ZCybersecurity

SOC 2 compliance › Controls list

SOC 2 controls

SOC 2 controls list: CC1 to CC9 examples, evidence and how to choose yours

There is no official SOC 2 controls list. The AICPA sets criteria, and you design the controls that meet them. This page gives the full CC1 to CC9 map, example controls with evidence and owners, and a method to build your own set.

Tell Us What You NeedJump to the control examples

Free for buyers · provider-funded introductions · Updated October 2026

At a glance
Official listNone. You choose controls to meet the criteria
Criteria33 Common Criteria plus 28 in optional categories
Always in scopeSecurity, the Common Criteria CC1 to CC9
Examples belowIllustrations, not requirements
The short answer

What are the SOC 2 controls?

SOC 2 has no fixed list of controls. The AICPA Trust Services Criteria say what must be achieved, and your company writes the controls that achieve it. Security, the Common Criteria CC1 to CC9, is always in scope and holds 33 criteria. Availability, confidentiality, processing integrity and privacy add 28 more if you include them. Your auditor tests the controls you wrote, so a list copied from elsewhere only helps if it matches how you operate.

  • Criteria are fixed by the AICPA. Controls are yours to design and own.
  • The number of controls follows your scope, systems and risks, not a required count.
  • Every control needs an owner and a source of evidence before the audit window opens.

Use any example list as a starting draft. Your auditor tests what you actually do, so each control must describe your own process.

Criteria vs controls

Criteria, controls, tests and evidence: how they fit together

Vendor pages mix these four terms. The auditor does not.

From criterion to evidence in a SOC 2 auditFour layers from requirement to proof. A criterion is the requirement, set by the AICPA. A control is what you do to meet it, designed by you. A test is how the auditor checks it by inspecting, inquiring and observing. Evidence is the proof that it happened, collected by you. One criterion can need several controls and one control can cover several criteria.CriterionThe requirementto be met, writtenby the AICPASet by the AICPAControlWhat you do tomeet it, such asapproving accessDesigned by youTestHow the auditorchecks: inspect,inquire, observeDone by the auditorEvidenceProof it happened:tickets, logs,approvals, reportsCollected by youOne criterion can need several controls. One control can cover several criteria.
Four layers from the AICPA requirement to the proof you hand the auditor.
Criteria, controls, tests and evidence compared
TermWhat it isWho sets itExample
CriterionA requirement the system must meetThe AICPACC6.2: access is granted and removed with authorisation
Point of focusGuidance on what a criterion may involveThe AICPAConsider registration and authorisation of new users
ControlWhat your company does to meet the criterionYouAccess requests are approved by a manager before access is given
TestHow the auditor checks the controlThe auditorInspect a sample of requests for approvals
EvidenceProof the control operatedYouTicket with approval, dated access log

Points of focus, published by the AICPA alongside each criterion, are guidance for what a criterion may involve. They are not a checklist, and an auditor is not required to assess each one. Check the AICPA for the current version of the criteria and points of focus.

The map

SOC 2 Common Criteria CC1 to CC9: the 33 criteria at a glance

Security is always in scope. The other four categories are optional.

SOC 2 Common Criteria CC1 to CC9 and optional categoriesA map of the SOC 2 Common Criteria. Nine series: CC1 control environment, five criteria; CC2 communication and information, three; CC3 risk assessment, four; CC4 monitoring activities, two; CC5 control activities, three; CC6 logical and physical access, eight; CC7 system operations, five; CC8 change management, one; CC9 risk mitigation, two. That makes 33 Common Criteria. Optional categories add Availability three, Confidentiality two, Processing integrity five and Privacy eighteen criteria.CC1Controlenvironment5 criteriaCC2Communicationand information3 criteriaCC3Riskassessment4 criteriaCC4Monitoringactivities2 criteriaCC5Controlactivities3 criteriaCC6Logical andphysical access8 criteriaCC7Systemoperations5 criteriaCC8Changemanagement1 criterionCC9Riskmitigation2 criteriaSecurity (Common Criteria): 33 criteria, in every SOC 2 reportOptional categories, added by what you commit to customers:Availability3 criteriaConfidentiality2 criteriaProcessing integrity5 criteriaPrivacy18 criteria
The nine Common Criteria series with criteria counts, and the four optional categories.

