CC1.1 Integrity and ethical values: SOC 2 requirements and evidence

What CC1.1 asks for and why auditors start here

CC1.1 asks the organization to show that it is committed to integrity and ethical values, and it is the first criterion in the CC1 control environment series. It restates COSO Principle 1 as applied in the 2017 Trust Services Criteria. For a compliance lead or CISO preparing for a SOC 2 examination, the practical answer is this: you need written conduct expectations, leadership that visibly stands behind them, a way to check that people follow them, and a record of what happened when someone did not. Auditors start here because every other control environment criterion, and much of the rest of the report, assumes that the people running controls take the rules seriously.

The 2017 criteria list several points of focus under CC1.1. Leaders should set the tone at the top, the organization should establish standards of conduct, management should evaluate adherence to those standards, deviations should be addressed in a timely manner, and the same expectations should be considered for contractors and vendor employees. Points of focus are characteristics that help you design and evaluate controls, not separate requirements, so you choose which ones fit your size and risk. The exposure is clear: if conduct expectations are undefined, or defined but never enforced, a service auditor has no basis for concluding the control environment works, and a customer reading the report will draw the same conclusion.

CC1.1 is hard to evidence because it is judgment-heavy and has no single artifact. A signed code of conduct proves that the document exists, not that anyone follows it. Your evidence set will usually combine the conduct policy, acknowledgment records, a sample of how deviations were raised and resolved, and evidence that leadership communicated the expectations. Confirm with your auditor early which samples they will select, and whether contractor and vendor staff must acknowledge the same standards or sign agreements that reference them. Those decisions are easier to make before fieldwork than during it.

Which people, teams and vendors fall under CC1.1

CC1.1 applies to everyone whose conduct can affect the system in the examination, not only the staff on the payroll. The decisions below determine who must sign up to standards of conduct, who is checked for adherence, and where the system description draws its boundary.

Employees at every level

Every employee who works on or near the in-scope system must be covered by the standards of conduct, including staff who never touch production. Auditors will ask whether acknowledgments are collected at hire and at intervals after that, and whether they are tracked against the current headcount. Check that the HR roster and the acknowledgment records reconcile, because gaps between them are a common source of exceptions.

Executives and the board

Senior leaders set the tone that CC1.1 describes, so their conduct expectations should be written and their adherence reviewed. Confirm whether the board or an equivalent body receives reports on ethics matters and whether executives sign the same acknowledgments as everyone else. Leaders who are exempt from a standard weaken the evidence for the whole criterion.

Contractors with production access

Contractors who can reach production systems or sensitive data should accept the same standards of conduct as employees, or a clearly equivalent agreement. Record the contract terms, the acknowledgment date and the offboarding date for each person. Ask your auditor early whether they expect the same evidence depth for contractors as for employees, since the answer changes the sampling work.

Vendor staff with system access

Vendor personnel who administer, support or access the system are part of the population the TSC points of focus describe as contractors and vendor employees. Their obligations usually sit in contracts and vendor security terms rather than your own handbook. Decide which vendor staff are in scope, and collect evidence that they agreed to conduct expectations, for example through contract clauses or the vendor's own SOC report.

Subservice organizations and entities

Decide whether your own standards cover subservice organizations, such as hosting providers, or whether you rely on their reports and carve them out of your system description. The legal entities and regions included in the system description also define who falls under CC1.1. Confirm the boundary with your auditor before fieldwork, because changing it midway can change the evidence you need.

How an assessor tests CC1.1 in a Type 2 examination

This table walks through what an assessor requests, samples and judges for CC1.1 in the design and operating effectiveness phases of a Type 2 examination. Read each row as an evidence request paired with the common finding that appears when it is missing. The main takeaway is that the auditor selects samples and forms the opinion, so the organization's job is to keep records complete and current across the whole period.

