← SOC 2 Trust Services Criteria in plain English

CC3.4 CC3

Risk Assessment / CC3.4

Reassessing when something significant changes

Think of it likeRechecking the locks after you move house, not just after you first moved in.

In plain English

Changes that could meaningfully affect internal control get identified and assessed. New systems, new markets, acquisitions and reorganizations all move the risk picture.

Related CSF, CIS and ISO controls (unofficial mapping)