SOC 2
CC - Common Criteria (Security)

SOC 2 CC5.3: COSO principle 12: Deploys control activities through policies and procedures

Deploys control activities through policies that establish what is expected and in procedures that put policies into action

What else in your programme already covers this

This control maps to 280 controls across 32 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

PCI DSS 4.0 · 33 controls

  • 1.1.1 NSC policies and procedures documented
  • 1.1.2 Roles and responsibilities for Requirement 1
  • 1.2.1 NSC configuration standards defined
  • 10.1.1 Requirement 10 policies and operational procedures documented and maintained
  • 11.1.1 Testing policy documented
  • 12.1.1 An overall information security policy is: • Established. • Published. • Maintained. • Disseminated to all relevant personnel, as well as to relevant vendors and business partners
  • 12.1.2 The information security policy is: • Reviewed at least once every 12 months. • Updated as needed to reflect changes to business objectives or risks to the environment
  • 12.2.1 Acceptable use policies for end-user technologies
  • 12.4.2 Quarterly PCI compliance reviews (SP)
  • 12.6.3 Security awareness training delivered
  • 12.6.3.2 Training on acceptable use of end-user technologies
  • 2.1.1 All security policies and operational procedures that are identified in Requirement 2 are: • Documented. • Kept up to date. • In use. • Known to all affected parties
  • 2.1.2 Roles and responsibilities for performing activities in Requirement 2 are documented, assigned, and understood
  • 2.2.6 System security parameters configured
  • 3.7.2 Secure key distribution
  • 3.7.3 Secure key storage
  • 3.7.6 Manual cleartext key operations use split knowledge
  • 3.7.9 Service provider customer key responsibilities
  • 4.1.1 All security policies and operational procedures that are identified in Requirement 4 are: • Documented. • Kept up to date. • In use. • Known to all affected parties
  • 4.1.2 Roles and responsibilities for performing activities in Requirement 4 are documented, assigned, and understood
  • 5.1.1 All security policies and operational procedures that are identified in Requirement 5 are: • Documented. • Kept up to date. • In use. • Known to all affected parties
  • 5.1.2 Roles and responsibilities for performing activities in Requirement 5 are documented, assigned, and understood
  • 6.1.1 All security policies and operational procedures that are identified in Requirement 6 are: • Documented. • Kept up to date. • In use. • Known to all affected parties
  • 6.1.2 Roles and responsibilities for performing activities in Requirement 6 are documented, assigned, and understood
  • 7.1.1 All security policies and operational procedures that are identified in Requirement 7 are: • Documented. • Kept up to date. • In use. • Known to all affected parties
  • 8.3.10 Service provider customer password guidance
  • 9.1.1 All security policies and operational procedures that are identified in Requirement 9 are: • Documented. • Kept up to date. • In use. • Known to all affected parties
  • 9.5.1.3 POI personnel training
  • 3.1.1 All security policies and operational procedures that are identified in Requirement 3 are: • Documented. • Kept up to date. • In use. • Known to all affected parties
  • 3.1.2 Roles and responsibilities for performing activities in Requirement 3 are documented, assigned, and understood
  • 8.1.1 All security policies and operational procedures that are identified in Requirement 8 are: • Documented. • Kept up to date. • In use. • Known to all affected parties
  • 8.1.2 Roles and responsibilities for performing activities in Requirement 8 are documented, assigned, and understood
  • 8.6.3 Passwords/passphrases for any application and system accounts are protected against misuse as follows: • Passwords/passphrases are changed periodically (at the frequency defined in the entity's targeted risk analysis, which is performed according to all

