CC4.1 Ongoing and separate evaluations of control (COSO principle 16)

The organisation chooses, builds and carries out ongoing or separate evaluations to confirm the control components are present and working. Points of focus: a balance between continuous and point-in-time evaluations; the pace of business change informs their design; a baseline of the control system is established; evaluators understand what they evaluate; ongoing evaluations are built into processes; scope and frequency vary with risk; separate evaluations give objective feedback; and varied techniques are used such as penetration testing, independent certification against a standard and internal audit. The 2022 revision widens the evaluation types to include monitoring and testing by the first line and the second line, internal audit, compliance and resilience assessments, vulnerability scanning, security assessments, penetration tests and assessments by outside parties.

Source: SOC 2 (2017 Trust Services Criteria), CC4.1. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open SOC 2 (2017 Trust Services Criteria) in the compliance library.

These are criteria, not controls: you design controls that meet them, and which criteria are in scope follows the categories your report covers (Security always; Availability, Confidentiality, Processing Integrity and Privacy only if chosen). A Type 2 report tests that the controls operated across the period, so the evidence asked for is samples across that period, not one copy.