Test area	What the assessor requests or samples	Common finding when weak
Code of conduct and approval history	Current standards of conduct, prior versions, and records showing who approved each version and when	Policy exists but approval date or owner is missing, or the version in use differs from the one published
Design of tone at the top	Evidence that leadership set expectations, such as signed commitments, board or management minutes, or published messages about ethics	Expectations are stated only in the policy, with no record of leadership communicating them during the period
Acknowledgment records for personnel	A sample of employees drawn across the period, each with a signed or electronically recorded acknowledgment dated on or after their start date	Acknowledgments collected at hire but not refreshed after policy changes, or dates that fall after the sampled access period began
Acknowledgment records for contractors and vendor staff	A sample of contractors and vendor personnel with acknowledgments or equivalent contractual terms covering conduct expectations	Contractors with system access and no acknowledgment or contract clause on file
Monitoring of adherence	Evidence that someone reviewed adherence, such as periodic attestations, reviews of exceptions, or reports from the reporting channel	Monitoring described in policy but no completed review record for the period
Deviation case records	A sample of reported or identified deviations with the investigation notes, decision, corrective action and closure date	Deviations raised in chat or email with no documented action, or closure occurring long after the event
Policy review cadence	Evidence that the code of conduct was reviewed within the review cycle the organization set for itself	Policy past its stated review date without a documented review, which assessors often treat as a design gap

How to implement CC1.1 step by step

This sequence turns CC1.1 from a statement of values into a set of approved documents, signed acknowledgments, working reporting channels and recorded reviews that an independent CPA can test across the examination period.

Draft or refresh the code of conduct
Write or update the code of conduct and ethics policy so it states the standards of conduct expected of employees, contractors and vendor staff who access your systems or data. Map each standard to the situations your organization actually faces, such as handling customer data, conflicts of interest, gifts and use of company systems. Output: a draft policy with a version number and a list of the people who reviewed it.
Obtain leadership approval and assign ownership
Have the board or the executive team approve the policy, and name a single owner responsible for keeping it current, usually a security or compliance lead. Record the approval date, the approver and the owner in the document itself. Output: an approved policy with recorded sign-off, which is the first artifact an assessor will ask to see when testing the tone at the top.
Roll out acknowledgments at onboarding and annually
Publish the approved policy where people can find it, and require each employee and contractor to acknowledge it when they join and again on the recurring cycle you set. Vendor staff with system access should be covered through the contract or a vendor acknowledgment. Output: an acknowledgment register listing each person, the policy version they accepted and the date, with exceptions followed up until closed.
Set up a reporting channel and deviation procedure
Establish a way for people to report suspected breaches of the code, such as a monitored mailbox or ticket queue, and allow reports to be made without fear of retaliation. Write a short procedure that names who triages reports, who investigates, who decides on corrective action and how the outcome is communicated. Output: a reporting procedure with named owners and a case log template.
Log and resolve each reported deviation
Open a case record for every report or detected deviation, capture the facts, assign an owner, decide on the response and record when it was closed and what changed afterward, such as retraining, access removal or a disciplinary step. Escalate matters involving leadership or customer data to the board or designated committee. Output: a case log showing each deviation moving from open to resolved, which lets an assessor test that deviations are addressed in a timely manner.
Run periodic adherence checks and record the review
Sample acknowledgments, case handling and access or expense records against the code on a schedule you define, and confirm that exceptions are followed up. Have leadership review the results and record any policy updates. Output: a dated review record that shows who checked adherence, what they sampled, what they found and what was changed as a result. Ask your CPA early which samples and frequency they expect for your environment.

How tone at the top becomes evidence an auditor can sample

Tone at the top only helps a SOC 2 examination when it leaves records an auditor can select and test. An auditor cannot sample a leader's conviction, but can sample a signed approval of the code of conduct, a leadership message sent to staff, the minutes of a meeting where ethics was on the agenda, or a log showing that a senior manager completed the annual acknowledgment. For CC1.1, the organization should decide in advance which leaders own the standards of conduct, which communications count as tone at the top, and where each record will be stored so it can be produced within the examination period.

A single point of focus can generate several artifacts across the period. The point of focus on establishing standards of conduct, for example, may produce the approved code of conduct, its version history, the distribution list, staff acknowledgments at hire and at renewal, and the reminder campaign that followed a missed deadline. The point of focus on evaluating adherence may produce a sample of completed acknowledgments, a quarterly review of hotline or exception reports, and the follow-up on any finding. Auditors generally look for a consistent, repeatable pattern rather than a large volume of documents, so the organization should set a fixed cadence for each record type and confirm with its auditor how many occurrences the period will require.