NIST SP 800-53 Rev 5 · 28 controls

  • NIST800-AC-1 Access control policy and procedures
  • NIST800-AT-1 Policy and procedures for awareness and training
  • NIST800-AU-1 Policy and procedures for audit and accountability
  • NIST800-CA-1 Policy and procedures for assessment, authorization, and monitoring
  • NIST800-CM-1 Policy and procedures for configuration management
  • NIST800-CP-1 Policy and procedures for contingency planning
  • NIST800-IA-1 Policy and procedures for identification and authentication
  • NIST800-IR-1 Policy and procedures for incident response
  • NIST800-MA-1 Policy and procedures for maintenance
  • NIST800-MP-1 Policy and procedures for media protection
  • NIST800-PE-1 Policy and procedures for physical and environmental protection
  • NIST800-PL-1 Policy and procedures for planning
  • NIST800-PL-2 System security and privacy plans
  • NIST800-PL-4 Rules of behavior
  • NIST800-PM-1 Information Security Program Plan. Develop and disseminate an organization-wide information security program plan that: Provides an overview of the requirements for the security program and a description of the security program management controls and
  • NIST800-PM-17 Protecting Controlled Unclassified Information on External Systems. Establish policy and procedures to ensure that requirements for the protection of controlled unclassified information that is processed, stored or transmitted on external systems, are implemented in
  • NIST800-PM-18 Privacy Program Plan. Develop and disseminate an organization-wide privacy program plan that provides an overview of the agency's privacy program, and: Includes a description of the structure of the privacy program and the resources
  • NIST800-PM-25 Minimization of Personally Identifiable Information Used in Testing, Training, and Research. Develop, document, and implement policies and procedures that address the use of personally identifiable information for internal testing, training, and research; Limit or
  • NIST800-PS-1 Policy and procedures for personnel security
  • NIST800-PT-1 Policy and Procedures. Develop, document, and disseminate to [organization-defined]: [organization-defined] personally identifiable information processing and transparency policy that: Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and Is consistent
  • NIST800-RA-1 Policy and procedures for risk assessment
  • NIST800-SA-1 Policy and procedures for system and services acquisition
  • NIST800-SA-5 System documentation
  • NIST800-SC-1 Policy and procedures for system and communications protection
  • NIST800-SI-1 Policy and procedures for system and information integrity
  • NIST800-SR-1 Policy and procedures for supply chain risk management
  • SP800-53-PL Planning Family
  • SP800-53-PS Personnel Security Family

FedRAMP High · 24 controls

  • AC-1 Policy and Procedures
  • AT-1 Policy and Procedures
  • AT-3 Role-Based Training
  • AU-1 Policy and Procedures
  • CA-1 Policy and Procedures
  • CM-1 Policy and Procedures
  • CM-11 User-Installed Software
  • CM-5 Access Restrictions for Change
  • CP-1 Policy and Procedures
  • IA-1 Policy and Procedures
  • IR-1 Policy and Procedures
  • MA-1 Policy and Procedures
  • MP-1 Policy and Procedures
  • PE-1 Policy and Procedures
  • PL-1 Policy and Procedures
  • PL-2 System Security and Privacy Plans
  • PS-1 Policy and Procedures
  • PS-9 Position Descriptions. Incorporate security and privacy roles and responsibilities into organizational position descriptions
  • RA-1 Policy and Procedures
  • SA-1 Policy and Procedures
  • SA-5 System Documentation
  • SC-1 Policy and Procedures
  • SI-1 Policy and Procedures
  • SR-1 Policy and Procedures (SR-1)

FedRAMP Moderate · 24 controls

  • AC-1 Policy and Procedures
  • AT-1 Policy and Procedures
  • AT-3 Role-Based Training
  • AU-1 Policy and Procedures
  • CA-1 Policy and Procedures
  • CM-1 Policy and Procedures
  • CM-11 User-Installed Software
  • CM-5 Access Restrictions for Change
  • CP-1 Policy and Procedures
  • IA-1 Policy and Procedures
  • IR-1 Policy and Procedures
  • MA-1 Policy and Procedures
  • MP-1 Policy and Procedures
  • PE-1 Policy and Procedures
  • PL-1 Policy and Procedures
  • PL-2 System Security and Privacy Plans
  • PS-1 Policy and Procedures
  • PS-9 Position Descriptions. Incorporate security and privacy roles and responsibilities into organizational position descriptions
  • RA-1 Policy and Procedures
  • SA-1 Policy and Procedures
  • SA-5 System Documentation
  • SC-1 Policy and Procedures
  • SI-1 Policy and Procedures
  • SR-1 Policy and Procedures (SR-1)

