CC3.1 Objectives specified clearly enough to assess risk (COSO principle 6)

Objectives are defined precisely enough that risks to them can be identified and assessed. Points of focus: operations objectives reflect management's choices and risk tolerances, include performance goals and guide resource allocation; external financial reporting objectives follow suitable accounting principles, consider materiality and reflect real activity; external non-financial reporting objectives follow applicable laws and recognised frameworks with suitable precision; internal reporting gives management accurate, sufficiently precise information; compliance objectives absorb legal minimums and tolerances; and sub-objectives for security, availability, confidentiality, privacy and processing integrity are set to support the overall objectives.

Source: SOC 2 (2017 Trust Services Criteria), CC3.1. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open SOC 2 (2017 Trust Services Criteria) in the compliance library.

These are criteria, not controls: you design controls that meet them, and which criteria are in scope follows the categories your report covers (Security always; Availability, Confidentiality, Processing Integrity and Privacy only if chosen). A Type 2 report tests that the controls operated across the period, so the evidence asked for is samples across that period, not one copy.