The 2017 Trust Services Criteria treat points of focus as characteristics to consider when designing and evaluating controls, not as separate requirements, and not every point of focus has to be addressed. The organization should therefore document which points of focus apply to its environment, why others do not, and which control owns each one. A short mapping in the control matrix, reviewed by the auditor during planning, prevents disputes at fieldwork. Confirm with your CPA firm how it expects those decisions to be recorded, since the expectation for documentation and sampling depends on the examination engagement, not on this page alone. The AICPA 2017 Trust Services Criteria is the primary text to read alongside that decision.

Evidence that passes CC1.1 and how to keep it current

An assessor testing CC1.1 looks for proof that standards of conduct exist, that people accept them, that deviations get handled, and that leadership reviews all of it over the whole observation period. The cards below cover the artifacts that carry that proof, who owns each one, and how to keep it current between audits.

Approved code of conduct with version history

The code of conduct is the anchor document for CC1.1. Keep it in a wiki or policy repository that records every change, when it was made and who made it, so the auditor can see which version was in force on any date in the period. Confirm that the approved version carries an approver, an approval date and a review date. Owner: the HR or people lead, approved by the board or CEO.

Signed or recorded acknowledgments

Each employee and relevant contractor should accept the code of conduct on joining and again when it changes, with the acceptance stored as a dated record linked to the person. Check that the record matches the current HR roster, since acknowledgments from people who have left are a common exception. Owner: HR, with managers chasing gaps.

Contractor and vendor agreements with conduct terms

Contractor agreements and vendor contracts should require staff to follow the organization's standards of conduct, and the topic's points of focus expect the organization to consider vendor employees. Keep signed agreements in a register that shows the counterparty, the date and the clause that covers conduct. Owner: legal or procurement, with the engineering manager who sponsors each vendor.

Leadership communications

Tone at the top is evidenced by what leaders say and do. Keep dated records of messages from the CEO or board on ethics, such as all-hands notes, policy launch emails or a short annual reaffirmation. An assessor will want to see that these communications exist across the period, not only at the start. Owner: the CEO or a delegated executive sponsor.

Reporting channel records and deviation case files

Reporting channels, such as an ethics hotline or a monitored mailbox, need logs of each report, the triage decision, the investigation notes and the outcome. Case files should show timely handling and any corrective action. Confirm that access to case files is restricted to people who need it, and that closed cases are retained according to your retention policy. Owner: a named ethics or compliance officer, with HR and legal for escalations.

Periodic review records

The organization should review the code of conduct and the adherence checks on a set schedule, and record what was reviewed, what changed and who signed off. Role-based permissions in a documentation platform help here: restrict edits to policy pages to named owners so that every change passes through the review trail. Owner: the compliance lead, with the board or its committee signing off the annual review.

What meeting CC1.1 costs in money and effort

This table compares each cost component of meeting CC1.1, who is paid for it, whether it is one-time or recurring, and what pushes it up or down. Read it as a checklist for building a quote, since no price list exists and the figures depend on your headcount, contractor population and vendor count. The main takeaway is that most of the cost is staff time, which open-source tools do not remove.

