← SOC 2 · CC5 — Control Activities
CC5.1 — Selection and development of control activities
medium
policy-governance
Requirement
The entity selects and develops control activities that contribute to the mitigation of risks to the achievement of objectives to acceptable levels.
What the engine looks for
Every group below must be satisfied — by an affirmative statement, not a plan, a hedge or a denial — for the control to count as covered. A term ending in … matches any word it begins. Supporting terms do not change the verdict — they raise confidence and distinguish a policy that names a mechanism from one that gestures at a category.
Required element 1 — any one of
controlprocedurepolicy
Required element 2 — any one of
riskmitigat…
Supporting terms — specificity signals
preventivedetectivemanualautomateddesign
Equivalent controls elsewhere
Matched on shared topics. Satisfying this control usually moves these too.
| Framework | Control | Title | Shared topics |
|---|---|---|---|
| GDPR | Art.24 | Responsibility of the controller | policy-governance |
| GDPR | Art.31 | Cooperation with the supervisory authority | policy-governance |
| ISO 27001 | A.5.1 | Policies for information security | policy-governance |
| ISO 27001 | A.6.4 | Disciplinary process | policy-governance |
| PCI DSS 4.0.1 | 12.1 | Information security policy | policy-governance |
| HIPAA | 164.308(a)(1)(ii)(C) | Sanction policy (R) | policy-governance |
| NIST CSF 2.0 | GV.PO-01 | Cybersecurity policy is established and communicated | policy-governance |
| GDPR | Art.5(2) | Accountability | policy-governance |