Question

What is a SOC 2 control for Change Management?

Answer 1

SOC 2 has been updated to meet the needs of a wider-range of Organizations, improve the overall quality and usefulness of the report, and to assist in reporting at an entity-level, rather than for a specific process or system. These updates will also bring a large number of decisions, changes, and enhanced responsibility and accountability to Service Organizations.

Key changes to the standard include:

Services criteria updated to align with the 17 principles in the COSO framework, some include:

• Demonstrate commitment to integrity and ethical values
• Ensure that board exercises oversight responsibility
• Establish structures, reporting lines, authorities and responsibilities
• Select and develop control activities that mitigate risks
• Select and develop technology controls
• Deploy control activities through policies and procedures
• Perform ongoing or periodic evaluations of internal controls (or a combination of the two)