SOC 2 CC5.2: technology controls, explained for startups

What usually proves it

An auditor wants records from the period being examined, pulled from the systems that hold them rather than written up afterwards. Dates matter. A record with a date and a named owner carries more weight than a screenshot with neither. For CC5.2, the usual records are these.

• Configuration exports from the identity provider and cloud console
• Branch protection and pipeline settings
• Infrastructure as code or documented baselines

What Polara asks about it

The free readiness assessment asks 2 questions that bear on CC5.2. A yes becomes a task to show the proof. A no becomes a task to fix the gap, with the steps written out.

• Do you maintain an inventory of production systems, data stores, and SaaS applications with an owner for each? If yes, show it: spreadsheet listing each production system, data store and SaaS application with an owner, a configuration management database export, or a cloud resource inventory with owner tags. If no, the fix: build one inventory of production systems, data stores and SaaS applications, assign an owner to each entry, and export it.
• Do you apply a documented hardening or configuration baseline to production systems? If yes, show it: center for Internet Security (CIS) Benchmark report for the production account, a hardening standard document, the infrastructure as code module that enforces the baseline, or a configuration compliance scan. If no, the fix: document a hardening baseline for production systems and export the configuration that shows it applied.

Policies, templates and connected evidence

A policy states the rule, a template gives you the record to keep, and a connected system pulls the proof from the source. An auditor checks that the three agree: the cadence in the policy, the dates in the record and what the system shows.

In the policy pack, the Asset Management Policy and Operations Security Policy cover CC5.2.

Is it in your scope?

Yes, always. CC5.2 is one of the 33 common criteria, and the common criteria are in every SOC 2 report, Type 1 or Type 2. The common criteria. Every SOC 2 report covers them, whatever else you add: governance, risk, access, operations, change and vendors. Most of the work in any SOC 2 sits here.

Polara Labs is not a CPA firm. SOC 2 examinations are performed by independent licensed U.S. CPA firms.

Control activities: the criteria around it

CC5.2 is one of 3 criteria in control activities, CC5.1 to CC5.3. Reading a group together shows how its outcomes fit, and one record often serves more than one of them.

• CC5.1, choosing controls
• CC5.2, this page
• CC5.3, policies and procedures

Before it: CC5.1, choosing controls. After it: CC5.3, policies and procedures. All the criteria are on the Trust Services Criteria page, grouped by category.