CC1.2 Board independence and oversight of internal control (COSO principle 2)

A governing body that is independent of management oversees how internal control is designed and how it performs. Points of focus: the board accepts defined oversight duties; it keeps and periodically reviews the skills it needs to question management and act; enough members are independent and objective; and where it lacks expertise in any of the five trust services categories (security, availability, confidentiality, processing integrity, privacy) it adds it through a committee or outside advisers.

Source: SOC 2 (2017 Trust Services Criteria), CC1.2. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open SOC 2 (2017 Trust Services Criteria) in the compliance library.

These are criteria, not controls: you design controls that meet them, and which criteria are in scope follows the categories your report covers (Security always; Availability, Confidentiality, Processing Integrity and Privacy only if chosen). A Type 2 report tests that the controls operated across the period, so the evidence asked for is samples across that period, not one copy.