SOC 2 · CC1
CC1 · Control Environment
5 controls in this family.
SOC2-CC1-CODE-OF-CONDUCT
Code of Conduct and Ethics Policy
Formal policy establishing expected standards of ethical behavior, conflicts of interest, and disciplinary consequences for all employees and contractors.
SOC2-CC1-ORG-STRUCTURE
Organizational Structure and Accountability
Documented org chart with clear reporting lines, defined roles, and delegated authority for security and compliance responsibilities.
SOC2-CC1-BACKGROUND-CHECKS
Employee Background Check Process
Pre-employment background screening for all employees and contractors with access to customer data or production systems.
SOC2-CC1-PERFORMANCE-MGMT
Performance Management and Competency Assessment
Formal process for evaluating employee performance, identifying skills gaps, and ensuring staff have the competencies required for their security-relevant roles.
SOC2-CC1-SECURITY-TRAINING
Security Awareness Training
Annual security awareness training for all employees covering phishing, social engineering, password hygiene, and data handling responsibilities.
Code of Conduct and Ethics Policy
Formal policy establishing expected standards of ethical behavior, conflicts of interest, and disciplinary consequences for all employees and contractors.
Testing: Annually
Organizational Structure and Accountability
Documented org chart with clear reporting lines, defined roles, and delegated authority for security and compliance responsibilities.
Testing: Annually
Employee Background Check Process
Pre-employment background screening for all employees and contractors with access to customer data or production systems.
Testing: Per hire
Performance Management and Competency Assessment
Formal process for evaluating employee performance, identifying skills gaps, and ensuring staff have the competencies required for their security-relevant roles.
Testing: Annually
Security Awareness Training
Annual security awareness training for all employees covering phishing, social engineering, password hygiene, and data handling responsibilities.
Testing: Annually