SOC 2 · CC - Common Criteria (Security)
SOC 2 SOC2-CC5.2: CC5.2 General controls over technology (COSO principle 11)
SOC 2 SOC2-CC5.2 covers CC5.2 General controls over technology (COSO principle 11). The held text names 3 evidence records for it, the first being Inventory of IT general controls covering access, change, operations and development. The common gap an assessor flags is Automated controls relied on with no testing of the underlying general controls.
General controls over technology are selected and developed to support objectives. Points of focus: management understands how business processes and automated controls depend on technology general controls; controls over infrastructure support complete, accurate and available processing; security management controls limit access rights to authorised users in line with their jobs and protect assets from external threats; and controls over acquisition, development and maintenance of technology support management's objectives.
What evidence supports SOC2-CC5.2?
- IT general controlsInventory of IT general controls covering access, change, operations and development
- IT general controlsMapping of automated business controls to the systems and general controls they rely on
- IT general controlsInfrastructure management procedures (patching, capacity, backups)
Where this requirement comes from
This is our own statement of SOC 2 SOC2-CC5.2, read from the copy we hold (issuer free complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.
Common gaps an assessor flags
- Automated controls relied on with no testing of the underlying general controls
- Cloud infrastructure outside the scope of general controls
- Development and acquisition not governed by any control
How it maps to ISO 27001:2022
No reviewed link is held for this control.
A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.