SOC 2 CC5: control activities and the matrix

CC5 is where the risk register turns into a list of controls, and where your policy set stops being paperwork and starts being the thing under test.

Last reviewed 2026-09-01Written by Jacob Masse, TrazTech Inc.

CC5 has three criteria: CC5.1 that you select and develop control activities that mitigate the risks you identified, CC5.2 that you select and develop general control activities over technology, and CC5.3 that you deploy those controls through policies establishing what is expected and procedures putting the policies into action. The artifact that satisfies all three at once is a control matrix, cross-referenced to the risk register on one side and the policy set on the other.

CC5 is the join in the middle of the standard. CC3 says what could go wrong, CC5 says what you do about it, and CC6 through CC9 are where specific control activities are then tested. If your matrix does not trace back to a risk, an auditor reading CC5.1 will ask why the control exists.

What columns does a control matrix need?

The two columns companies leave out are the risk reference and the policy reference, and they are the two the criterion is about. Without the risk reference CC5.1 has no evidence of selection. Without the policy reference CC5.3 has no evidence of deployment.

What are technology general controls, and why is CC5.2 skipped?

CC5.2 asks for general control activities over technology: the controls that make your other controls trustworthy. Access to the systems that enforce your controls, change control over those systems, and operations of the underlying infrastructure. It gets skipped because it looks like a restatement of CC6 and CC8, and to a degree it is.

What it adds is the meta layer. If your access reviews are driven by an export from the identity provider, who can change the identity provider configuration, and is that change reviewed. If your evidence lives in a shared drive, who can delete from it. If your alerting rules define what counts as a security event, who can edit the rules. Three sentences in the matrix covering administrative access to the control systems themselves satisfies CC5.2 and takes about twenty minutes.

60 to 100 Controls in a typical first security-only SOC 2

That range is a consequence of how finely you split, not of how secure you are. Two companies with identical practices can produce a 55 control matrix and a 120 control matrix. Fewer, broader controls are easier to evidence and harder to fail; more, narrower controls make individual exceptions less damaging. For a first audit, prefer fewer.

How does CC5.3 relate to the policy set?

CC5.3 is the criterion that makes your policies testable. It requires policies that establish what is expected and procedures that put them into action, which is why every cadence you write into a policy becomes something an auditor samples. It produces the most expensive self-inflicted finding in SOC 2: a downloaded template promising quarterly access reviews becomes, under CC5.3, a quarterly control you now have to evidence four times.

Write the policy to the cadence you will keep. The policy templates page covers how to edit a downloaded pack without inheriting somebody else's commitments, and the policy checklist tool works out which documents you need from your criteria and the data you hold rather than handing you the standard American twelve.

0 of 6 done · Reset

• Every control traces to at least one risk register row.
• Every control names a person, not a team.
• Every control names the evidence it produces and where that evidence is filed.
• Every control frequency matches what the governing policy says, word for word.
• Administrative access to the control systems themselves is covered, for CC5.2.
• No control in the matrix is one nobody has run yet.

Common questions