Frameworks / SOC 2 / SOC2-CC5.3 SOC 2
CC - Common Criteria (Security)
SOC 2 SOC2-CC5.3: CC5.3 Deploying controls through policies and procedures (COSO principle 12) Control activities are put into practice through policies that state expectations and procedures that carry them out. Points of focus: policies and procedures embed management's directives in daily work; responsibility and accountability sit with the managers of the unit where the risk lives; controls are performed on time; issues found while performing controls are investigated and acted on; competent people with enough authority perform them diligently; and policies and procedures are reviewed periodically and refreshed when needed.
Maintained by Gerard Blokdyk · Control text last updated 21 May 2026 What else in your programme already covers this This control maps to 208 controls across 29 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
1.1.1 1.1.1 Requirement 1 policies and procedures governed 1.1.2 1.1.2 Requirement 1 roles and responsibilities assigned 1.2.1 1.2.1 Ruleset configuration standards for NSCs 10.1.1 10.1.1 Requirement 10 policies and procedures maintained and in use 11.1.1 11.1.1 Requirement 11 policies and procedures managed 12.1.1 12.1.1 Overall information security policy established and disseminated 12.1.2 12.1.2 Security policy reviewed annually and updated as needed 12.2.1 12.2.1 Rules for acceptable use of end-user technology 12.4.2 12.4.2 Quarterly reviews that personnel follow security procedures 12.6.3 12.6.3 Security awareness training on hire and annually with acknowledgment 12.6.3.2 12.6.3.2 Awareness training covers acceptable use of end-user technologies 2.1.1 2.1.1 Requirement 2 policies and procedures governed 2.1.2 2.1.2 Requirement 2 roles and responsibilities assigned 2.2.6 2.2.6 System security parameters configured against misuse 3.7.2 3.7.2 Secure distribution of cryptographic keys 3.7.3 3.7.3 Secure storage of cryptographic keys 3.7.6 3.7.6 Split knowledge and dual control for manual key operations 3.7.9 3.7.9 Key guidance for service provider customers 4.1.1 4.1.1 Requirement 4 policies and procedures maintained and communicated 4.1.2 4.1.2 Requirement 4 roles and responsibilities assigned 5.1.1 5.1.1 Requirement 5 policies and procedures maintained and communicated 5.1.2 5.1.2 Requirement 5 roles and responsibilities assigned 6.1.1 6.1.1 Requirement 6 policies and procedures maintained and communicated 6.1.2 6.1.2 Requirement 6 roles and responsibilities assigned 7.1.1 7.1.1 Requirement 7 policies and procedures maintained 8.3.10 8.3.10 Service provider customer password guidance 9.1.1 9.1.1 Requirement 9 policies and procedures maintained 9.5.1.3 9.5.1.3 Training for personnel in POI environments 3.1.1 3.1.1 Requirement 3 policies and procedures maintained and in use 3.1.2 3.1.2 Assigned duties for Requirement 3 activities 8.1.1 8.1.1 Requirement 8 policies and procedures maintained 8.1.2 8.1.2 Requirement 8 roles and responsibilities assigned 8.6.3 8.6.3 System account passwords protected against misuse AC-1 Policy and Procedures AT-1 Policy and Procedures AT-3 Role-Based Training AU-1 Policy and Procedures CA-1 Policy and Procedures CM-1 Policy and Procedures CM-11 User-Installed Software CM-5 Access Restrictions for Change CP-1 Policy and Procedures IA-1 Policy and Procedures IR-1 Policy and Procedures MA-1 Policy and Procedures MP-1 Policy and Procedures PE-1 Policy and Procedures PL-1 Policy and Procedures PL-2 System Security and Privacy Plans PS-1 Policy and Procedures PS-9 Position Descriptions (PS-9) RA-1 Policy and Procedures SA-1 Policy and Procedures SA-5 System Documentation SC-1 Policy and Procedures SI-1 Policy and Procedures SR-1 Policy and Procedures (SR-1) AC-1 Policy and Procedures AT-1 Policy and Procedures AT-3 Role-Based Training AU-1 Policy and Procedures CA-1 Policy and Procedures CM-1 Policy and Procedures CM-11 User-Installed Software CM-5 Access Restrictions for Change CP-1 Policy and Procedures IA-1 Policy and Procedures IR-1 Policy and Procedures MA-1 Policy and Procedures MP-1 Policy and Procedures PE-1 Policy and Procedures PL-1 Policy and Procedures PL-2 System Security and Privacy Plans PS-1 Policy and Procedures PS-9 Position Descriptions (PS-9) RA-1 Policy and Procedures SA-1 Policy