When an important change misses the people doing the work
You have updated the emergency-access procedure and explained it in the engineering meeting. The next urgent request should be straightforward. Then support follows the old route, and you learn that two engineers missed the meeting and the support employee never received the announcement.
Everyone thought they knew what to do. Your communication left some of the people doing the work behind.
SOC 2 CC2.2 focuses on internal communication: helping people understand your control objectives, their responsibilities, and the information they need to carry them out. The AICPA Trust Services Criteria provide the authoritative wording.
The points of focus include management and board communication, routes for concerns when normal channels fail, security awareness, and timely information about system changes. Your authorized personnel also need enough context about the system and its boundaries to understand their part. Apply those considerations with judgment rather than turning them into an identical checklist for every team.
This seventh article in our SOC 2 Guide builds on CC2.1’s discussion of information quality. The scenarios below are fictional. Think about the services, risks, and people in your own business as you read.
Decide who needs to know
Start with a real process, such as offboarding, production access, or incident reporting. Walk through who requests, approves, performs, and reviews the work. Include occasional cover and relevant contractors. The person outside your usual meeting may still be the first person a customer calls.
Then ask what each person actually needs. An approver may need the business reason and duration for access. The engineer granting it needs permissions, expiration, and recording instructions. Help each of them find their decision without digging through material meant for somebody else.
For each important message, settle four things:
- Who needs it, and what should they do afterward?
- Who prepares and approves it?
- Where can they find the current instructions?
- When must it reach them, and who will answer questions?
Use a delivery method suited to the situation. A knowledge-base update, team discussion, and recorded acknowledgment may work for a straightforward change. An urgent operational instruction may need direct contact and confirmation that the responsible person is available.
Make the next action understandable
Tell your team what changed, why it matters, when it takes effect, and what they should do differently. Link the active procedure and identify someone who can answer questions. Keep older versions where they help explain earlier activity, but make the current version easy to recognize.
For emergency access, explain the named approver, backup, decision record, and route to use when the normal channel is unavailable. Connect those steps to the objective of limiting access to approved work and removing it promptly. If a hosting change shifts responsibilities to a provider, explain the new boundary too.
Before calling the rollout complete, ask an engineer to walk you through a request and ask support how they would route it. Listen for the handoff neither person owns. You can correct that ambiguity now, while there is time to think.
Use the same practical approach for awareness training. Work through a customer-file mistake or an unexpected authentication prompt. Record participation and follow up with anyone absent. A scheduled course helps with learning, while operational changes still need communication when they occur.
Give information a route back
Your team should know how to report a suspected problem before they have all the facts. If someone sends a customer file to the wrong recipient, they need a clear contact and useful reporting instructions immediately, without searching an old slide deck.
Assign people to receive and route concerns about incidents, confusing instructions, or controls that cannot be performed. Include a credible alternative when the usual manager is absent or involved in the concern. Confirm that the alternate contact has accepted the role, and describe confidentiality honestly. In a small team, the circumstances may identify the reporter.
Make sure significant concerns reach management and the board or other appropriate governing body with enough context for oversight. A concise report can explain the affected service, immediate response, and decision still needed. Keep sensitive supporting details restricted.
When someone points out a gap, close the loop where appropriate. Let them know what you clarified or changed. That makes it easier for your team to bring the next problem forward.
A five-person company with two founders
Imagine you and your cofounder run a bootstrapped software company with three employees. You handle operations and customers; your cofounder leads engineering. You talk constantly, so it is tempting to assume everyone hears important changes.
Before changing emergency access, you create a short reference with responsibilities, current procedures, and reporting contacts. Each founder owns their area, and the other checks whether the instructions make sense outside that specialty.
Your cofounder walks all five people through a realistic request. You check support coverage. An absent employee gets a separate briefing before taking responsibility under the revised procedure. You record the version, participants, questions, and clarifications, then put the current reference into onboarding.
Vanta can help you keep those records together as evidence linked to the relevant control, with an assigned owner for the supporting item. The walkthrough gives you the practical check that the written instructions were understood.
Keep: approved versions, audience lists, dated briefings or acknowledgments, resolved questions, and actual escalations. Include the founders’ participation. Explain how to raise concerns with either founder and provide a credible route for concerns involving both. Sensitive data or complex services may justify more formal arrangements and qualified support even at this size.
A 100-person company with several departments
At a fictional 100-person company, you are replacing the approved file-sharing service. Engineering hears about it quickly. Sales still has a long-running customer exchange in the old tool, and a new support employee has just received outdated onboarding slides.
You name a communication owner who identifies the affected employees and contractors. Security explains customer-file handling, IT covers migration and access, and support updates its workflow. Managers bring forward exceptions so the relevant process owners can resolve them.
The owner records who received the instructions and when the old method stops being authorized. Short walkthroughs with each department test whether the process works in practice. New hires receive current material, and managers inheriting control responsibilities get a role-specific briefing.
You could use Vanta to assign the updated policy and track acceptance. Check the assigned audience against the people affected by the change. Use the walkthrough findings to answer the separate question of whether they know what to do.
Keep: the announcement, audience population, guidance versions, completion and follow-up records, approved exceptions, and walkthrough results. Investigate missing recipients before relying on a completion percentage.
A 1,000-person company across business units
At a 1,000-person service provider, your new incident escalation process crosses regions, languages, and acquired businesses. A companywide announcement reaches inboxes, but an exercise reveals that one acquired team still calls a retired number.
The central security team supplies common instructions. Local owners verify contacts, working hours, and translation needs, then demonstrate that their on-call people can reach the responder and backup. Leadership sees the specific coverage gap and assigns corrective work, rather than relying on an encouraging companywide percentage.
In Vanta, you could route supported test notifications to assigned owners and organize local exercise records as evidence. Review the coverage behind automated results before using them in your reporting. Check available features and configuration; a policy-acceptance result does not establish that an on-call handoff works.
Exercise the handoffs between units, especially when an event starts in one service and affects another. Keep exercise results separate from real incident records. Preserve common and local instructions, distribution populations, training, contact checks, findings, and follow-up, including effective dates so earlier activity can be understood.
Preserve the history during a Type 2 period
A SOC 2 Type 2 examination assesses control design and operating effectiveness over a specified period. Capture your evidence when communication occurs: the message, audience, date, and response needed. Today’s policy folder cannot establish which version someone received months ago.
Keep actual completion dates when training or acknowledgment is late, along with your response. Do not backdate records or invent communications when no relevant change or concern occurred. Choose review and training intervals around your risks, obligations, and workforce needs.
Discuss your evidence approach with the examining CPA firm, particularly where personnel information is sensitive. These scenarios illustrate approaches to consider; they do not determine the auditor’s procedures or guarantee a result.
Check one recent change
Choose a procedure you recently changed. Ask three affected people how they heard about it and what they now do differently. Compare their answers with the active instructions, then fix the gap in delivery or understanding. That is a useful place to start.
Support for your SOC 2 program
Genius GRC helps you develop practical controls and organize their supporting evidence. Schedule a free consultation to work through communication responsibilities that fit your team.
Explore the SOC 2 Guide for the full series. Next is CC2.3: External Communication. This article provides general guidance; evaluate the examples with your advisers and auditor in the context of your examination scope and obligations.