SOC2 CC2 - Communication and Information

Control: CC2 - Communication and Information Status: Procedure template Last Updated: 2025-12-16 Owner: Organization Leadership

---

Overview

This document defines communication and information requirements for organizations using CloudForge CI. Effective communication ensures that relevant, quality information is identified, captured, and communicated to support internal control. These procedures are a template for addressing SOC2 CC2 (Communication and Information) requirements.

---

CC2.1 - Information Quality for Internal Control

Information Sources

CloudForge CI generates the following information for internal control:

Information Type	Source	Quality Controls
Audit Logs	CloudTrail	Tamper-proof, encrypted, validated
Configuration Data	AWS Config	Continuous recording, drift detection
Security Findings	GuardDuty, Security Hub	Automated correlation, severity rating
Compliance Status	AWS Config Rules	Real-time evaluation
Performance Metrics	CloudWatch	High-resolution, accurate timestamps

Data Quality Requirements

Attribute	Requirement	Validation
Completeness	All events captured	CloudTrail validation enabled
Accuracy	Correct event details	AWS service guarantees
Timeliness	Near real-time capture	< 15 minute delivery to S3
Authorization	Only authorized access	S3 bucket policies, encryption
Integrity	No modification	Log file validation, checksums

---

CC2.2 - Internal Communication

Communication Channels

Channel	Purpose	Audience	Frequency
Security Alerts	Critical security events	Security team, on-call	Real-time
Compliance Reports	Control status summary	Leadership, compliance	Weekly/Monthly
Incident Notifications	Active incident updates	Stakeholders	As needed
Change Notifications	Infrastructure changes	Operations, development	Per change
Policy Updates	Security policy changes	All staff	As needed

CloudForge CI Automated Notifications

Event Type	Notification Method	Recipients
GuardDuty Finding (High)	SNS -> Email/Slack/PagerDuty	Security team
Config Rule Non-Compliant	SNS -> Email	Cloud administrators
CloudWatch Alarm	SNS -> Email/PagerDuty	Operations team
Security Hub Critical	EventBridge -> SNS	Security team
Failed Deployment	CloudFormation notifications	DevOps team

SNS Topic Configuration

CloudForge CI creates the following SNS topics:

Topic	Created by	Purpose
security-alerts-<profile>	SecurityMonitoringFactory	Security findings and alarms
alb-alarms-<profile>	AlarmFactory	ALB health and error-rate alarms

<profile> is the security profile in lower case (dev, staging, or production). Separate compliance or operational topics, if required, must be created by the organization.

---

CC2.3 - External Communication

External Party Communication

External Party	Communication Type	Frequency	Owner
Auditors	Compliance evidence, reports	Annual/As requested	Compliance Officer
Regulators	Compliance certifications	As required	Legal/Compliance
Customers	Security documentation, SOC2 reports	Upon request	Sales/Legal
Vendors	Security requirements, assessments	Contract renewal	Procurement
Law Enforcement	Incident data (if required)	As legally required	Legal

Customer Communication Requirements

Document	Purpose	Update Frequency
Security Whitepaper	Describe security controls	Annual
SOC2 Report	Third-party attestation	Annual
Privacy Policy	Data handling practices	Annual/As changed
Incident Notification	Breach communication	Within 72 hours
Service Status	Availability information	Real-time

Breach Notification Template

SECURITY INCIDENT NOTIFICATION
==============================
Date: [Date]
Incident ID: [ID]

SUMMARY
-------
[Brief description of the incident]

AFFECTED DATA
-------------
- Data types: [List]
- Records affected: [Number or estimate]
- Time period: [Start - End]

ACTIONS TAKEN
-------------
1. [Containment actions]
2. [Investigation status]
3. [Remediation steps]

RECOMMENDED ACTIONS
-------------------
[Actions customers should take]

CONTACT
-------
[Contact information for questions]

Next update: [Date/Time]

---

CC2.4 - Reporting Deficiencies

Deficiency Reporting Process

┌─────────────────┐     ┌─────────────────┐     ┌─────────────────┐
│  Deficiency     │────>│  Assessment &   │────>│  Remediation    │
│  Identified     │     │  Classification │     │  Assignment     │
└─────────────────┘     └─────────────────┘     └─────────────────┘
                                                        │
┌─────────────────┐     ┌─────────────────┐            │
│  Closure &      │<────│  Verification   │<───────────┘
│  Reporting      │     │  & Testing      │
└─────────────────┘     └─────────────────┘

Deficiency Classification

Severity	Definition	Response Time	Escalation
Critical	Control completely ineffective	24 hours	Executive immediately
High	Significant control weakness	7 days	Security leadership
Medium	Control partially effective	30 days	Department manager
Low	Minor improvement needed	90 days	Control owner

Reporting Channels

Reporter	Channel	Recipient
Automated (AWS)	Security Hub findings	Security team
Internal Staff	Ticketing system	Security team
External (Pentest)	Formal report	Security leadership
Auditor	Audit finding	Compliance officer

---

Communication Records Retention

Record Type	Retention Period	Storage
Security Alerts	1 year	SIEM/CloudWatch Logs
Incident Communications	7 years	Secure archive
Audit Reports	7 years	Secure archive
Policy Acknowledgments	Duration of employment + 3 years	HR system
External Communications	7 years	Document management

---

Audit Checklist

• SNS topics configured for security, compliance, and operational alerts
• Alert recipients documented and current
• External communication templates approved by legal
• Breach notification procedures tested annually
• Deficiency tracking system in place
• Communication records retained per policy
• Customer-facing security documentation current
• Escalation paths documented and tested