Series counts are criteria, not controls. One criterion can need several controls, and one control can cover several criteria. See the Trust Services Criteria guide for how to decide which categories to include.

Control examples

SOC 2 Common Criteria controls list: examples for CC1 to CC9

Example controls with the evidence an auditor would expect to see. Rewrite each in your own words.

SOC 2 Common Criteria CC1 to CC9: example controls, evidence, owners and cadence
SeriesExample controlTypical evidenceUsual ownerCadence you might choose
CC1 Control environmentNew hires acknowledge the code of conduct and security responsibilitiesSigned acknowledgements, onboarding recordsHRAt hire
CC1 Control environmentManagement reviews security oversight and reporting linesMeeting minutes, org chartLeadershipAnnual
CC2 Communication and informationSecurity policies are published and staff are informed of changesPolicy portal, training records, announcementsSecurity leadAnnual and on change
CC3 Risk assessmentA documented risk assessment ranks risks and assigns treatment ownersRisk register, review notesSecurity or GRC leadAnnual and on major change
CC4 Monitoring activitiesControl performance is reviewed and deficiencies are tracked to closureReview records, issue trackerCompliance leadQuarterly
CC5 Control activitiesEach control has a named owner, a procedure and a link to the risk it addressesControl matrix, proceduresCompliance leadAnnual and on change
CC6 Logical and physical accessAccess is requested, approved, reviewed and removed on exitTickets, access review output, leaver checklistIT and HROn event and periodic review
CC6 Logical and physical accessStrong authentication and encryption protect systems and dataIdentity provider settings, encryption configurationEngineeringContinuous, reviewed periodically
CC7 System operationsSystems are monitored, alerts are triaged and incidents follow a planAlert logs, incident tickets, post-incident reviewsSecurity or engineeringContinuous, plan tested periodically
CC7 System operationsVulnerabilities are scanned, ranked and fixed within set timesScan reports, remediation ticketsEngineeringPer your policy
CC8 Change managementChanges are approved, tested and reviewed before releasePull requests, tickets, test resultsEngineeringEach change
CC9 Risk mitigationVendors are assessed before use and reviewed on a cycleVendor register, due diligence recordsProcurement or securityAt onboarding and periodically

These are illustrations. The cadence column shows options, not requirements. Choose cadences you will actually keep, because the auditor tests whether you followed your own description. For the order auditors work in, see the audit process.

Optional categories

Controls for Availability, Confidentiality, Processing integrity and Privacy

Each category adds its own criteria on top of the 33 Common Criteria.

Optional SOC 2 categories: criteria series, example controls and evidence
CategoryCriteriaExample controlTypical evidence
Availability3 (A1.1 to A1.3)Capacity is monitored, backups run, and the recovery plan is testedCapacity dashboards, backup logs, recovery test records
Confidentiality2 (C1.1, C1.2)Confidential data is identified, protected and disposed of per policyData classification register, disposal records
Processing integrity5 (PI1.1 to PI1.5)Processing is defined, and inputs, processing and outputs are checked for completeness and accuracySpecifications, reconciliation reports, error logs
SOC 2 Privacy criteria P1 to P8 with criteria counts
SeriesTopicCriteria
P1Notice and communication of objectives1
P2Choice and consent1
P3Collection2
P4Use, retention and disposal3
P5Access2
P6Disclosure and notification7
P7Quality1
P8Monitoring and enforcement1

Add a category only when customers expect it or your commitments cover it. Every extra category adds criteria to test. See which categories to include.

Build your set

How to build a SOC 2 control set in 6 steps

A method that starts from your system, not from a template.

1

Set scope and categories

Fix the system boundary and the categories customers need before you write any control. Scope drives the count.

2

Map criteria to what you already do

List what exists today against each criterion. Most companies already meet some criteria in practice.

3

Write testable statements

State who does what, how often and where the proof lives. Wording an auditor cannot test is wording to rewrite.

4

Name an owner and a source

Each control needs a person accountable and a system the evidence comes from.

5

Dry-run the evidence

Pull a sample the way an auditor would and fix gaps before the audit window opens. See the readiness checklist.

6

Review at every system change

Controls must keep matching reality. Update them when tools, vendors or staffing change.

Mistakes

8 mistakes that weaken a SOC 2 control set

Each one causes testing exceptions or last-minute evidence work.

