Framework

SOC 2: what it asks of a production change

The Trust Services Criteria put change management in CC8.1 and the consideration of segregation in CC5.1; CC7.1 covers detecting configuration changes. The criteria are named by code and title here, not quoted.

Named, not quoted: the criteria text is not held in full here, so each criterion is named by code and title.

The findings it sits behind

3 clauses cited

Finding	Clause
No independent approval	SOC 2 CC8.1
Approved after it shipped	SOC 2 CC8.1
Automated author, no human approval	SOC 2 CC8.1
Deployed their own change	SOC 2 CC5.1
One person, three roles	SOC 2 CC5.1
Emergency, no approval after	SOC 2 CC8.1
Deployment with no matching change	SOC 2 CC7.1
No ticket reference	SOC 2 CC8.1
Approver not on the list	SOC 2 CC5.1
No test evidence	SOC 2 CC8.1

Every SOC 2 (Trust Services Criteria) clause the checker cites

Run the specimen Check your own change log