SOC 2 CC1.5: accountability, explained for startups

What usually proves it

An auditor wants records from the period being examined, pulled from the systems that hold them rather than written up afterwards. Dates matter. A record with a date and a named owner carries more weight than a screenshot with neither. For CC1.5, the usual records are these.

• Signed policy acknowledgments
• A disciplinary clause in the handbook or policies
• Performance reviews or role descriptions that include security duties

What Polara asks about it

The free readiness assessment asks 2 questions that bear on CC1.5. A yes becomes a task to show the proof. A no becomes a task to fix the gap, with the steps written out.

• Are security responsibilities included in performance expectations or job descriptions for staff with production access? If yes, show it: job description with a security duties section, performance review template naming security objectives, or an employee handbook section on security responsibilities. If no, the fix: add security responsibilities to the job description or performance expectations of every role with production access.
• How often is a documented review of all user access to production performed? If yes, show it: signed access review record, a user list export carrying the reviewer name and date, the access review ticket with the removals it produced, or an identity provider access review report. If no, the fix: review every production account at least quarterly and retain the completed review with its reviewer and its date.

Policies, templates and connected evidence

A policy states the rule, a template gives you the record to keep, and a connected system pulls the proof from the source. An auditor checks that the three agree: the cadence in the policy, the dates in the record and what the system shows.

In the policy pack, the Access Control Policy and Human Resources Security Policy cover CC1.5.

Free templates that help, printed in full with Word, PDF or Excel downloads:

• Acceptable use policy template
• Security awareness training policy template

Connected systems that pull evidence for it:

• Okta, Users and last sign-in: Okta users with their status and last sign-in time.
• Microsoft Entra ID, Users and last sign-in: directory users with their enabled status, user type and last sign-in.
• Linear, Workspace members: Workspace members with their active, admin and guest status.
• Jira, Site users: users on the Jira site with their active status and account type.
• Slack, Workspace members: Workspace members, admins, guests and deactivated accounts.

If you also run ISO 27001, the Annex A controls A.5.4, what managers must enforce and A.6.4, disciplinary process ask for overlapping evidence. One record can serve both when it names what it proves.

Is it in your scope?

Yes, always. CC1.5 is one of the 33 common criteria, and the common criteria are in every SOC 2 report, Type 1 or Type 2. The common criteria. Every SOC 2 report covers them, whatever else you add: governance, risk, access, operations, change and vendors. Most of the work in any SOC 2 sits here.

Polara Labs is not a CPA firm. SOC 2 examinations are performed by independent licensed U.S. CPA firms.

Control environment: the criteria around it

CC1.5 is one of 5 criteria in control environment, CC1.1 to CC1.5. Reading a group together shows how its outcomes fit, and one record often serves more than one of them.

• CC1.1, integrity and ethics
• CC1.2, board oversight
• CC1.3, structure and reporting
• CC1.4, hiring and competence
• CC1.5, this page

Before it: CC1.4, hiring and competence. After it: CC2.1, reliable information. All the criteria are on the Trust Services Criteria page, grouped by category.