SOC 2 · CC - Common Criteria (Security)
SOC 2 SOC2-CC5.1: CC5.1 Selecting control activities that mitigate risk (COSO principle 10)
SOC 2 SOC2-CC5.1 covers CC5.1 Selecting control activities that mitigate risk (COSO principle 10). The held text names 3 evidence records for it, the first being Risk and control matrix linking each risk to mitigating controls. The common gap an assessor flags is Risks in the register with no mapped control.
Control activities are chosen and developed to bring risks to objectives down to acceptable levels. Points of focus: control activities carry out the risk responses from the risk assessment; the environment, complexity and scope of operations shape the choice; the business processes that need controls are determined; a mix of manual and automated, preventive and detective controls is used; controls are applied at appropriate levels; and incompatible duties are segregated, or alternative controls are designed where segregation is impractical.
What evidence supports SOC2-CC5.1?
- Control activitiesRisk and control matrix linking each risk to mitigating controls
- Control activitiesDocumented control descriptions including type (manual, automated, preventive, detective)
- Control activitiesSegregation of duties analysis and compensating controls
Where this requirement comes from
This is our own statement of SOC 2 SOC2-CC5.1, read from the copy we hold (issuer free complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.
Common gaps an assessor flags
- Risks in the register with no mapped control
- Reliance on detective controls alone for high risks
- Segregation conflicts accepted without compensating controls
How it maps to ISO 27001:2022
No reviewed link is held for this control.
A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.