CC2 tests whether security-relevant information actually reaches the people who need it, internally and externally. The distinction auditors draw is between publishing and communicating: a policy on an intranet nobody has acknowledged does not satisfy CC2, so distribution lists, acknowledgement records and customer-facing commitments carry the weight here.
CC2 Communication and Information contains 3 criteria. The Trust Services Criteria define 61 in total: 33 Common Criteria across CC1–CC9 plus the criteria for the Availability, Confidentiality, Processing Integrity and Privacy categories.
Yes. CC2 is part of the Common Criteria, which apply to every SOC 2 engagement regardless of which additional categories you scope in.
A Type 1 assesses whether the controls are suitably designed at a point in time. A Type 2 also tests whether they operated effectively across a review period, typically 3 to 12 months, by sampling evidence from throughout that window. Most customers asking for a SOC 2 mean Type 2.