CC3.2 Identifying and analysing risks to objectives (COSO principle 7)

Risks to objectives are identified across the organisation and analysed as the basis for deciding how to manage them. Points of focus: risk is assessed at entity, subsidiary, division, unit and function level; internal and external factors are considered; appropriate management levels take part; the significance of each risk is estimated; a response of accept, avoid, reduce or share is chosen; information assets are identified and their criticality assessed together with threats and vulnerabilities; threats arising from vendors, partners and others with access are analysed; and significance combines asset criticality, threat impact and likelihood. The 2022 revision restructures the process into steps: list information assets (devices, virtual systems, software, data and its flows, external systems and roles) and rate their criticality; identify threats to objectives and the weaknesses of system components; judge how likely and how severe each resulting risk is; consider that some threats and weaknesses may not yet be known; devise mitigation strategies; and decide whether the residual risk is acceptable or should be reduced or shared.

Source: SOC 2 (2017 Trust Services Criteria), CC3.2. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open SOC 2 (2017 Trust Services Criteria) in the compliance library.

These are criteria, not controls: you design controls that meet them, and which criteria are in scope follows the categories your report covers (Security always; Availability, Confidentiality, Processing Integrity and Privacy only if chosen). A Type 2 report tests that the controls operated across the period, so the evidence asked for is samples across that period, not one copy.