SOC 2 Type II control library
Every control CMDash tracks for SOC 2 Type II, in the order the standard itself uses. Each one is a row in the product with an owner, a status, evidence and its own history — this page is the public index of what those rows are.
AICPA publishes the criteria at no cost but retains copyright, so the criteria text cannot be redistributed inside this product.
CMDash publishes the identifiers, titles and cross-framework mappings so you can see the shape of what is tracked, and links you to AICPA & CIMA for the document itself. A tenant that holds its own licence can load the real text through the framework import.
Download free from AICPA & CIMA →Families
Control Environment · 5
| CC1.1 | COSO Principle 1: Commitment to integrity and ethical values Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework (1.1, legacy), NIST Cybersecurity Framework 2.0 |
| CC1.2 | COSO Principle 2: Board exercises oversight responsibility Maps to NIST Cybersecurity Framework 2.0 |
| CC1.3 | COSO Principle 3: Management establishes structure and authority Maps to NIST Cybersecurity Framework 2.0 |
| CC1.4 | COSO Principle 4: Commitment to competence |
| CC1.5 | COSO Principle 5: Enforces accountability |
Communication & Information · 3
| CC2.1 | COSO Principle 13: Uses relevant information Maps to NIST Cybersecurity Framework 2.0 |
| CC2.2 | COSO Principle 14: Communicates internally |
| CC2.3 | COSO Principle 15: Communicates externally |
Risk Assessment · 4
| CC3.1 | COSO Principle 6: Specifies suitable objectives Maps to NIST Cybersecurity Framework 2.0 |
| CC3.2 | COSO Principle 7: Identifies and analyzes risk Maps to NIST Cybersecurity Framework (1.1, legacy), NIST Cybersecurity Framework 2.0 |
| CC3.3 | COSO Principle 8: Assesses fraud risk |
| CC3.4 | COSO Principle 9: Identifies and analyzes significant change Maps to NIST Cybersecurity Framework 2.0 |
Monitoring Activities · 2
| CC4.1 | COSO Principle 16: Selects and develops monitoring activities Maps to NIST Cybersecurity Framework 2.0 |
| CC4.2 | COSO Principle 17: Evaluates and communicates deficiencies |
Control Activities · 3
| CC5.1 | COSO Principle 10: Selects and develops control activities Maps to NIST Cybersecurity Framework (1.1, legacy) |
| CC5.2 | COSO Principle 11: Selects and develops general controls over technology |
| CC5.3 | COSO Principle 12: Deploys through policies and procedures |
Logical & Physical Access · 8
| CC6.1 | Logical access security software, infrastructure, and architectures Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework (1.1, legacy), NIST Cybersecurity Framework 2.0 |
| CC6.2 | New user registration and authorization Maps to NIST Cybersecurity Framework (1.1, legacy), NIST Cybersecurity Framework 2.0 |
| CC6.3 | Credential lifecycle management Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework (1.1, legacy), NIST Cybersecurity Framework 2.0 |
| CC6.4 | Restriction and revocation of access |
| CC6.5 | Change to access and role changes |
| CC6.6 | External access and boundaries Maps to NIST Cybersecurity Framework (1.1, legacy), NIST Cybersecurity Framework 2.0 |
| CC6.7 | Restricting data transmission and movement Maps to NIST Cybersecurity Framework (1.1, legacy), NIST Cybersecurity Framework 2.0 |
| CC6.8 | Prevention and detection of unauthorized software Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework (1.1, legacy) |
System Operations · 5
| CC7.1 | Detection and monitoring of security events Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework (1.1, legacy), NIST Cybersecurity Framework 2.0 |
| CC7.2 | Monitoring of system components for anomalies Maps to NIST Cybersecurity Framework (1.1, legacy), NIST Cybersecurity Framework 2.0 |
| CC7.3 | Evaluation and response to security incidents Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework (1.1, legacy), NIST Cybersecurity Framework 2.0 |
| CC7.4 | Incident recovery and remediation Maps to NIST Cybersecurity Framework (1.1, legacy), NIST Cybersecurity Framework 2.0 |
| CC7.5 | Identification and assessment of vulnerabilities Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework (1.1, legacy), NIST Cybersecurity Framework 2.0 |
Change Management · 1
| CC8.1 | Infrastructure and software change authorization Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework (1.1, legacy), NIST Cybersecurity Framework 2.0 |
Risk Mitigation · 2
| CC9.1 | Risk mitigation activities |
| CC9.2 | Vendor and business partner risk management Maps to NIST Cybersecurity Framework (1.1, legacy) |
Availability · 3
| A1.1 | Capacity management and environmental protections |
| A1.2 | Recovery planning and testing Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework (1.1, legacy) |
| A1.3 | Recovery from backup Maps to NIST Cybersecurity Framework (1.1, legacy) |
Processing Integrity · 5
Privacy · 18
Confidentiality · 2
Where this comes from
Control identifiers, families and titles are the rows CMDash’s own seed data writes for SOC 2 Type II 2017, published from a build-time export rather than read from any customer’s workspace. Cross-framework mappings are CMDash’s own, and each one is shown on both frameworks it connects.
Every control on this page becomes a row with an owner, a status, evidence and an audit trail — with the crosswalks already wired, so evidence mapped once counts in more than one framework.