SOC 2 · CC - Common Criteria (Security)
SOC 2 CC9.1: CC9.1 Mitigating risks of business disruption
SOC 2 CC9.1 covers CC9.1 Mitigating risks of business disruption. The held text names 3 evidence records for it, the first being Business continuity and disaster recovery plans covering the in-scope service. The common gap an assessor flags is Continuity plan does not cover the in-scope system.
Measures to reduce the risk of business disruption are identified, selected and developed. Points of focus: policies, procedures, communication plans and fallback processing are prepared in advance so the organisation can respond, limit the damage and recover from disruptive security events, with monitoring and information flows to meet objectives during those efforts; and insurance is considered to cover the financial cost of loss events.
What evidence supports CC9.1?
- Business continuityBusiness continuity and disaster recovery plans covering the in-scope service
- Business continuityBusiness impact analysis
- Business continuityCyber or business interruption insurance policy details
Where this requirement comes from
This is our own statement of SOC 2 CC9.1, read from the copy we hold (issuer free complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.
Common gaps an assessor flags
- Continuity plan does not cover the in-scope system
- No business impact analysis to set recovery priorities
- Insurance never considered
How it maps to ISO 27001:2022
- 5.29 high Risk mitigation activities for business disruptions are the continuity arrangements this control requires.
- 5.30 high Mitigation of disruption risk covers the ICT continuity planning being assessed.
A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.