Which policies SOC 2 requires

CC5.3 asks the organization to deploy its control activities through policies that set expectations and procedures that carry those expectations out. It restates COSO Principle 12 inside the 2017 Trust Services Criteria, and it is the criterion that explains why a SOC 2 auditor reads your policies before testing anything else. A policy states what management expects, such as who may approve production access or how a vulnerability is triaged. A procedure states the steps people follow to make that happen, and the evidence those steps leave behind. An auditor testing CC5.3 will look for both halves: a written expectation for each control area in scope, and proof that someone actually performs the procedure on the dates the examination period covers.

The points of focus under CC5.3 give you a practical checklist for each policy. They ask whether policies and procedures support management's directives, whether a named role is responsible and accountable for carrying out each one, whether tasks are performed in a timely way, whether corrective action follows when something fails, whether the people doing the work are competent, and whether policies are reassessed over time. Points of focus are characteristics that help you design and evaluate controls. They are not separate requirements, and not every one has to be addressed. Decide, for each policy, which points of focus your design needs and document that choice, so the reasoning is visible when the auditor asks.

Confirm with your CPA firm how it will treat a minimum set of common controls and whether your policy set meets the criteria as you have drafted it. The AICPA staff FAQs published in December 2020, reported by the Journal of Accountancy, address that question, but how a particular examination applies them is the auditor's judgment. Ask the firm early which policies it expects to see, how it wants the review cycle recorded, and whether it needs a separate document for areas like vendor management that CC9.2 also touches. Settling those points before fieldwork is far cheaper than rewriting a policy set mid-period.

SOC 2 does not hand you a fixed review interval for policies. The relevant point of focus sits under CC5.3, which restates COSO Principle 12: controls operate through policies that set expectations and procedures that carry them out, and management reassesses those policies and procedures. The auditor is therefore looking for a credible rhythm of reassessment that you define and then follow, not a number printed in a template. Set the interval in your own information security policy, choose one that your team can actually keep (an annual review with earlier reviews after material changes is a common pattern), and write down who owns each review. Confirm with your CPA firm, before fieldwork, what cadence and what triggers they expect you to document.

A Type 2 examination tests operating effectiveness over an observation period, so the auditor samples evidence from across that window rather than checking a single moment. For each policy, the evidence that matters is the record of approval by an accountable owner, the review date, the version history showing what changed, and the change tickets or meeting notes that link a revision to a real event such as a new vendor, a platform migration or an incident. A policy last approved before the period began, with no reviews inside it, is an exception waiting to be written up, even if the text is sound. Keep these records in a system that preserves history, such as a version-controlled document repository, so the approval trail cannot be rewritten after the fact.

Before the period starts, produce a short review calendar for every policy in scope and run one full cycle of it on purpose, including the approval signature and the change log. This is cheaper than discovering gaps during sampling. Name the triggers that force an out-of-cycle review, such as a material change to hosting, a significant incident, a new subservice organization or a change to customer commitments, and confirm that your change management records show when those triggers were acted on. Ask your auditor how they plan to sample policy reviews and whether they expect a specific evidence format. Their answer, not a generic template, should set the standard you build to.

Management owns the policy set. The organization's leadership decides which policies exist, who approves them, and what each one commits the company to do. A SOC 2 auditor expects those policies to be approved by someone with authority over the business, dated, and reviewed on a stated schedule. An implementation partner can draft the policies, map each statement to the criteria it supports (for example CC5.3 on deploying control activities through policies and procedures), and check that the wording matches the tools and processes you actually run. The partner cannot approve the policies on your behalf, and a policy that describes controls nobody operates will be found as an exception in testing.

Alignment work is where an outside partner usually adds the most value. Confirm that each policy names an accountable owner, that the access, change, incident response and vendor management rules point to systems that exist in your environment, and that the review dates in the policies match the review you will actually perform. Ask the partner to show how each policy statement becomes evidence, such as an exported access list, a ticket or a pipeline record. Those artifacts are what the examination samples, so the partner's work product should include an evidence source for every policy commitment.

The CPA firm examines and reports; management asserts. Only the independent CPA firm performs the SOC 2 examination and issues the report. Under AT-C section 205 of the AICPA attestation standards, the service auditor must obtain written representations from management, which is why management's assertion and the representation letter are management's responsibility. Management signs them, and no consultant or platform partner signs them for you. Before fieldwork, confirm with your auditor which policies and evidence they expect, and keep a written record of who approved each policy and when.