SOC 2 · CC - Common Criteria (Security)
SOC 2 SOC2-CC4.1: CC4.1 Ongoing and separate evaluations of control (COSO principle 16)
SOC 2 SOC2-CC4.1 covers CC4.1 Ongoing and separate evaluations of control (COSO principle 16). The held text names 5 evidence records for it, the first being Internal audit plan and reports covering security controls. The common gap an assessor flags is No independent evaluation of controls in the period.
The organisation chooses, builds and carries out ongoing or separate evaluations to confirm the control components are present and working. Points of focus: a balance between continuous and point-in-time evaluations; the pace of business change informs their design; a baseline of the control system is established; evaluators understand what they evaluate; ongoing evaluations are built into processes; scope and frequency vary with risk; separate evaluations give objective feedback; and varied techniques are used such as penetration testing, independent certification against a standard and internal audit. The 2022 revision widens the evaluation types to include monitoring and testing by the first line and the second line, internal audit, compliance and resilience assessments, vulnerability scanning, security assessments, penetration tests and assessments by outside parties.
What evidence supports SOC2-CC4.1?
- Monitoring activitiesInternal audit plan and reports covering security controls
- Monitoring activitiesPenetration test and vulnerability scan reports within the period
- Monitoring activitiesManagement self-assessments or control monitoring dashboards (first and second line)
- Monitoring activitiesIndependent certification reports such as ISO/IEC 27001
- Monitoring activitiesResilience or compliance assessment reports and remediation tracking
Where this requirement comes from
This is our own statement of SOC 2 SOC2-CC4.1, read from the copy we hold (issuer free complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.
Common gaps an assessor flags
- No independent evaluation of controls in the period
- Penetration test older than twelve months or scoped too narrowly
- Control monitoring relies solely on the annual SOC 2 audit
- Assessment findings logged but not tracked to closure
How it maps to ISO 27001:2022
- 5.35 high Ongoing and separate evaluations of internal control are the independent review being sought.
- 5.36 high Separate evaluations ascertain whether controls are present and functioning as policy requires.
A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.