polara labs

SOC 2 · Trust Services Criteria · 2 min read

SOC 2 CC3.4: changes that add risk, explained for startups

What CC3.4 asks you to show about changes that add risk, and what proves it.

When something significant changes, you check whether your risks changed with it. A new product line, a new cloud provider, an acquisition or a big hiring push all count. The record shows you looked and what you decided.1

CC3.4 is a common criterion, so it is part of every SOC 2 report.

What usually proves it

An auditor wants records from the period being examined, pulled from the systems that hold them rather than written up afterwards. Dates matter. A record with a date and a named owner carries more weight than a screenshot with neither. For CC3.4, the usual records are these.

  • Risk assessment updates triggered by a change
  • Meeting notes that review a significant change
  • Vendor or architecture reviews for new systems

What Polara asks about it

The free readiness assessment asks 2 questions that bear on CC3.4. A yes becomes a task to show the proof. A no becomes a task to fix the gap, with the steps written out.

  • Completed a formal information security risk assessment in the last 12 months? If yes, show it: risk assessment report with ratings, risk register spreadsheet, risk workshop notes, or risk review approval. If no, the fix: perform and document a formal risk assessment covering the in-scope system, with an owner for each identified risk.
  • Are significant changes (new systems, vendors, or headcount changes) assessed for risk before rollout? If yes, show it: change ticket with its risk section completed before release, an architecture review note, a new vendor risk assessment, or a risk register row dated before the rollout. If no, the fix: require a risk review of each new system, vendor or significant headcount change before it goes live, and retain the review.

Policies, templates and connected evidence

A policy states the rule, a template gives you the record to keep, and a connected system pulls the proof from the source. An auditor checks that the three agree: the cadence in the policy, the dates in the record and what the system shows.

In the policy pack, the Risk Management Policy covers CC3.4.

Free templates that help, printed in full with Word, PDF or Excel downloads:

If you also run ISO 27001, the Annex A control A.5.8, security in projects ask for overlapping evidence. One record can serve both when it names what it proves.

Where it goes wrong

One gap a remediation playbook covers here is risk Assessment. The fix: create a risk register with identified risks scored by likelihood and impact. The proof: risk register export showing identified risks, scores, and owners.

An auditor asks two things about it. Is there a documented risk assessment methodology? Does a risk register exist with identified and scored risks?

Is it in your scope?

Yes, always. CC3.4 is one of the 33 common criteria, and the common criteria are in every SOC 2 report, Type 1 or Type 2. The common criteria. Every SOC 2 report covers them, whatever else you add: governance, risk, access, operations, change and vendors. Most of the work in any SOC 2 sits here.

Polara Labs is not a CPA firm. SOC 2 examinations are performed by independent licensed U.S. CPA firms.

Risk assessment: the criteria around it

CC3.4 is one of 4 criteria in risk assessment, CC3.1 to CC3.4. Reading a group together shows how its outcomes fit, and one record often serves more than one of them.

Before it: CC3.3, fraud risk. After it: CC4.1, control monitoring. All the criteria are on the Trust Services Criteria page, grouped by category.

Questions

What does SOC 2 CC3.4 ask a startup to show?
When something significant changes, you check whether your risks changed with it. A new product line, a new cloud provider, an acquisition or a big hiring push all count. The record shows you looked and what you decided.
What evidence proves CC3.4?
The usual evidence is risk assessment updates triggered by a change, meeting notes that review a significant change and vendor or architecture reviews for new systems. An auditor tests it across the report period, so dated records matter more than a written promise.

Sources

  1. TSP Section 100, Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy AICPA. The criteria themselves, including the common criteria every SOC 2 report covers.

Related

Get audit-ready without a compliance team.

The readiness assessment is free, with no payment and no card. Star is $2,000 one time to get on the platform and close your gaps. Orbit is $7,800 a year, and your SOC 2 Type 2 audit is included in every contract year. You can be audit-ready starting at about a week.

Take the free assessment

Polara Labs is not a CPA firm. SOC 2 examinations are performed by independent licensed U.S. CPA firms.