Cost component	Who is paid or who spends time	One-time or recurring	What drives the cost
Policy drafting: code of conduct and ethics policy	Internal HR or legal staff, or outside counsel or consultant	One-time, then recurring when reviewed	Number of jurisdictions, existing policy library, depth of conflict-of-interest and gift rules
Legal review of conduct standards	Outside counsel, billed by the hour or by fixed fee	One-time, with reviews after material changes	Employment law exposure by country, union or works council requirements, need for contractor terms
Acknowledgment tooling or HR systems	Software licence, or staff time on a self-hosted platform	Recurring licence where bought; one-time setup for self-hosted	Whether an existing HRIS can capture signed acknowledgments, or a separate tool is needed
Engineering or HR time to run acknowledgments	Internal HR operations and team managers	Recurring, typically at each hire, annually and on each policy change	Joiner volume, contractor churn, number of policies requiring acknowledgment
Case handling for reported deviations	Ethics or HR investigators, legal, sometimes an outside investigator	Recurring, unpredictable in volume	Number of reports received, severity, whether investigations are handled in-house
Contractor and vendor staff expectations	Procurement, vendor management and legal for contract clauses	One-time per contract template, recurring per vendor onboarding	Number of vendors with staff access to your systems or data
Auditor sampling effort	Your compliance lead and HR staff, plus the CPA firm's fees	Recurring each audit period	Number of samples the auditor selects, quality of records, how quickly evidence can be retrieved
Recurring review and tone-at-the-top reporting	Leadership, board or committee time, compliance lead	Recurring, typically at least annually	Board meeting cadence, number of business units, frequency of policy change
Self-hosted open-source wiki or documentation tools	Staff time to configure, maintain and back up the platform	Licence spend can be removed; staff time remains recurring	Whether version history and role-based access are configured to match your policy owners

Who owns CC1.1 and what can be outsourced

Management owns CC1.1 and cannot delegate that ownership to a consultant, a partner or an auditor. Under the assertion-based structure of a SOC 2, management makes written representations about its system and its controls, and the examination tests those representations. Your leadership therefore has to approve the standards of conduct, set the expectation that they apply from the top down, and decide what happens when someone breaks them. Human resources and legal usually carry the day-to-day weight: HR issues the code of conduct and collects signed acknowledgments, while legal reviews how standards interact with employment contracts and disciplinary procedure.

Leadership approval: Executives or the board approve the code of conduct and the ethics policy, and the approval date and version are recorded.
HR and legal ownership: HR runs onboarding acknowledgments, annual re-certification and the disciplinary path, and legal confirms the wording is enforceable.
Deviation decisions: Someone with authority must decide how each reported breach is investigated, resolved and documented, and that person should not be the subject of the complaint.
Contractor and vendor expectations: Your team decides which external parties must accept the standards and how that acceptance is recorded in contracts.

Before you hire anyone, confirm with your CPA firm which of these artifacts it will expect to see and in what form.

Where CC1.1 evidence usually falls short

Why does a code of conduct policy fail CC1.1 if it already exists?

Usually because nobody with authority approved it. A conduct policy written by a team lead and posted on the intranet does not show that the tone at the top supports it. The gap is the missing approval record, not the document itself. To close it, have the board, or the executive team if no board exists, approve the standards of conduct in a recorded meeting or signed resolution, store the approved version with its date, and show the auditor who approved it. Keep the approval history in the same place as the policy so the auditor can trace each version back to a decision.

How do you collect conduct acknowledgments from contractors and vendor staff?

Most teams collect signatures from employees and forget everyone else. CC1.1 expects the expectations to reach contractors and vendor personnel, so an acknowledgment gap for them is a common finding. Add a conduct acknowledgment step to contractor onboarding and to the contract or statement of work, then record each person's acknowledgment against their name, role and start date. Where a vendor employs the individual, require the vendor to attest that its staff have accepted equivalent terms. Your identity system can hold the acknowledgment date so the population is reviewable at audit time.

What should a reporting channel for ethics concerns include?

Many organizations say staff can raise concerns but never define how. An auditor looks for a documented route, a named owner who reviews reports, a way to report without fear of retaliation, and a record of what happened to each report. Publish the channel in the conduct policy, staff handbook and contractor terms, assign an owner who is not the subject of most complaints, and log every submission with its date, category and outcome. Test the channel periodically by confirming that a submission reaches the owner. The log, not the mailbox, is the evidence.

How should deviations from conduct standards be recorded?

Deviations handled in a hallway conversation or a chat thread leave no evidence, and the auditor cannot confirm that the organization addressed them in a timely manner. The fix is a simple case record for each deviation: what happened, who was involved, when it was identified, the decision taken, any disciplinary or contractual action, and the date it was closed. Link each case to the relevant policy section. If no deviations occurred in the period, say so with a dated review, because a Type 2 examination still needs evidence that the check operated. Ask the auditor early how they expect to see a zero-case period documented.

