CC5.3 Deploying controls through policies and procedures (COSO principle 12)

Control activities are put into practice through policies that state expectations and procedures that carry them out. Points of focus: policies and procedures embed management's directives in daily work; responsibility and accountability sit with the managers of the unit where the risk lives; controls are performed on time; issues found while performing controls are investigated and acted on; competent people with enough authority perform them diligently; and policies and procedures are reviewed periodically and refreshed when needed.

Source: SOC 2 (2017 Trust Services Criteria), CC5.3. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open SOC 2 (2017 Trust Services Criteria) in the compliance library.

These are criteria, not controls: you design controls that meet them, and which criteria are in scope follows the categories your report covers (Security always; Availability, Confidentiality, Processing Integrity and Privacy only if chosen). A Type 2 report tests that the controls operated across the period, so the evidence asked for is samples across that period, not one copy.