Criterion CC9.1The entity identifies, selects, and develops risk mitigation activities for risks arising from potential business disruptions.

What it says

The entity identifies, selects, and develops risk mitigation activities for risks arising from potential business disruptions.

SOC 2, the trust services criteria, CC9.1

What is in the packs for this

Each one helps with this requirement.

• XLSExcel

  Trust Services Criteria Response Register

  in SOC 2 Report ReadinessThe register has a row for this criterion, for you to write down your own controls, owners and evidence against it. Lists the 61 Trust Services Criteria by number and series title, with blank columns for your own controls, owners and evidence. It makes no coverage claim.
• DOCWord

  Business Continuity & ICT Resilience Policy

  in Business Continuity, Disaster Recovery & Cyber ResilienceIts Framework References cite this criterion. Commits the organisation to continuity and recovery objectives; the resilience domain's single policy.
• XLSExcel

  Business Impact Analysis Questionnaire

  in Business Continuity, Disaster Recovery & Cyber ResilienceIts Framework References cite this criterion. Gathers each critical service's business impact analysis with its business owner, process by process: busy periods, the least each process needs, and the harm over time that sets the service's maximum tolerable downtime.
• DOCWord

  Site & Business Unit Continuity Plan Template

  in Business Continuity, Disaster Recovery & Cyber ResilienceIts Framework References cite this criterion. One site's or business unit's plan for losing its building, a large part of its people, a supplier or its systems, with the first steps, the minimum resources and the vital records.