CC1.1 — Integrity and ethical values

COSO Principle 1 — The entity demonstrates a commitment to integrity and ethical values.

Also written as CC 1.1, TSC CC1.1, SOC2 CC1.1, SOC 2 Type 2 CC1.1.

Written by Jett N. · Last reviewed 22 July 2026

What SOC 2 CC1.1 requires

Integrity and ethical values is one of 5 criteria in the Control Environment (CC1) series of the Security (Common Criteria) category. COSO Principle 1 — The entity demonstrates a commitment to integrity and ethical values. CC1 criteria come from the COSO framework rather than from security practice, so the evidence is governance paperwork — charters, minutes, signed acknowledgements — and it usually lives with HR, legal, or the board rather than with the security team.

Audit evidence assessors look for

When preparing for a SOC 2 audit against CC1.1, gather artefacts such as:

Points of focus for CC1.1

The Trust Services Criteria set out points of focus that describe what an auditor considers when assessing CC1.1. They are not themselves requirements, but they shape the testing:

• The board and management set the tone through their own directives, actions and behaviour.
• Standards of conduct are defined, communicated, and understood by staff, contractors and business partners.
• Adherence to those standards is evaluated, not assumed.
• Deviations are identified and addressed in a timely and consistent way.

How to implement CC1.1

1. Get the code of conduct signed, and keep the signaturesThe artefact auditors sample is the signature list reconciled against the current employee roster. A code of conduct with no acknowledgement records evidences a document, not a control. Tie signing to onboarding and re-affirm annually.
2. Give people a reporting channel that is genuinely usableA whistleblower or ethics channel needs to allow anonymity and reach someone outside the normal management line. An email address that goes to the person a complaint might be about does not satisfy the intent.
3. Evidence the evaluation stepThe point of focus most commonly missed is evaluation. Something has to demonstrate that adherence is assessed — performance review criteria that reference conduct, an annual attestation, or a compliance review. Without it you have communicated standards and never checked them.
4. Keep records of how deviations were handledThis is uncomfortable evidence to prepare because it involves personnel matters, but the auditor does not need names. A redacted log showing that conduct issues were raised, investigated and concluded consistently is sufficient and is far stronger than asserting none occurred.
5. Cover contractors and partners explicitlyThe criterion extends to outsourced providers and business partners. That usually means a conduct or ethics clause in contracts rather than a signed code, but it needs to exist somewhere.

Common audit findings for CC1.1

What actually gets raised against CC1.1, in rough order of how often it comes up:

• Code of conduct signature coverage below headcount, usually because it was only ever collected at onboarding and never re-run.
• An ethics reporting channel that exists in policy but has no owner, no route, and no record of ever being tested.
• No evidence at all for the evaluation point of focus, which is the most frequently missed part of CC1.1.
• Contractors excluded from conduct requirements despite having system access.

Scoping CC1.1

CC1.1 is Common Criteria, so it applies to every SOC 2 engagement without exception. Its evidence sits almost entirely outside the security team — HR, legal and the executive — which is why it is disproportionately often the last evidence to arrive before fieldwork. Start collecting it early.

ISO 27001 mapping

CC1.1 corresponds to the following ISO 27001:2022 Annex A control(s): A.5.1, A.5.4, A.6.2, A.6.6. If you already run an ISO 27001 ISMS, map your existing evidence for these controls to CC1.1 rather than duplicating work.

Other Control Environment criteria

All CC1 Control Environment criteria →