SOC 2 · CC - Common Criteria (Security)
SOC 2 SOC2-CC8.1: CC8.1 Managing changes to procedures, software, data and infrastructure
SOC 2 SOC2-CC8.1 covers CC8.1 Managing changes to procedures, software, data and infrastructure. The held text names 5 evidence records for it, the first being Change management policy covering normal, standard and emergency changes. The common gap an assessor flags is Changes deployed without recorded approval or testing.
Every change to procedures, software, data or infrastructure is authorised, designed or acquired, configured, documented, tested, approved and implemented. Points of focus: changes are managed across the system life cycle; they are authorised before development, designed and developed, documented, tracked before implementation, configured, tested, approved and deployed; the effect on objectives is evaluated through the life cycle; changes needed to remediate incidents are identified and started; a configuration baseline is maintained for IT and control systems; emergency changes follow their own authorise-test-approve path; and confidential and personal information are protected during design, development, testing and change. The 2022 revision adds: segregation of responsibilities so one person cannot develop, test and deploy a change alone; testing of internally developed and acquired changes before production (unit, integration, regression, static and dynamic code analysis, quality assurance or automated testing); a process to identify, assess, test, approve and roll out patches on time; for availability, designing for resilience and testing it during development; and, for privacy, building privacy requirements into design and collecting and processing only the personal information the purpose needs.
What evidence supports SOC2-CC8.1?
- Change managementChange management policy covering normal, standard and emergency changes
- Change managementSample of change tickets with approval, testing evidence and deployer different from author
- Change managementPatch management records with timelines
- Change managementEvidence production data is not used in test environments, or is masked
- Change managementPrivacy-by-design or data minimisation review records for new features (privacy engagements)
Where this requirement comes from
This is our own statement of SOC 2 SOC2-CC8.1, read from the copy we hold (issuer free complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.
Common gaps an assessor flags
- Changes deployed without recorded approval or testing
- Emergency changes never reviewed after the fact
- Developers able to push directly to production
- Patches for critical vulnerabilities applied late or untested
How it maps to ISO 27001:2022
- 8.26 medium Change authorization and testing touches application requirements without defining security requirements up front.
- 8.29 medium Change testing and approval is required, but security testing within development is not.
- 8.31 medium Change management usually separates environments but SOC 2 does not require environment separation.
- 8.32 high Authorizing, documenting, testing, approving and implementing changes is change management.
A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.