← SOC 2 Trust Services Criteria in plain English

CC5.1 CC5

Control Activities / CC5.1

Choosing controls that actually address the assessed risk

Think of it likeBuying the lock that fits the door you were worried about.

In plain English

Control activities are selected and developed to bring identified risks down to an acceptable level. The link runs from the risk assessment to the control, not the other way around.

Related CSF, CIS and ISO controls (unofficial mapping)

GV.OC-01GV.OC-02GV.OC-03GV.OC-04GV.OC-05GV.OV-0118.218.418.58.18.28.5A.5.1A.5.2A.5.3A.5.31A.5.32A.5.35