SOC 2 CC2.1: Quality Information Supporting Controls

SOC 2 CC2.1 requires an organization to obtain or generate and use relevant, quality information so that its internal controls can function. It opens the CC2 series (Communication and Information), and a frequent finding under it is that the records controls depend on, asset inventories, data flow diagrams, risk assessments, are stale, scattered, or buried inside documents that were built for something else.

What does SOC 2 CC2.1 require?

In plain terms, CC2.1 is about the raw material every other control runs on. An access review is only as good as the user list it works from, a vulnerability program is only as good as the asset inventory it scans against, and a risk assessment is only as good as the data flow it maps. CC2.1 requires that the information feeding those controls exists, is the right information for the job, and is good enough to rely on.

The criterion has two halves. The first is obtaining or generating the information: identifying what internal controls need, capturing it from internal and external sources, and turning raw data into something usable. The second is quality: the information has to be timely, current, accurate, complete, accessible, protected, verifiable, and retained long enough to support the control. Information that was accurate a year ago but never refreshed fails CC2.1 the same way information that was never collected does.

CC2.1 maps to COSO Principle 13, the first of the three principles under Communication and Information. Where the rest of the CC2 series governs moving information to the right people, internally under CC2.2 and externally under CC2.3, CC2.1 governs whether the information is worth moving at all. Its Trust Services Criteria points of focus make this concrete with a documented data flow, an asset inventory, and a classification scheme.

What are the CC2.1 points of focus?

The AICPA defines 9 points of focus for CC2.1. Because the Trust Services Criteria are AICPA copyrighted material, the points of focus below are paraphrased and grouped by theme rather than reproduced verbatim; consult the official TSC document for exact wording.

• Identifies information requirements. The organization determines what information its internal controls need in order to function, so collection is driven by control needs rather than by whatever data happens to be available.
• Captures internal and external sources. Relevant data is gathered from both internal systems and external sources, then processed into information the controls can use.
• Maintains quality throughout processing. Information is kept timely, current, accurate, complete, accessible, protected, verifiable, and retained, so the record a control relies on holds up when an auditor tests it.
• Documents data flows. The organization documents how internal and external information and data move through its systems, which is the map that scoping and control design work from.
• Manages and locates assets. An inventory of infrastructure, software, and information assets is maintained, including the physical location or custody of assets such as BYOD and vendor devices.
• Classifies information. Data is classified by sensitivity, for example PII, confidential customer information, and intellectual property, so protection matches the value of what is being protected.
• Uses complete and accurate information to operate controls. Controls are operated using information that is itself complete and accurate, closing the loop between information quality and control performance.

How do you meet CC2.1 in cloud environments?

Cloud environments meet CC2.1 by generating current, queryable information about assets, data, and control activity from the platform itself:

• Automated asset inventory. AWS Config, Azure Resource Graph, or a cloud-native CMDB keeps a live inventory of infrastructure and software assets, so the record scanners and access reviews depend on stays current without a manual refresh cycle.
• Documented data flows. Architecture and data flow diagrams show where customer data enters, is processed, is stored, and leaves, and are updated when the architecture changes rather than once at audit time.
• Data classification and tagging. Resources and data stores are tagged by sensitivity, so classification is attached to the asset and can be reported on rather than living only in a policy document.
• A monitoring and logging pipeline. Logs from cloud services flow into a central store that produces accurate, verifiable information for detective controls. The security logging and monitoring architecture guide covers how to build that pipeline so the information it produces holds up.
• Current risk and vulnerability records. Risk assessment records and vulnerability scan reports are dated and retained, so the information driving remediation decisions is demonstrably recent.

How do you meet CC2.1 on-prem?

On-prem environments meet the same requirement where inventories and data flows are maintained deliberately rather than generated by a platform API:

• A maintained CMDB or asset register. Infrastructure, software, and information assets are recorded in a configuration management database or asset register, with a defined owner and a review cadence so it does not drift out of date.
• Network and data flow diagrams. Diagrams show how data moves across internal networks, data centers, and any connected third parties, and carry a revision date and owner.
• An applied classification scheme. File shares, databases, and document stores are labeled against a classification scheme, so sensitive data is identifiable and protection can be matched to it.
• Centralized logging. A SIEM or central log server collects events from servers, network devices, and applications, producing the accurate, verifiable information that monitoring controls run on.
• Procedures kept separate and current. The operating information a control depends on, hostnames, addresses, dashboard steps, lives in maintained procedures rather than buried inside a rarely updated policy, so it stays accurate as the environment changes.

Cloud vs on-prem at a glance

What evidence do auditors expect for CC2.1?

How does CC2.1 map to ISO 27001:2022?

The overlap is partial because A 5.37 covers the documented operating information that keeps controls repeatable and current, which is the maintenance half of CC2.1, but ISO handles the asset and classification half through separate controls: A 5.9 (inventory of information and other associated assets) and A 5.12 (classification of information) are the adjacent Annex A controls for those points of focus. The documented procedures, inventories, and classification records reuse across both frameworks. The SOC 2 to ISO 27001 control mapping covers the full crosswalk across all five Trust Services Categories.

Related criteria

CC2.1 opens the CC2 Communication and Information series by governing the quality of the information itself, and CC2.2 follows by requiring that this information reach the people inside the organization who need it. The accountability the CC1 series sets up, ending with CC1.5, makes someone responsible for keeping each inventory, diagram, and record current. The monitoring controls in the CC4 series then consume the information CC2.1 produces.

Frequently Asked Questions

What does SOC 2 CC2.1 mean?

SOC 2 CC2.1 requires an organization to obtain or generate and use relevant, quality information to support the functioning of its internal control. In practice that means identifying what information its controls need, capturing it from internal and external sources, and keeping it timely, current, accurate, complete, accessible, protected, verifiable, and retained. It is the first criterion in the CC2 Communication and Information series and maps to COSO Principle 13.

What evidence satisfies CC2.1?

The core evidence is an asset inventory covering infrastructure, software, and information assets, documented data flow diagrams, a data classification policy with applied labels, risk assessment records, vulnerability scan reports, and internal control monitoring evidence. Together these show that the information the controls depend on is identified, current, and accurate.

What counts as quality information under CC2.1?

Quality information under CC2.1 is information relevant to the control it supports that also meets the criterion's quality attributes: timely, current, accurate, complete, accessible, protected, verifiable, and retained. An asset inventory that is a year out of date is not quality information even if it exists, because the control relying on it cannot trust it.

How is CC2.1 different from CC2.2?

CC2.1 governs whether the information is worth using: whether it is the right information and whether it is good enough to rely on. CC2.2 governs internal communication, moving that information to the people inside the organization who need it to carry out their control responsibilities. CC2.1 is about the quality of the record, and CC2.2 is about getting it to the right hands.

Why does an asset inventory matter for CC2.1?

An asset inventory is one of the Trust Services Criteria points of focus for CC2.1, and it is the record several other controls depend on. Vulnerability scanning, access reviews, and change management all assume an accurate list of what exists. If the inventory is incomplete or out of date, every control that runs against it inherits that gap, which is why auditors treat a current inventory as foundational evidence for CC2.1.