CC5.2 General controls over technology (COSO principle 11)

General controls over technology are selected and developed to support objectives. Points of focus: management understands how business processes and automated controls depend on technology general controls; controls over infrastructure support complete, accurate and available processing; security management controls limit access rights to authorised users in line with their jobs and protect assets from external threats; and controls over acquisition, development and maintenance of technology support management's objectives.

Source: SOC 2 (2017 Trust Services Criteria), CC5.2. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open SOC 2 (2017 Trust Services Criteria) in the compliance library.

These are criteria, not controls: you design controls that meet them, and which criteria are in scope follows the categories your report covers (Security always; Availability, Confidentiality, Processing Integrity and Privacy only if chosen). A Type 2 report tests that the controls operated across the period, so the evidence asked for is samples across that period, not one copy.