SOC 2 CC5.1: choosing controls, explained for startups

What usually proves it

An auditor wants records from the period being examined, pulled from the systems that hold them rather than written up afterwards. Dates matter. A record with a date and a named owner carries more weight than a screenshot with neither. For CC5.1, the usual records are these.

• A risk register that names the control for each treated risk
• A control matrix
• A separation of duties matrix with compensating controls

What Polara asks about it

The free readiness assessment asks one question that bear on CC5.1. A yes becomes a task to show the proof. A no becomes a task to fix the gap, with the steps written out.

• Are significant changes (new systems, vendors, or headcount changes) assessed for risk before rollout? If yes, show it: change ticket with its risk section completed before release, an architecture review note, a new vendor risk assessment, or a risk register row dated before the rollout. If no, the fix: require a risk review of each new system, vendor or significant headcount change before it goes live, and retain the review.

Policies, templates and connected evidence

A policy states the rule, a template gives you the record to keep, and a connected system pulls the proof from the source. An auditor checks that the three agree: the cadence in the policy, the dates in the record and what the system shows.

In the policy pack, the Risk Management Policy covers CC5.1.

Free templates that help, printed in full with Word, PDF or Excel downloads:

• Separation of duties matrix template

If you also run ISO 27001, the Annex A control A.5.3, segregation of duties ask for overlapping evidence. One record can serve both when it names what it proves.

Is it in your scope?

Yes, always. CC5.1 is one of the 33 common criteria, and the common criteria are in every SOC 2 report, Type 1 or Type 2. The common criteria. Every SOC 2 report covers them, whatever else you add: governance, risk, access, operations, change and vendors. Most of the work in any SOC 2 sits here.

Polara Labs is not a CPA firm. SOC 2 examinations are performed by independent licensed U.S. CPA firms.

Control activities: the criteria around it

CC5.1 is one of 3 criteria in control activities, CC5.1 to CC5.3. Reading a group together shows how its outcomes fit, and one record often serves more than one of them.

• CC5.1, this page
• CC5.2, technology controls
• CC5.3, policies and procedures

Before it: CC4.2, fixing deficiencies. After it: CC5.2, technology controls. All the criteria are on the Trust Services Criteria page, grouped by category.