principle 7). The held text names 5 evidence records for it, the first being Risk assessment performed in the period with methodology, scoring and approvals. The common gap an assessor flags is Risk assessment not refreshed within the last year.

Risks to objectives are identified across the organisation and analysed as the basis for deciding how to manage them. Points of focus: risk is assessed at entity, subsidiary, division, unit and function level; internal and external factors are considered; appropriate management levels take part; the significance of each risk is estimated; a response of accept, avoid, reduce or share is chosen; information assets are identified and their criticality assessed together with threats and vulnerabilities; threats arising from vendors, partners and others with access are analysed; and significance combines asset criticality, threat impact and likelihood. The 2022 revision restructures the process into steps: list information assets (devices, virtual systems, software, data and its flows, external systems and roles) and rate their criticality; identify threats to objectives and the weaknesses of system components; judge how likely and how severe each resulting risk is; consider that some threats and weaknesses may not yet be known; devise mitigation strategies; and decide whether the residual risk is acceptable or should be reduced or shared.