Home / Rules / SOC 2 (Trust Services Criteria) / SOC 2 CC4.2 Evaluating and communicating control deficiencies
SOC 2 CC4.2 Evaluating and communicating control deficiencies
Control deficiencies are evaluated and reported promptly to those who must fix them, including senior management and the board where appropriate. Points of focus: management and the board assess the results of evaluations; deficiencies go to the parties responsible for correction and upward as appropriate; and management tracks whether they are remedied on time.
Steps that cite it
- KC-08 S4 Report the deficiency
Evidence commonly asked for
- Deficiency or findings log with owner, severity, due date and status
- Reports of open findings to senior management or the board
- Evidence of closure and retesting of remediated deficiencies
Accepted citation forms are listed on the answer format page.