and Procedures SA-5 System Documentation SC-1 Policy and Procedures SI-1 Policy and Procedures SR-1 Policy and Procedures (SR-1) 5.2 AI policy 6.2 AI objectives and planning to achieve them 7.5 Documented information 7.5.2 Creating and updating documented information 7.5.3 Control of documented information 8.1 Operational planning and control A.2.2 AI policy A.2.3 Alignment with other organizational policies A.3.2 AI roles and responsibilities A.9.2 Processes for responsible use of AI systems A.9.3 Objectives for responsible use of AI system 4.4 Business continuity management system 5.2 Policy 5.2.1 Establishing the business continuity policy 5.3 Roles, responsibilities and authorities 7.5 Documented information 7.5.1 General 7.5.2 Creating and updating 7.5.3 Control of documented information 8.1 Operational planning and control 8.4.4 Business continuity plans 5.3.2 Policy 5.5.5 Documented information 5.6.1 Operational planning and control 6.15.1 Compliance with legal and contractual requirements 6.2 Information security policies 6.2.1 Management direction for information security 6.3 Organization of information security 6.6.3 User responsibilities 6.9.1 Operational procedures and responsibilities CIS-12.4 Establish and Maintain Architecture Diagram(s) CIS-14.1 Establish and Maintain a Security Awareness Program CIS-14.3 Train Workforce Members on Authentication Best Practices CIS-14.8 Train Workforce on the Dangers of Connecting to and Transmitting Enterprise Data Over Insecure Networks CIS-15.2 Establish and Maintain a Service Provider Management Policy CIS-17.5 Assign Key Roles and Responsibilities CIS-4.2 Establish and Maintain a Secure Configuration Process for Network Infrastructure CIS-6.2 Establish an Access Revoking Process 5.1 Policies for information security 5.10 Acceptable use of information and other associated assets 5.2 Information security roles and responsibilities 5.3 Segregation of duties 5.36 Compliance with policies, rules and standards for information security 5.37 Documented operating procedures 5.4 Management responsibilities 6.3 Information security awareness, education and training 5.1 Policies for information security 5.36 Compliance with policies, rules and standards for information security 5.37 Documented operating procedures 5.4 Management responsibilities 5.8 Information security in project management 6.3 Information security awareness, education and training 6.4 Disciplinary process C5-AM-02 Acceptable Use and Safe Handling of Assets Policy C5-OIS-02 Information Security Policy C5-SP-01 Documentation, communication and provision of policies and instructions C5-SP-02 Review and Approval of Policies and Instructions C5-SP-03 Exceptions from Existing Policies and Instructions CPS220-P23 Minimum Contents of the Risk Management Framework CPS220-P30 Minimum Contents of the Risk Management Strategy CPS220-P35 Required Content of Risk Management Policies and Procedures CPS220-P36 Monitoring of Policy Review Dates and Ownership NIST-CSF-GV.PO-01 Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced NIST-CSF-GV.PO-02 Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission NIST-CSF-GV.SC-02 Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally NIST-CSF-PR.AT-01 Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind MYHR-REG-3 Conditions of registration and participation MYHR-SEC-1 Written security and access policy CPS230-15 Operational Risk Elements of the Risk Management Framework CPS234-19 Information Security Policy Framework AUCDR-IS-STEP1 Step 1 - Define and implement security governance for CDR data CFTC-SS-7 Generally Accepted Standards and Best Practices Art.21.2.a Policies on risk analysis and on information system security Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Other controls in CC - Common Criteria (Security) You are reading one control. How much of SOC 2 have you already done? SOC 2 SOC2-CC5.3 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of SOC 2 your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 49 of 61 SOC 2 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 193 were rejected on the NIST SP 800-53 Rev 5 pair alone.
Query this from an agent The graph holds this control, the 208 it maps to, and the evidence behind each claim, over MCP and REST.