SOC 2 · CC - Common Criteria (Security)
SOC 2 SOC2-CC4.2: CC4.2 Evaluating and communicating control deficiencies (COSO principle 17)
SOC 2 SOC2-CC4.2 covers CC4.2 Evaluating and communicating control deficiencies (COSO principle 17). The held text names 3 evidence records for it, the first being Deficiency or findings log with owner, severity, due date and status. The common gap an assessor flags is Findings from audits or penetration tests left open past their due date.
Control deficiencies are evaluated and reported promptly to those who must fix them, including senior management and the board where appropriate. Points of focus: management and the board assess the results of evaluations; deficiencies go to the parties responsible for correction and upward as appropriate; and management tracks whether they are remedied on time.
What evidence supports SOC2-CC4.2?
- Monitoring activitiesDeficiency or findings log with owner, severity, due date and status
- Monitoring activitiesReports of open findings to senior management or the board
- Monitoring activitiesEvidence of closure and retesting of remediated deficiencies
Where this requirement comes from
This is our own statement of SOC 2 SOC2-CC4.2, read from the copy we hold (issuer free complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.
Common gaps an assessor flags
- Findings from audits or penetration tests left open past their due date
- No escalation of significant deficiencies to leadership
- Remediation closed without verification
How it maps to ISO 27001:2022
- 5.36 medium Evaluating and communicating deficiencies follows compliance review but is not the review itself.
A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.