← SOC 2 Trust Services Criteria in plain English

CC4.2 CC4

Monitoring Activities / CC4.2

Reporting the deficiencies to someone who can fix them

Think of it likeTelling whoever owns the ladder that the alarm failed its test.

In plain English

Control weaknesses are evaluated and communicated to the parties responsible for corrective action, including senior management and the board where the matter warrants it, and remediation is followed up.

Related CSF, CIS and ISO controls (unofficial mapping)