The nine Common Criteria categories that make up the Security TSC in SOC 2 — control environment through change management.
The Common Criteria (CC1–CC9) are the nine categories of criteria within the Security Trust Services Criterion: CC1 Control Environment, CC2 Communication & Information, CC3 Risk Assessment, CC4 Monitoring Activities, CC5 Control Activities, CC6 Logical & Physical Access, CC7 System Operations, CC8 Change Management, CC9 Risk Mitigation.
Run a free ComplianceIQ audit against SOC 2 and we'll surface every gap on this — and the other controls auditors flag — with the exact clause references to fix.