NIST SP 800-53 Rev 5 LOW · 24 controls

  • AC-1 Policy and Procedures
  • AT-1 Policy and Procedures
  • AT-3 Role-Based Training
  • AU-1 Policy and Procedures
  • CA-1 Policy and Procedures
  • CM-1 Policy and Procedures
  • CM-11 User-Installed Software
  • CM-5 Access Restrictions for Change
  • CP-1 Policy and Procedures
  • IA-1 Policy and Procedures
  • IR-1 Policy and Procedures
  • MA-1 Policy and Procedures
  • MP-1 Policy and Procedures
  • PE-1 Policy and Procedures
  • PL-1 Policy and Procedures
  • PL-2 System Security and Privacy Plans
  • PS-1 Policy and Procedures
  • PS-9 Position Descriptions. Incorporate security and privacy roles and responsibilities into organizational position descriptions
  • RA-1 Policy and Procedures
  • SA-1 Policy and Procedures
  • SA-5 System Documentation
  • SC-1 Policy and Procedures
  • SI-1 Policy and Procedures
  • SR-1 Policy and Procedures (SR-1)

NIST SP 800-53 Rev 5 MODERATE · 24 controls

  • AC-1 Policy and Procedures
  • AT-1 Policy and Procedures
  • AT-3 Role-Based Training
  • AU-1 Policy and Procedures
  • CA-1 Policy and Procedures
  • CM-1 Policy and Procedures
  • CM-11 User-Installed Software
  • CM-5 Access Restrictions for Change
  • CP-1 Policy and Procedures
  • IA-1 Policy and Procedures
  • IR-1 Policy and Procedures
  • MA-1 Policy and Procedures
  • MP-1 Policy and Procedures
  • PE-1 Policy and Procedures
  • PL-1 Policy and Procedures
  • PL-2 System Security and Privacy Plans
  • PS-1 Policy and Procedures
  • PS-9 Position Descriptions. Incorporate security and privacy roles and responsibilities into organizational position descriptions
  • RA-1 Policy and Procedures
  • SA-1 Policy and Procedures
  • SA-5 System Documentation
  • SC-1 Policy and Procedures
  • SI-1 Policy and Procedures
  • SR-1 Policy and Procedures (SR-1)

NIST SP 800-53 Revision 5.1 HIGH · 24 controls

  • AC-1 Policy and Procedures
  • AT-1 Policy and Procedures
  • AT-3 Role-Based Training
  • AU-1 Policy and Procedures
  • CA-1 Policy and Procedures
  • CM-1 Policy and Procedures
  • CM-11 User-Installed Software
  • CM-5 Access Restrictions for Change
  • CP-1 Policy and Procedures
  • IA-1 Policy and Procedures
  • IR-1 Policy and Procedures
  • MA-1 Policy and Procedures
  • MP-1 Policy and Procedures
  • PE-1 Policy and Procedures
  • PL-1 Policy and Procedures
  • PL-2 System Security and Privacy Plans
  • PS-1 Policy and Procedures
  • PS-9 Position Descriptions. Incorporate security and privacy roles and responsibilities into organizational position descriptions
  • RA-1 Policy and Procedures
  • SA-1 Policy and Procedures
  • SA-5 System Documentation
  • SC-1 Policy and Procedures
  • SI-1 Policy and Procedures
  • SR-1 Policy and Procedures (SR-1)

ISO/IEC 42001:2023 · 11 controls

  • 5.2 Policy
  • 6.2 Objectives and planning to achieve them
  • 7.5 Documented information
  • 7.5.2 Creating and updating
  • 7.5.3 Control of documented information
  • 8.1 Operational planning and control
  • A.2.2 AI policy
  • A.2.3 Alignment with other organizational policies
  • A.3.2 AI roles and responsibilities
  • A.9.2 Processes for responsible use of AI systems
  • A.9.3 Objectives for responsible use of AI system

ISO 22301:2019 · 10 controls

  • 4.4 Business continuity management system
  • 5.2 Policy
  • 5.2.1 Establishing the business continuity policy
  • 5.3 Roles, responsibilities and authorities
  • 7.5 Documented information
  • 7.5.1 General
  • 7.5.2 Creating and updating
  • 7.5.3 Control of documented information
  • 8.1 Operational planning and control
  • 8.4.4 Business continuity plans

ISO 27701:2019 · 9 controls

  • 5.3.2 Policy
  • 5.5.5 Documented information
  • 5.6.1 Operational planning and control
  • 6.15.1 Compliance with legal and contractual requirements
  • 6.2 Information security policies
  • 6.2.1 Management direction for information security
  • 6.3 Organization of information security
  • 6.6.3 User responsibilities
  • 6.9.1 Operational procedures and responsibilities

