Skip to content

SOC 2® change management in plain English (CC8.1)

Unofficial plain-English guide. Not affiliated with or endorsed by the AICPA. Read the AICPA’s own criteria

An unofficial plain-English look at SOC 2 criterion CC8.1: how a change moves from a laptop to production, and what trail it leaves for a reviewer.

By Blank Slate Creative.

OrderFive custom security policies, $85 flat. Markdown, Word, and PDF.

Order the five policies

How does a change get from a laptop to production, and who saw it?

CC8.1 is a single criterion, and it covers a lot: code, infrastructure, data changes, and the procedures people follow. A team that already works in pull requests and automated builds has much of this in place. The gap is often proof.

Reviewers typically pull a sample of recent changes and ask to see, for each one, the request, the review, the test result, and the release. If one system keeps those together, the sample is quick. If the trail is split between chat, a laptop, and someone’s memory, it is slow.

Where a small team starts

Turn on branch protection so nothing reaches the main branch without a review and passing checks. Write one paragraph on the emergency path: who may bypass the rule, and that a review follows within a day or two.

That gives you a rule and a record. Do the same for infrastructure changes, so the cloud account isn’t the one place where people click things by hand.

The criteria, CC8.1

Below are our short labels, what the criteria are about, and examples of what a small team might do or keep. The examples are our own views, not requirements of the standard.

CC8.1: Controlled changes to systems and code

Changes are a common way for systems to break or open up by accident, so the way you make them should leave a trail. A reviewer usually samples recent changes and checks that each followed the same process.

In practice

  • Pull requests that need a reviewer and passing checks before merge.
  • Branch protection that blocks direct pushes to the main branch.
  • Pipeline logs kept as the release record.
  • An emergency path that is reviewed after the fact, within a day or two.

Questions worth being able to answer

These are ours, not a list of what an examiner will ask. If you can answer each in a sentence, and show where the proof lives, you are in good shape for the conversation.

  • Show me five random production changes and their approvals.
  • Who can push to production, and can they approve their own change?
  • How are infrastructure changes reviewed?
  • What do you do when a change can’t wait?
  • How do you roll a change back?

More topics in this guide

This page is one part of our unofficial guide to the SOC 2 Trust Services Criteria. Here are the others.

Related guides

About this guide and the study tool

Who we are, and aren’t

Blank Slate Creative, LLC is not affiliated with, endorsed by, or sponsored by the AICPA, CIMA, or the Association of International Certified Professional Accountants. We are not a CPA firm. Only a licensed CPA firm can perform a SOC 2 examination and issue a report.

What this is, and isn’t

This is an unofficial, plain-English explanation written by Blank Slate Creative, LLC. It is not the Trust Services Criteria, and it does not reproduce or replace them.

It is not legal, audit, or attestation advice.

Using this guide or the study tool does not mean you will pass an audit or satisfy any customer or auditor.

The “in practice” notes and examples are our own views, not requirements of the standard.

Written about the 2017 criteria with the 2022 revised points of focus. The AICPA may revise them.

Read the AICPA’s own publication for the authoritative wording. The PDF download asks for a free AICPA account.

Trademarks

AICPA and American Institute of CPAs are trademarks of the American Institute of Certified Public Accountants and are registered in the US, the EU and other countries.

SOC 1®, SOC 2® and SOC 3® trademarks are registered trademarks of the AICPA.

← All guides