Can vendor staff be left out of conduct terms in a SOC 2?

Leaving them out is a frequent gap. CC1.1 includes contractors and vendor employees as a point of focus, so the organization should show that its expectations apply to people who work on its systems but are not on its payroll. Put conduct obligations into vendor master agreements, require confidentiality and conduct commitments in statements of work, and check that access to production or customer data is conditional on those terms. Where the organization cannot control a vendor's internal policy, document the contractual requirement and the review of the vendor's own report or attestation.

What does a periodic review of conduct standards look like to an auditor?

A policy with a review date in its header but no review record fails the test. Auditors look for evidence that someone compared the standards against current operations, recent deviations and changes in the business, then recorded the result. Set a review cadence the board or executive team agrees to, assign an owner, and keep dated minutes or sign-offs showing what changed or why nothing did. Reviews triggered by an incident, a reorganization or a new customer requirement strengthen the file. Confirm the cadence with your auditor before the observation period starts, since the evidence must exist across the whole period for a Type 2 report.

How CC1.1 connects to the rest of the control environment

CC1.1 sets the expectation that integrity and ethical values are real in daily practice, but an assessor does not test it in isolation. The other control environment criteria give that expectation its teeth: CC1.2 places oversight of conduct with a board or equivalent body that is independent of management, CC1.3 defines the reporting lines and authorities through which a deviation actually travels, CC1.4 covers how people are hired and checked before they are trusted, and CC1.5 ties performance and discipline to the standards of conduct. A written code of conduct under CC1.1 does little if no one with authority reviews adherence to it, if managers have no defined path to escalate a breach, or if a violation carries no consequence.

Gaps usually surface in a different criterion from the one where they start. A background check process that is undocumented under CC1.4 may appear as a finding when the auditor samples new hires and asks for proof that the conduct acknowledgement was signed. A conduct breach that never reaches the board under CC1.2 may show up as a monitoring weakness under CC4. For the reader, the practical check is to trace one deviation end to end: who reports it, which role receives it, who decides the outcome, how the outcome is recorded, and whether the sanction matches what the code of conduct says. Illustratively, if a contractor's breach is handled informally by a team lead with no record, the CC1.1 evidence exists on paper but the chain fails at CC1.3 and CC1.5.

Assessors read the control environment as one system, so scope decisions and owners should be settled before fieldwork begins. Confirm with your CPA firm which person or body is named as the owner for each of these criteria, whether the same evidence can support more than one criterion, and how contractors and vendor staff are brought into the same reporting and sanction paths as employees. Documenting these links in your control matrix, with the owner and evidence location for each, is usually more persuasive to an assessor than a longer code of conduct.

How DeployOpen prepares your CC1.1 evidence

DeployOpen works on CC1.1 as a set of systems and records inside your own infrastructure, not as a policy document alone. Your organization owns its standards of conduct and its responses to deviations, and we prepare the platforms, workflows and evidence that show those standards operating. Independent auditors, not DeployOpen, test the controls and issue any SOC 2 report.

How we scope

We confirm which self-hosted platforms and records the CC1.1 evidence will come from, written into the agreed scope.
We agree which contractor and vendor populations are in scope for conduct acknowledgments and deviation handling.
Engagements are fixed-scope, with deliverables and timelines agreed in writing before work starts.

How we build

We configure version-controlled documentation for the code of conduct, policies and their revision history.
We set role-based access so policy owners, approvers and reviewers each hold the rights their role requires.
We set up recorded acknowledgment workflows and a logged route for reporting and resolving deviations.

How we hand over

We document the control design, owners, review cadence and where each piece of evidence is stored.
We deliver a walkthrough so your team can show the auditor how each record is produced and retrieved.
We confirm with your auditor which evidence format and sampling approach they expect before handover is final.

How we support

Ongoing support, upgrades and continuous testing are available as a retainer after the initial scope is delivered.
We can help your team keep acknowledgment and deviation records current between audit periods.
Any changes to the agreed scope are documented in writing before further work proceeds.

CC1.1 Commitment to integrity and ethical values