CIS Controls v8 · 8 controls

  • CIS-12.4 Establish and Maintain Architecture Diagram(s)
  • CIS-14.1 Establish and Maintain a Security Awareness Program
  • CIS-14.3 Train Workforce Members on Authentication Best Practices
  • CIS-14.8 Train Workforce on the Dangers of Connecting to and Transmitting Enterprise Data Over Insecure Networks
  • CIS-15.2 Establish and Maintain a Service Provider Management Policy
  • CIS-17.5 Assign Key Roles and Responsibilities
  • CIS-4.2 Establish and Maintain a Secure Configuration Process for Network Infrastructure
  • CIS-6.2 Establish an Access Revoking Process

HIPAA Security Rule · 8 controls

ISO 27002:2022 · 8 controls

  • 5.1 Policies for information security
  • 5.10 Acceptable use of information and other associated assets
  • 5.2 Information security roles and responsibilities
  • 5.3 Segregation of duties
  • 5.36 Compliance with policies, rules and standards for information security
  • 5.37 Documented operating procedures
  • 5.4 Management responsibilities
  • 6.3 Information security awareness, education and training

ISO 27001:2022 · 7 controls

  • 5.1 Policies for information security
  • 5.36 Compliance with policies, rules and standards for information security
  • 5.37 Documented operating procedures
  • 5.4 Management responsibilities
  • 5.8 Information security in project management
  • 6.3 Information security awareness, education and training
  • 6.4 Disciplinary process

NIST SP 800-66 Rev 2 · 6 controls

C5 (Germany) · 5 controls

  • C5-AM-02 Acceptable Use and Safe Handling of Assets Policy
  • C5-OIS-02 Information Security Policy
  • C5-SP-01 Documentation, communication and provision of policies and instructions
  • C5-SP-02 Review and Approval of Policies and Instructions
  • C5-SP-03 Exceptions from Existing Policies and Instructions

APRA CPS 220 Risk Management · 4 controls

  • CPS220-P23 Minimum Contents of the Risk Management Framework
  • CPS220-P30 Minimum Contents of the Risk Management Strategy
  • CPS220-P35 Required Content of Risk Management Policies and Procedures
  • CPS220-P36 Monitoring of Policy Review Dates and Ownership

NIST Cybersecurity Framework 2.0 · 4 controls

  • NIST-CSF-GV.PO-01 Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
  • NIST-CSF-GV.PO-02 Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission
  • NIST-CSF-GV.SC-02 Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally
  • NIST-CSF-PR.AT-01 Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind

Australia My Health Records Act 2012 · 2 controls

  • MYHR-REG-3 Conditions of registration and participation
  • MYHR-SEC-1 Written security and access policy

CMMC 2.0 · 2 controls

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 2 controls

EU AI Act · 2 controls

NIST SP 800-171 Rev 3 · 2 controls

APRA CPS 230 Operational Risk Management · 1 control

  • CPS230-15 Operational Risk Elements of the Risk Management Framework

APRA CPS 234 · 1 control

  • CPS234-19 Information Security Policy Framework

Australia Consumer Data Right - Banking (CDR) · 1 control

  • AUCDR-IS-STEP1 Step 1 - Define and implement security governance for CDR data

Authorised Economic Operator (AEO) Programmes - Global Standards · 1 control

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 1 control

  • CFTC-SS-7 Generally Accepted Standards and Best Practices

DORA · 1 control

GDPR · 1 control

NIS2 Directive · 1 control

  • Art.21.2.a Policies on risk analysis and on information system security

NIST SP 800-218 · 1 control

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in CC - Common Criteria (Security)

You are reading one control. How much of SOC 2 have you already done?

SOC 2 CC5.3 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of SOC 2 your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 49 of 61 SOC 2 controls already carry evidence.

If you hold NIST SP 800-53 Rev 580.3% covered · 12 gapsIf you hold FedRAMP Moderate60.7% covered · 24 gapsIf you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.157.4% covered · 26 gapsIf you hold ISO 27001:202257.4% covered · 26 gapsIf you hold C5 (Germany)54.1% covered · 28 gapsIf you hold NIST Cybersecurity Framework 2.052.5% covered · 29 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 193 were rejected on the NIST SP 800-53 Rev 5 pair alone.

See the released pairs, $299 eachBrowse the graph free

Query this from an agent

The graph holds this control, the 280 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll SOC 2 controls