# SOC 2 CC1.1 — Commitment to Integrity and Ethical Values

- Source: https://support.icompaas.com/support/solutions/articles/a_gen_soc2_cc11_49f6603f5f-soc-2-cc11-commitment-to-integrity-and-ethical-values
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [SOC2 Readiness](https://support.icompaas.com/support/solutions/62000111733) › [Common Criteria (Security)](https://support.icompaas.com/support/solutions/folders/f_gen_62000111733_commoncriteriasecurity)
- Last updated: 2026-05-30
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

SOC 2 · Control CC1.1 · Priority: high · Component: Common Criteria (Security)

### What this control covers

The entity demonstrates a commitment to integrity and ethical values.

### Why it matters

Vulnerabilities introduced in code are 100× cheaper to fix in development than in production; this control is the place where security shifts left.

### How to implement

#### AWS

Use **CodeBuild** with [VPC-isolated](https://aws.amazon.com/codebuild/) build environments and **CodeArtifact** for an internal package mirror so builds don't pull straight from the public registry. Sign artefacts with **AWS Signer**.

#### Azure

Use **Azure DevOps Pipelines** with mandatory approvals on production environments and **Microsoft Defender for DevOps** for secret scanning across GitHub/ADO/GitLab in one pane.

#### GitHub

Apply **branch protection** on default and release branches: require PR review, status checks, signed commits, linear history, and dismiss stale reviews on new commits. Use **CODEOWNERS** for required reviewers, **Dependabot** + **CodeQL** for SAST, and the **Dependency graph / SBOM** export for vendor disclosures.

### Evidence to collect

-   `code_repo_scan` — See the iCompaas Evidence library for the canonical source for this evidence type.
-   `infra_scan` — See the iCompaas Evidence library for the canonical source for this evidence type.

Source control pipelines (GitHub, GitLab) enforce SDLC guardrails. Focus: Commitment to Integrity and Ethical Values (Original component: Control Environment).

### Quick checklist

-   Commitment — Integrity / Ethical Values
-   Security — Integrity / Ethical Values
-   Secure — Integrity / Ethical Values

### Related articles on this site

-   [Ensure Restrict Permissions for Dismissing Code Review Approvals](https://support.icompaas.com/support/solutions/articles/62000234915-ensure-restrict-permissions-for-dismissing-code-review-approvals)
-   [Ensure Require Resolution of All Code Review Comments Before Merge](https://support.icompaas.com/support/solutions/articles/62000235197-ensure-require-resolution-of-all-code-review-comments-before-merge)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): The full SOC 2 implementation guide: scoping the Trust Services Criteria, the roadmap to a Type 2 report, and what the auditor samples.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): Teams that finish SOC 2 usually add ISO 27001 next; the control overlap is large and the guide explains what is genuinely extra.