1

Template copied unchanged

Controls that describe processes you do not run fail testing, because the auditor checks your actual practice.

2

Vague wording

Terms such as regularly or as needed cannot be tested. Say who, what and how often.

3

No named owner

A control with no accountable person is the first to lapse during the report period.

4

No evidence source

If the proof cannot be pulled from a system, collecting it becomes a scramble in the audit window.

5

Not operating as written

Writing a monthly review and doing it quarterly produces an exception. Write what you will keep doing.

6

Scope gaps

Systems left out of the boundary, or vendors left unmanaged, show up as criteria with nothing behind them.

7

Too many controls

Every extra control is another test. Prefer fewer controls that cover several criteria well.

8

Never reviewed after changes

A new tool or vendor can invalidate a control overnight. Tie reviews to change, not only the calendar.

Beyond your own controls

User entity controls and subservice organisations

Two items that sit outside your own control list but appear in your report.

  • Complementary user entity controls (CUECs) are controls your customers must run for your system to meet its criteria, such as managing their own user accounts. Your report lists them.
  • Subservice organisations, such as a cloud host, can be carved out or included. With carve-out, their controls are excluded from your report, and you still need to manage them as vendors under CC9.
  • Ask your auditor which approach fits your vendors before you finalise the boundary.
Compare

SOC 2 controls vs ISO 27001 Annex A controls

The main difference is that ISO gives you a list and SOC 2 does not.

SOC 2 and ISO 27001 compared on controls
TopicSOC 2ISO 27001
Official control listNone, criteria onlyAnnex A lists 93 controls in the 2022 version
Who picks controlsYou, to meet the criteriaYou, from Annex A with reasons recorded
Who checksA licensed CPA firmA certification body
ResultAttestation reportCertificate

Many controls overlap, so one control set can often serve both. See SOC 2 vs ISO 27001 to decide which you need. To compare auditors, see how to choose a SOC 2 auditor.

FAQ

SOC 2 controls FAQ

Short answers to the questions buyers ask when they build a control set.

How many SOC 2 controls are there?
There is no required number. The AICPA sets 33 Common Criteria for Security and 28 more across Availability, Confidentiality, Processing integrity and Privacy, which is 61 criteria in all. How many controls you need depends on your scope, systems and the categories you include.
Is there an official SOC 2 controls list?
No. The AICPA publishes criteria and points of focus, not a fixed list of controls. Your company designs the controls that meet the criteria, and the auditor tests them.
What is the difference between a SOC 2 criterion and a control?
A criterion is the requirement set by the AICPA. A control is what your company does to meet it. A test is how the auditor checks the control, and evidence is the proof it operated.
Which SOC 2 controls are required?
Security, the Common Criteria CC1 to CC9, is always in scope. Which controls meet those criteria is your decision. Availability, Confidentiality, Processing integrity and Privacy are added only if you include them. See the criteria guide.
What are the SOC 2 Common Criteria CC1 to CC9?
Nine series: CC1 Control environment, CC2 Communication and information, CC3 Risk assessment, CC4 Monitoring activities, CC5 Control activities, CC6 Logical and physical access, CC7 System operations, CC8 Change management and CC9 Risk mitigation.
What is an example of a SOC 2 control?
Access requests are approved by a manager before access is granted, and access is removed when someone leaves. The evidence would be tickets with approvals and a leaver checklist. This kind of control supports CC6.
Are Type 1 and Type 2 controls different?
No. Both use the same criteria. Type 1 checks that controls are designed suitably at a date. Type 2 also tests that they operated over a period. See Type 1 vs Type 2.
What is the difference between SOC 1 and SOC 2 controls?
SOC 1 reports cover controls relevant to a customer's financial reporting. SOC 2 reports cover controls relevant to the Trust Services Criteria, such as security and availability.
Can I reuse SOC 2 controls for ISO 27001?
Often, in part. Many controls overlap, but ISO 27001 has its own Annex A list and documentation requirements. See SOC 2 vs ISO 27001.
Can I use a template or a platform control set?
Yes as a starting draft. Each control must describe how your company actually operates, because the auditor tests your practice. Ask your auditor to review the draft early. See how to choose a SOC 2 auditor.
Start here

Know your scope. Then write controls you will keep.

Scope→Controls→Evidence→Matched provider
Tell Us What You Need

Free for buyers · provider-funded introductions

Scroll to Top