Control sameness
Every namespace in scope runs the tested Version of each inherited control, or the difference is listed by Change.
Satisfies
| Criterion | Text |
|---|---|
| SOC2 CC4.1 | The entity performs ongoing or separate evaluations to confirm that the components of internal control are present and functioning. |
| SOC2 CC5.2 | The entity selects and develops general control activities over technology to support its objectives. |
Implemented by
Test
| Step | Rule |
|---|---|
| Kind | Detective: it finds the failure after it happens. |
| Select | Each inherited control’s implementing Versions and resolved Settings, per namespace in scope, over the report period. |
| Assert | All match the tested content hash, or each stratum names the Change that created it. |
Owner
Compliance Officer, Legal Team.
Example
Forty Startups inherit the encryption control. Thirty-nine run the tested content hash, and one runs a stricter key rotation, listed with the Change that tightened it.