SOC 2 Common Criteria Mapping: How CC1 to CC9 Line Up With SCF Domains

SOC 2 Common Criteria mapping links each of the nine Common Criteria (CC1 to CC9) in the AICPA Trust Services Criteria (TSC) to the controls you actually operate. Mapping them to Secure Controls Framework (SCF) domains lets one control set produce SOC 2 evidence and also support ISO 27001, NIST CSF and other obligations without a separate program.

What are the SOC 2 Common Criteria?

The Trust Services Criteria (TSC) have five categories: Security, Availability, Processing Integrity, Confidentiality and Privacy. Security is required in every SOC 2 examination, and it is expressed through the Common Criteria. The SCF's SOC 2 Trust Services Criteria page explains all five categories.

The nine Common Criteria series are:

1. CC1 Control Environment
2. CC2 Communication and Information
3. CC3 Risk Assessment
4. CC4 Monitoring Activities
5. CC5 Control Activities
6. CC6 Logical and Physical Access Controls
7. CC7 System Operations
8. CC8 Change Management
9. CC9 Risk Mitigation

A SOC 2 report is issued by a licensed CPA firm after an examination under AICPA attestation standards. SOC 2 is a report, not a certification.

How do CC1 to CC9 line up with SCF domains?

The SCF maps the TSC to its controls via Set Theory Relationship Mapping (STRM), so the same controls can support ISO 27001, NIST CSF and other frameworks. At the domain level, a typical starting point looks like this:

• CC1 Control Environment: SCR Governance (GOV) and Human Resources Security (HRS).
• CC2 Communication and Information: Governance (GOV) and Security Awareness & Training (SAT).
• CC3 Risk Assessment: Risk Management (RSK) and Threat Management (THR).
• CC4 Monitoring Activities: Compliance (CPL) and Continuous Monitoring (MON).
• CC5 Control Activities: Governance (GOV) for policies and standards, plus the domains that hold the activities themselves.
• CC6 Logical and Physical Access Controls: Identification & Authentication (IAC), Physical & Environmental Security (PES), Network Security (NET), Cryptographic Protections (CRY) and Asset Management (AST).
• CC7 System Operations: Continuous Monitoring (MON), Incident Response (IRO), Vulnerability & Patch Management (VPM) and Security Operations (OPS).
• CC8 Change Management: Change Management (CHG) and Configuration Management (CFG).
• CC9 Risk Mitigation: Third-Party Management (TPM), Business Continuity & Disaster Recovery (BCD) and Risk Management (RSK).

Treat this list as orientation. The control-level mapping in the SCF spreadsheet is what you scope and test. For specifics, you can see the TSC 2017 to SCF STRM here.

How do you use the mapping in practice?

The point is to build controls once and reuse the evidence. A practical sequence:

1. Download the SCF and filter the mapping column for the AICPA TSC (pre-established list of controls).
2. Select the SCF controls mapped to the Common Criteria and any optional categories in your SOC 2 scope.
3. Add the columns for other obligations you face, such as ISO 27001 or a state privacy law, and note controls that satisfy several at once.
4. Assign an owner and an evidence source to each selected control.
5. Hand your CPA firm the mapping so they can see how your controls address each criterion.

If you also need ISO 27001, the SCF post on mapping SOC 2 to ISO 27001 walks through that crosswalk.

Where do teams get the Common Criteria wrong?

• Treating CC5 as a policy checklist. CC5 is about control activities that actually operate, so policies alone are not enough.
• Scoping CC6 only to logical access. Physical access and asset handling also sit under CC6.
• Writing new controls for SOC 2 that duplicate controls already operating for another framework.
• Mapping once and never updating. Criteria guidance and your systems both change.

How does this connect to SCR CAP?

The SCR Conformity Assessment Program (SCR CAP) uses SCF controls to assess conformity with multiple laws, regulations and frameworks in one engagement. A control set mapped to the Common Criteria is already organized the way an SCR CAP assessment looks at controls. Learn more on the SCR CAP page. Organizations that do not need a SOC 2 should look at the SCR CAP as a way to demonstrate secure and resilient practices that can be shared with their clients and other stakeholders who want independent validation.

Frequently Asked Questions (FAQ)

How many Common Criteria are in SOC 2?

There are nine Common Criteria series, CC1 through CC9, which together make up the Security category. Each series contains several individual criteria. [VERIFY: confirm series count in the current AICPA TSC]

Are the Common Criteria required in every SOC 2 report?

Yes. Security is the required category, and it is expressed through the Common Criteria. Availability, Processing Integrity, Confidentiality and Privacy are optional and depend on the commitments you make to customers.

Is there a free SOC 2 to SCF mapping?

Yes. The SCF is free to use, and its download includes mappings to many laws, regulations and frameworks, including the AICPA Trust Services Criteria.

Does mapping to the SCF replace the SOC 2 examination?

No. A licensed CPA firm still performs the examination and issues the SOC 2 report. The mapping helps you prepare and reuse evidence.