SOC 2 CC1: control environment evidence

CC1 is the family engineering-led companies score worst on, because none of it is technical and all of it is somebody writing something down.

Last reviewed 2026-09-01Written by Jacob Masse, TrazTech Inc.

CC1 has five criteria and every one of them is satisfied by a document rather than a system. It asks whether your company demonstrates a commitment to integrity and ethical values, whether somebody independent of management oversees internal control, whether reporting lines and authorities are defined, whether you hire and keep competent people, and whether individuals are held accountable for their control responsibilities. For a 25 person SaaS company, the whole family is about a week of writing and two hours of a director's time.

5 documents What CC1 costs a company that has none of them yet

What are the five CC1 criteria?

CC1.1 Integrity and ethical values

The company demonstrates a commitment to integrity and ethical values. In practice: a code of conduct that every person has acknowledged, and a way to raise a concern that does not go through the person you are concerned about.

CC1.2 Independent oversight

The board of directors demonstrates independence from management and exercises oversight of internal control. In practice: minuted evidence that someone who is not the CEO looked at the security program.

CC1.3 Structure, authority and responsibility

Management establishes structures, reporting lines, and appropriate authorities and responsibilities. In practice: an org chart and a written statement of who owns security.

CC1.4 Competence

The company demonstrates a commitment to attract, develop and retain competent individuals. In practice: job descriptions with security responsibilities in them, background checks where lawful, and training records.

CC1.5 Accountability

The company holds individuals accountable for their internal control responsibilities. In practice: security objectives in performance reviews, or a documented consequence for policy violations that has actually been applied.

What if we do not have a board?

Most companies at this size do not have an independent board, and CC1.2 is written as though every entity does. Name the oversight body you actually have and evidence it running. An investor-appointed director, a lead investor, an advisory board, or in the smallest companies a co-founder who is not the person running the security program, all work, as long as the oversight is minuted and periodic.

What does not work is claiming the CEO oversees the CEO. If your entire management team is two people and one of them runs security, say so in the system description, name the compensating arrangement, and hold a quarterly security review with the other co-founder that produces dated notes. An auditor handles a stated limitation very differently from a silent one. The same applies to separation of duties in a small engineering team.

What gets CC1 evidence sent back?

Four things, in the order they come up.

An undated org chart. The auditor is testing that the structure existed during the observation window, and a chart exported from a tool last Tuesday proves nothing about February. Save a dated PDF at the start of the window and again at the end.

Acknowledgement gaps. CC1.1 is tested by sampling people, so a code of conduct signed by eleven of your thirteen staff is an exception whatever the two people had going on. For the same reason the policy templates page argues for one acknowledgement flow rather than one per document.

Oversight minutes that are a calendar invite. The record has to show attendees, a date, and what was discussed. "Security sync" on a calendar is not a minute.

Background checks that started after the window. You cannot retroactively check somebody hired eighteen months ago and present it as evidence for the window. State the date the practice began, apply it to everyone hired after, and say so in the policy.

What to do this week

0 of 6 done · Reset

• Write a two page code of conduct and send it for acknowledgement to everyone including contractors.
• Name the oversight body in writing, book the first review, and take minutes with attendees and date.
• Export a dated org chart and store it in the evidence folder for the first day of the window.
• Add a security responsibilities paragraph to every engineering job description.
• Decide your background check position, write it into the HR security policy, and apply it from a stated date.
• Add one security line to the performance review template so CC1.5 has an artifact.

CC1 feeds into CC4, because the oversight body you name here is usually the same forum that receives control deficiencies. Getting the two aligned saves you inventing a second meeting. The common criteria overview has the whole map if you are working through the families in order.

Common questions