SOC 2 CC5.1: COSO Principle 10: Selects and Develops Control Activities That Mitigate Risks

Map each risk from your risk register to one or more control activities. Build a risk-control matrix that makes this linkage explicit. This is arguably the single most important artefact for demonstrating that your controls are purposeful rather than arbitrary. Specify each control clearly: what risk it mitigates, what activity is performed, how often, who performs it, what evidence is generated, and how effectiveness is verified. Vague control descriptions are difficult to test and even harder to audit. Use a layered defence approach. For critical risks, combine preventive controls (access restrictions, configuration hardening) with detective controls (monitoring, alerting) and corrective controls (incident response, backup recovery). No single control failure should lead to an unacceptable outcome. Automate where you can. Automated controls are more consistent and reliable than manual ones. Automated access provisioning/deprovisioning, configuration compliance checks, backup verification, and vulnerability scanning all reduce human error. Document both automated and manual controls clearly. Build approval and authorisation workflows for sensitive operations. Define what requires management approval, what needs dual approval, and how exceptions are escalated. Implement these in your tooling rather than relying on informal processes. Review control activities at least annually, or whenever the risk environment shifts. Assess whether existing controls are still effective, whether new ones are needed, and whether any can be streamlined without increasing risk.