SOC 2's CC1 to CC5 criteria are the governance layer: control environment, information and communication, risk assessment, monitoring, and control activities. A small company meets them with a few short documents, named owners, a risk register, a regular review, and records that these things actually happen.
Where do these criteria come from?
CC1 to CC5 follow the COSO framework, and the AICPA text lists a COSO principle for each criterion. We read the 2017 Trust Services Criteria with the 2022 points of focus. Below we paraphrase them and cite IDs.
CC1: control environment
CC1 asks whether leadership sets the tone and holds people accountable. It covers integrity and ethics, board oversight and independence (CC1.2), structure and authority, commitment to competence (CC1.4), and accountability (CC1.5).
For a ten person company with no board, an advisor or investor can provide independent oversight. Keep minutes of a quarterly security review. Write a code of conduct and have people acknowledge it. Keep job descriptions or a role matrix, and show hiring checks and training.
CC2: information and communication
CC2 covers using quality information (CC2.1), communicating internally (CC2.2), and communicating with outsiders (CC2.3). In practice: a policy library employees can find, an onboarding session on security, a way to report incidents or concerns, and a customer facing place that states your security commitments and how to contact you. Keep acknowledgment records and the support or security contact page.
CC3: risk assessment
CC3 asks you to set clear objectives (CC3.1), identify and analyze risks (CC3.2), consider fraud (CC3.3), and assess changes that could affect controls (CC3.4). Keep a risk register: risk, likelihood, impact, owner, treatment, review date. Run it at least yearly and after big changes such as a new cloud region, a new data type or an acquisition. Add one fraud scenario, for example payment redirection.
CC4: monitoring activities
CC4 requires ongoing or separate evaluations that controls are present and working (CC4.1) and communication of deficiencies to those who can fix them (CC4.2). Make a calendar: monthly control checks, quarterly access reviews, yearly policy review. Track every failed check as an issue with an owner and close date. Auditors like to see a deficiency found by you and fixed by you.
CC5: control activities
CC5 covers selecting controls that reduce risk to an acceptable level (CC5.1), general controls over technology (CC5.2), and deploying controls through policies and procedures (CC5.3). This is where your technical controls and policies meet. Keep a control matrix that links each risk to a control, an owner, a policy and the evidence.
A one page governance kit
- Org chart or role list with security owners
- Code of conduct and acknowledgments
- Quarterly security review minutes
- Risk register
- Control matrix
- Monitoring calendar and issue log
Mistakes to avoid
- Copying a template that describes a board you do not have.
- A risk register written once and never reviewed.
- Policies without owners or review dates.
- Treating CC1 to CC5 as paperwork for the auditor. They decide whether the technical controls survive staff changes.
What to do
- Name a security owner and an independent reviewer.
- Publish a code of conduct and collect acknowledgments.
- Hold and minute a quarterly security review.
- Build the risk register and review it on a schedule.
- Create the control matrix linking risks, controls and evidence.
- Set the monitoring calendar and an issue log.
- Review all documents annually and after major change.
Quick check
Do small companies need a board for CC1?
The criteria ask for oversight and independence appropriate to your size. Many small companies use an advisor, investor or outside reviewer, with minutes of regular meetings as evidence.
Which criteria cover risk assessment?
CC3.1 to CC3.4: objectives, risk identification and analysis, fraud, and changes that affect controls.
How Safeguard helps automate this
Governance criteria need steady proof, which is what teams tend to lose track of. Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of by screenshot, and monitoring runs continuously between audits. That saves time and keeps your CC4 monitoring story honest.
Where your control matrix touches software, technical evidence comes from your real code and dependencies, through scans, SBOMs and reachability, not just policies. Safeguard's agent can open tested fix pull requests for vulnerable dependencies. It is off by default, every category starts on Manual, and you choose which categories run automatically and set the approval level. The examination is done by an independent CPA firm. Safeguard helps prepare and keep evidence ready, and does not guarantee a pass.
See it at /demos/framework-mapping.
Want to see it on your own stack? Book a call.
Sources
Last reviewed: 18 October 2026.
