SOC 2 SOC2-CC2.1: CC2.1 Relevant, quality information to support internal control (COSO principle 13)
The organisation obtains or produces relevant, good-quality information and uses it so internal control can function. Points of focus: there is a process to decide what information the control components and objectives need; systems capture data from inside and outside the organisation; relevant data is turned into information; and that information stays produced on time, kept up to date, correct and whole, reachable when needed, secured, capable of verification and kept, and is reviewed for relevance. The 2022 revision adds five points: internal and external data flows are documented and used in control design; system components (infrastructure, software, data, external systems, endpoints and roles) are recorded and kept current as assets; information is classified by its characteristics, such as personal data, customer confidential data or intellectual property, so threats and controls can be identified; people running controls work from reports they can trust to be whole, correct, up to date and valid; and the physical location and custody of assets is tracked, especially where they sit outside the organisation's own premises, such as on vendor equipment or staff-owned phones.
This control maps to 94 controls across 26 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
NIST-CSF-GV.OC-01 The organizational mission is understood and informs cybersecurity risk management
NIST-CSF-GV.OC-03 Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
NIST-CSF-GV.OC-04 Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated
NIST-CSF-GV.OC-05 Outcomes, capabilities, and services that the organization depends on are understood and communicated
NIST-CSF-GV.RM-03 Cybersecurity risk management activities and outcomes are included in enterprise risk management processes
NIST-CSF-ID.AM-07 Inventories of data and corresponding metadata for designated data types are maintained
NIST-CSF-ID.RA-05 Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization
NIST-CSF-ID.RA-09 The authenticity and integrity of hardware and software are assessed prior to acquisition and use
NIST-CSF-RS.AN-07 Incident data and metadata are collected, and their integrity and provenance are preserved
You are reading one control. How much of SOC 2 have you already done?
SOC 2 SOC2-CC2.1 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of SOC 2 your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 49 of 61 SOC 2 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 193 were rejected on the NIST SP 800-53 Rev 5 pair alone.