CC2.2 Internal communication of objectives and control responsibilities (COSO principle 14)

Information needed for internal control, including objectives and control duties, is communicated inside the organisation. Points of focus: a process lets all personnel understand and carry out their control duties; management and the board exchange what each needs; separate channels such as a whistle-blowing line exist when normal routes fail; the method suits timing, audience and content; people who design, run or monitor controls are told their responsibilities and changes to them; staff know how to report failures, incidents and concerns; objectives and changes are communicated promptly; a security awareness programme builds knowledge and good behaviour; and at system level, staff are told how the system and its boundaries operate, its objectives, and changes that affect them. The 2022 revision adds, for privacy engagements, a privacy awareness programme for personnel and telling staff how to report a suspected privacy incident.

Source: SOC 2 (2017 Trust Services Criteria), CC2.2. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open SOC 2 (2017 Trust Services Criteria) in the compliance library.

These are criteria, not controls: you design controls that meet them, and which criteria are in scope follows the categories your report covers (Security always; Availability, Confidentiality, Processing Integrity and Privacy only if chosen). A Type 2 report tests that the controls operated across the period, so the evidence asked for is samples across that period, not one copy.