CC2.1 Relevant, quality information to support internal control (COSO principle 13)

The organisation obtains or produces relevant, good-quality information and uses it so internal control can function. Points of focus: there is a process to decide what information the control components and objectives need; systems capture data from inside and outside the organisation; relevant data is turned into information; and that information stays produced on time, kept up to date, correct and whole, reachable when needed, secured, capable of verification and kept, and is reviewed for relevance. The 2022 revision adds five points: internal and external data flows are documented and used in control design; system components (infrastructure, software, data, external systems, endpoints and roles) are recorded and kept current as assets; information is classified by its characteristics, such as personal data, customer confidential data or intellectual property, so threats and controls can be identified; people running controls work from reports they can trust to be whole, correct, up to date and valid; and the physical location and custody of assets is tracked, especially where they sit outside the organisation's own premises, such as on vendor equipment or staff-owned phones.

Source: SOC 2 (2017 Trust Services Criteria), CC2.1. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open SOC 2 (2017 Trust Services Criteria) in the compliance library.

These are criteria, not controls: you design controls that meet them, and which criteria are in scope follows the categories your report covers (Security always; Availability, Confidentiality, Processing Integrity and Privacy only if chosen). A Type 2 report tests that the controls operated across the period, so the evidence asked for is samples across that period, not one copy.