SOC 2 CC1.1: integrity and ethics, explained for startups

What usually proves it

An auditor wants records from the period being examined, pulled from the systems that hold them rather than written up afterwards. Dates matter. A record with a date and a named owner carries more weight than a screenshot with neither. For CC1.1, the usual records are these.

• A code of conduct approved by leadership
• Signed acknowledgments from every employee and contractor
• A reporting channel for concerns, and a record of how reports were handled

What Polara asks about it

The free readiness assessment asks 5 questions that bear on CC1.1. A yes becomes a task to show the proof. A no becomes a task to fix the gap, with the steps written out.

• Has management formally approved the security and compliance program in the last 12 months? If yes, show it: board resolution, signed policy approval page, executive approval email, or meeting minutes. If no, the fix: obtain and minute management or board approval of the security program before the examination date.
• Do employees acknowledge a Code of Conduct? If yes, show it: code of Conduct document, signed acknowledgment log, onboarding checklist, or employee handbook excerpt. If no, the fix: publish the Code of Conduct and collect a signed acknowledgment from every employee and contractor.
• NDA signed at hire? If yes, show it: signed inventions and confidentiality agreement, signed non-disclosure agreement (redacted), confidentiality policy excerpt, or employee handbook section. If no, the fix: include a non-disclosure agreement in the offer package and retain the signed copy.

It also asks, for context:

• Summarize the scope and ethical standards covered by your Code of Conduct.
• Whistleblower or ethics reporting channel (email, hotline, or anonymous form).

Policies, templates and connected evidence

A policy states the rule, a template gives you the record to keep, and a connected system pulls the proof from the source. An auditor checks that the three agree: the cadence in the policy, the dates in the record and what the system shows.

In the policy pack, the Code of Conduct Policy and Human Resources Security Policy cover CC1.1.

Free templates that help, printed in full with Word, PDF or Excel downloads:

• Information security policy template
• Acceptable use policy template
• Code of conduct template
• Code of conduct acknowledgment log

If you also run ISO 27001, the Annex A controls A.5.4, what managers must enforce, A.5.10, acceptable use, A.5.32, intellectual property, A.6.2, employment terms, A.6.4, disciplinary process and A.6.6, confidentiality agreements ask for overlapping evidence. One record can serve both when it names what it proves.

Where it goes wrong

One gap a remediation playbook covers here is code of Conduct. The fix: draft a code of conduct, get executive signature, and collect employee acknowledgments. The proof: signed code of conduct document plus employee acknowledgment log.

An auditor asks two things about it. Does the organization have a documented code of conduct? Have employees acknowledged the code of conduct?

Is it in your scope?

Yes, always. CC1.1 is one of the 33 common criteria, and the common criteria are in every SOC 2 report, Type 1 or Type 2. The common criteria. Every SOC 2 report covers them, whatever else you add: governance, risk, access, operations, change and vendors. Most of the work in any SOC 2 sits here.

Polara Labs is not a CPA firm. SOC 2 examinations are performed by independent licensed U.S. CPA firms.

Control environment: the criteria around it

CC1.1 is one of 5 criteria in control environment, CC1.1 to CC1.5. Reading a group together shows how its outcomes fit, and one record often serves more than one of them.

• CC1.1, this page
• CC1.2, board oversight
• CC1.3, structure and reporting
• CC1.4, hiring and competence
• CC1.5, accountability

After it: CC1.2, board oversight. All the criteria are on the Trust Services Criteria page, grouped by category.