SOC 2 CC1.2: board oversight, explained for startups

What usually proves it

An auditor wants records from the period being examined, pulled from the systems that hold them rather than written up afterwards. Dates matter. A record with a date and a named owner carries more weight than a screenshot with neither. For CC1.2, the usual records are these.

• Minutes of board or advisory meetings where security was discussed
• A charter or written note naming who oversees security and how often
• A dated review memo from an outside advisor

What Polara asks about it

The free readiness assessment asks 4 questions that bear on CC1.2. A yes becomes a task to show the proof. A no becomes a task to fix the gap, with the steps written out.

• Has management formally approved the security and compliance program in the last 12 months? If yes, show it: board resolution, signed policy approval page, executive approval email, or meeting minutes. If no, the fix: obtain and minute management or board approval of the security program before the examination date.
• How often does a body outside day-to-day management (a board, an advisory board, or a named independent advisor) review security matters? If yes, show it: signed oversight review minutes, board meeting minutes covering security, advisory board notes, or a dated review memo from an outside advisor. If no, the fix: appoint a board, an advisory board or a named independent advisor to review security at least quarterly, and minute each review.
• Does management review the overall security and compliance program at least annually? If yes, show it: annual security review meeting notes, steering committee minutes, security program update deck, or executive approval email. If no, the fix: schedule an annual management review of the security program and minute the outcome.

It also asks, for context:

• Management body responsible for reviewing Code of Conduct or ethics reports.

Policies, templates and connected evidence

A policy states the rule, a template gives you the record to keep, and a connected system pulls the proof from the source. An auditor checks that the three agree: the cadence in the policy, the dates in the record and what the system shows.

In the policy pack, the Information Security Policy covers CC1.2.

Is it in your scope?

Yes, always. CC1.2 is one of the 33 common criteria, and the common criteria are in every SOC 2 report, Type 1 or Type 2. The common criteria. Every SOC 2 report covers them, whatever else you add: governance, risk, access, operations, change and vendors. Most of the work in any SOC 2 sits here.

Polara Labs is not a CPA firm. SOC 2 examinations are performed by independent licensed U.S. CPA firms.

Control environment: the criteria around it

CC1.2 is one of 5 criteria in control environment, CC1.1 to CC1.5. Reading a group together shows how its outcomes fit, and one record often serves more than one of them.

• CC1.1, integrity and ethics
• CC1.2, this page
• CC1.3, structure and reporting
• CC1.4, hiring and competence
• CC1.5, accountability

Before it: CC1.1, integrity and ethics. After it: CC1.3, structure and reporting. All the criteria are on the Trust Services Criteria page, grouped by category.