SOC 2
CC - Common Criteria (Security)

SOC 2 SOC2-CC1.1: CC1.1 Commitment to integrity and ethical values (COSO principle 1)

The organisation shows through direction, decisions and behaviour that integrity and ethics matter to how it runs its controls. Points of focus: leadership sets the tone at the top; expected conduct is written into a code that staff, outsourced providers and partners understand; performance of individuals and teams is judged against that code; departures from it are found and corrected promptly and consistently; and contractors and vendor staff are brought within the same conduct expectations, adherence checks and corrective action.

Maintained by Gerard BlokdykControl text last updated

What else in your programme already covers this

This control maps to 54 controls across 21 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

ISO 27001:2022 · 8 controls

  • 5.1 Policies for information security
  • 5.2 Information security roles and responsibilities
  • 5.35 Independent review of information security
  • 5.36 Compliance with policies, rules and standards for information security
  • 6.2 Terms and conditions of employment
  • 6.3 Information security awareness, education and training
  • 6.4 Disciplinary process
  • 6.6 Confidentiality or non-disclosure agreements

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 5 controls

ISO 27002:2022 · 5 controls

  • 5.1 Policies for information security
  • 5.36 Compliance with policies, rules and standards for information security
  • 6.2 Terms and conditions of employment
  • 6.3 Information security awareness, education and training
  • 6.4 Disciplinary process

C5 (Germany) · 4 controls

  • C5-AM-05 Commitment to Permissible Use, Safe Handling and Return of Assets
  • C5-HR-02 Employment terms and conditions
  • C5-HR-04 Disciplinary measures
  • C5-OIS-01 Information Security Management System (ISMS)

FedRAMP High · 4 controls

  • PL-4 Rules of Behavior
  • PL-4(1) Rules of Behavior | Social Media and External Site/Application Usage Restrictions (PL-4(1))
  • PS-6 Access Agreements
  • PS-8 Personnel Sanctions

FedRAMP Moderate · 4 controls

  • PL-4 Rules of Behavior
  • PL-4(1) Rules of Behavior | Social Media and External Site/Application Usage Restrictions (PL-4(1))
  • PS-6 Access Agreements
  • PS-8 Personnel Sanctions

APRA CPS 220 Risk Management · 3 controls

  • CPS220-02 Board Responsibility for the Risk Management Framework
  • CPS220-P30 Minimum Contents of the Risk Management Strategy
  • CPS220-P35 Required Content of Risk Management Policies and Procedures

ISO 27701:2019 · 3 controls

  • 5.2 Context of the organization
  • 5.3 Leadership
  • 5.3.1 Leadership and commitment

ISO/IEC 42001:2023 · 3 controls

  • 5.1 Leadership and commitment
  • A.2.2 AI policy
  • A.9.3 Objectives for responsible use of AI system

NIST SP 800-53 Rev 5 · 3 controls

HIPAA Security Rule · 2 controls

AICPA SOC 3 · 1 control

  • SOC3-CONTROL-ENV Control Environment

APRA CPS 230 Operational Risk Management · 1 control

  • CPS230-P12 Key Principles for Operational Risk, Resilience and Service Providers

DORA · 1 control

EU AI Act · 1 control

ISO 22301:2019 · 1 control

  • 5.1 Leadership and commitment

NIST Cybersecurity Framework 2.0 · 1 control

  • NIST-CSF-GV.RR-01 Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving

NIST SP 800-161 Rev 1 · 1 control

NIST SP 800-171 Rev 3 · 1 control

NIST SP 800-66 Rev 2 · 1 control

PCI DSS 4.0 · 1 control

  • 12.7.1 12.7.1 Pre-hire screening of personnel with CDE access

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in CC - Common Criteria (Security)

You are reading one control. How much of SOC 2 have you already done?

SOC 2 SOC2-CC1.1 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of SOC 2 your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 49 of 61 SOC 2 controls already carry evidence.

If you hold NIST SP 800-53 Rev 580.3% covered · 12 gapsIf you hold FedRAMP Moderate60.7% covered · 24 gapsIf you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.157.4% covered · 26 gapsIf you hold ISO 27001:202257.4% covered · 26 gapsIf you hold C5 (Germany)54.1% covered · 28 gapsIf you hold NIST Cybersecurity Framework 2.052.5% covered · 29 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 193 were rejected on the NIST SP 800-53 Rev 5 pair alone.

See the released pairs, $299 eachBrowse the graph free

Query this from an agent

The graph holds this control, the 54 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll SOC 2 controls