SOC 2 CC1.3: structure and reporting, explained for startups

What usually proves it

An auditor wants records from the period being examined, pulled from the systems that hold them rather than written up afterwards. Dates matter. A record with a date and a named owner carries more weight than a screenshot with neither. For CC1.3, the usual records are these.

• A current org chart
• A security roles and responsibilities list with a named owner for each role
• Job descriptions that mention security duties

What Polara asks about it

The free readiness assessment asks 2 questions that bear on CC1.3. A yes becomes a task to show the proof. A no becomes a task to fix the gap, with the steps written out.

• Are security roles and responsibilities documented and communicated? If yes, show it: responsible, accountable, consulted and informed (RACI) matrix, job descriptions with security duties, org chart highlighting security roles, or role responsibility document. If no, the fix: document security roles and responsibilities in the information security policy and communicate them to all personnel.

It also asks, for context:

• Primary owner for security and compliance (name and title).

Policies, templates and connected evidence

A policy states the rule, a template gives you the record to keep, and a connected system pulls the proof from the source. An auditor checks that the three agree: the cadence in the policy, the dates in the record and what the system shows.

In the policy pack, the Information Security Policy covers CC1.3.

Free templates that help, printed in full with Word, PDF or Excel downloads:

• Information security policy template
• Security roles and responsibilities template

If you also run ISO 27001, the Annex A control A.5.2, security roles ask for overlapping evidence. One record can serve both when it names what it proves.

Where it goes wrong

One gap a remediation playbook covers here is segregation of Duties -- Compensating Controls. The fix: document compensating controls for segregation of duties risks in small teams. The proof: one-page compensating controls document signed by CEO/CTO.

An auditor asks two things about it. Is there a documented approach to segregation of duties or compensating controls? Are compensating controls implemented for roles where segregation is not feasible?

Is it in your scope?

Yes, always. CC1.3 is one of the 33 common criteria, and the common criteria are in every SOC 2 report, Type 1 or Type 2. The common criteria. Every SOC 2 report covers them, whatever else you add: governance, risk, access, operations, change and vendors. Most of the work in any SOC 2 sits here.

Polara Labs is not a CPA firm. SOC 2 examinations are performed by independent licensed U.S. CPA firms.

Control environment: the criteria around it

CC1.3 is one of 5 criteria in control environment, CC1.1 to CC1.5. Reading a group together shows how its outcomes fit, and one record often serves more than one of them.

• CC1.1, integrity and ethics
• CC1.2, board oversight
• CC1.3, this page
• CC1.4, hiring and competence
• CC1.5, accountability

Before it: CC1.2, board oversight. After it: CC1.4, hiring and competence. All the criteria are on the Trust Services Criteria page, grouped by category.