CC1.1 Commitment to integrity and ethical values (COSO principle 1)

The organisation shows through direction, decisions and behaviour that integrity and ethics matter to how it runs its controls. Points of focus: leadership sets the tone at the top; expected conduct is written into a code that staff, outsourced providers and partners understand; performance of individuals and teams is judged against that code; departures from it are found and corrected promptly and consistently; and contractors and vendor staff are brought within the same conduct expectations, adherence checks and corrective action.

Source: SOC 2 (2017 Trust Services Criteria), CC1.1. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open SOC 2 (2017 Trust Services Criteria) in the compliance library.

These are criteria, not controls: you design controls that meet them, and which criteria are in scope follows the categories your report covers (Security always; Availability, Confidentiality, Processing Integrity and Privacy only if chosen). A Type 2 report tests that the controls operated across the period, so the evidence asked for is samples across that period, not one copy.