Governance
Management assigns responsibility for design, operation, monitoring, evidence ownership, and remediation of controls supporting the organization's services, customer environments, security operations, and internal systems.
Use this guide to put the control into operation, decide what records to retain, and check that an auditor can trace the evidence back to the work your team performed.
Maintained by GreenHat Security · Reviewed August 21, 2026
Leaders can show who is accountable for security decisions, who operates each control, how performance is reviewed, and how unresolved issues are escalated and closed.
First SOC 2 program
Keep the structure small and real. Name one executive accountable for the program, assign an operator and evidence owner for each important control, and hold a short monthly security review using the same agenda and action log each time.
As the company scales
Create a management-approved governance charter, delegate control ownership to functional leaders, and use a quarterly dashboard to review control health, exceptions, overdue remediation, material risks, and decisions that require executive attention.
List the security decisions management must make, including risk acceptance, policy approval, remediation priority, and escalation of material issues.
You should end up with: A governance charter that states authority, scope, meeting cadence, and escalation thresholds.
Give every in-scope control one accountable business or technical owner, one day-to-day operator, and one person responsible for retaining evidence.
You should end up with: A dated responsibility matrix with named people or roles and no unassigned controls.
Schedule recurring reviews and define the minimum inputs: control status, exceptions, risk acceptances, incidents, overdue actions, and material changes.
You should end up with: A recurring calendar series and a consistent review agenda.
Summarize what is working, what is late, what changed, and which items need a decision instead of presenting an undifferentiated list of security activity.
You should end up with: A dated control-health dashboard or management report for each review.
Capture attendees, materials reviewed, questions raised, decisions made, and assigned actions during each governance meeting.
You should end up with: Approved meeting notes or a decision log linked to the materials reviewed.
Assign an owner and target date to every follow-up, escalate overdue items, and require support showing that corrective work was completed before closure.
You should end up with: An action tracker with status history and links to closure evidence.
Build the evidence set in three layers: what defines the control, who approved or reviewed it, and what proves it operated. Collect operating records when the work happens so they remain dated, attributable, correctly scoped, and traceable to the underlying activity.
Before sharing, remove unrelated personal or customer data, never expose passwords, tokens, or secret values, preserve enough source context to authenticate the record, and use the secure exchange approved for the engagement.
Documents that define the control, its scope, ownership, and expected way of working.
Confirm what the record proves
Management established the security governance body, its authority, decision scope, membership, review cadence, and escalation responsibilities.
Include this context
approved scope and authority
Include this context
named roles or members
Include this context
decision and escalation responsibilities
Include this context
meeting cadence
Include this context
approval and effective date
Weak evidence to avoid
An undated charter draft that lists a security committee but does not grant it decision authority or identify who approved it.
Confirm what the record proves
Each in-scope control has accountable leadership, an operator, an evidence owner, and an escalation path rather than falling between teams.
Include this context
control identifier
Include this context
accountable owner
Include this context
control operator
Include this context
evidence owner
Include this context
escalation role
Include this context
last review date
Weak evidence to avoid
A spreadsheet that assigns every control to Security with no named operator, evidence owner, review date, or acknowledgement from the assigned teams.
Records showing that an accountable person reviewed, approved, challenged, or accepted the work.
Confirm what the record proves
Management actually reviewed control health, risks, exceptions, and remediation and made or assigned follow-up decisions during the review period.
Include this context
meeting date
Include this context
attendees
Include this context
materials and metrics reviewed
Include this context
decisions made
Include this context
action owner and due date
Weak evidence to avoid
A recurring calendar invitation titled Security Review with no attendees captured, attached status, minutes, decisions, or action assignments.
Dated proof that the control actually ran, such as tickets, logs, settings, exports, reports, and test results.
Confirm what the record proves
Governance follow-ups and control deficiencies were assigned, monitored, escalated when late, and closed with supporting proof.
Include this context
issue and affected control
Include this context
severity or risk
Include this context
accountable owner
Include this context
target date
Include this context
status history
Include this context
closure evidence and reviewer
Weak evidence to avoid
A task list in which three overdue security issues are marked done without closure dates, reviewer approval, or links showing what was fixed.
Type 1
The current approved governance charter, current control owner matrix, the most recent management review package, and open remediation dashboard as of the examination date, showing that oversight is designed and assigned.
Type 2
The complete set of scheduled security governance reviews held or due during the review period, together with every action, deficiency, risk acceptance, or escalation created from those reviews through period end.
Reconcile the governance calendar to retained meeting records, then reconcile every action identifier in the minutes to the remediation system, explaining canceled meetings, missing records, and unmatched actions.
Use this checklist to prepare for procedures an auditor may perform. The exact steps and sample selection depend on your engagement scope and the service auditor's professional judgment.
Determine whether the control is designed to achieve this result: Leaders can show who is accountable for security decisions, who operates each control, how performance is reviewed, and how unresolved issues are escalated and closed.
Compare the documented owner with the intended role (Executive Management / CISO), then compare dated records with the stated cadence: At least annually and upon material change.
Reconcile the governance calendar to retained meeting records, then reconcile every action identifier in the minutes to the remediation system, explaining canceled meetings, missing records, and unmatched actions.
The current approved governance charter, current control owner matrix, the most recent management review package, and open remediation dashboard as of the examination date, showing that oversight is designed and assigned.
The complete set of scheduled security governance reviews held or due during the review period, together with every action, deficiency, risk acceptance, or escalation created from those reviews through period end.
Documents that define the control, its scope, ownership, and expected way of working.
For each selected record, confirm it demonstrates Management established the security governance body, its authority, decision scope, membership, review cadence, and escalation responsibilities.
For each selected record, confirm it demonstrates Each in-scope control has accountable leadership, an operator, an evidence owner, and an escalation path rather than falling between teams.
Records showing that an accountable person reviewed, approved, challenged, or accepted the work.
For each selected record, confirm it demonstrates Management actually reviewed control health, risks, exceptions, and remediation and made or assigned follow-up decisions during the review period.
Dated proof that the control actually ran, such as tickets, logs, settings, exports, reports, and test results.
For each selected record, confirm it demonstrates Governance follow-ups and control deficiencies were assigned, monitored, escalated when late, and closed with supporting proof.
Use the categories that apply to this control: connect any policy or design artifact to its approval or review record, then trace a selected operating record through execution, result, and any exception or remediation.
These identifiers help you navigate related Trust Services Criteria. They do not reproduce the criteria or prove that this control fully addresses them in your environment.
Confirm final scope, mappings, and testing expectations with your service auditor. SOC 2® is an AICPA trademark; GreenHat Security is not affiliated with or endorsed by AICPA.