SOC 2 · CC - Common Criteria (Security)
SOC 2 CC5.3: CC5.3 Deploying controls through policies and procedures (COSO principle 12)
SOC 2 CC5.3 covers CC5.3 Deploying controls through policies and procedures (COSO principle 12). The held text names 4 evidence records for it, the first being Approved information security policy set with owners and review dates. The common gap an assessor flags is Policies past their review date.
Control activities are put into practice through policies that state expectations and procedures that carry them out. Points of focus: policies and procedures embed management's directives in daily work; responsibility and accountability sit with the managers of the unit where the risk lives; controls are performed on time; issues found while performing controls are investigated and acted on; competent people with enough authority perform them diligently; and policies and procedures are reviewed periodically and refreshed when needed.
What evidence supports CC5.3?
- Policies and proceduresApproved information security policy set with owners and review dates
- Policies and proceduresEvidence of annual policy review and approval
- Policies and proceduresOperating procedures for key controls
- Policies and proceduresRecords showing exceptions found during control operation were followed up
Where this requirement comes from
This is our own statement of SOC 2 CC5.3, read from the copy we hold (issuer free complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.
Common gaps an assessor flags
- Policies past their review date
- Procedures describe controls nobody performs
- Control exceptions noted but never investigated
How it maps to ISO 27001:2022
- 5.1 high Policy deployment of control activities is the evidence an assessor wants for security policies.
- 5.37 high Deploying control activities through documented procedures is the operating procedure evidence.
A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.