{
  "node_id": "soc2-cc9-risk-mitigation",
  "title": "AICPA SOC 2 Common Criteria CC9 - Risk Mitigation (CC9.1-CC9.2)",
  "domain": "Cybersecurity",
  "version": "1.0.0",
  "last_updated": "2026-06-26",
  "bluf": "CC9 is the Risk Mitigation series of the SOC 2 Common Criteria (CC9.1-CC9.2). It requires the entity to identify, select, and develop risk mitigation activities for risks arising from potential business disruptions, and to assess and manage risks associated with vendors and business partners. CC9 covers business continuity and third-party risk management within the Common Criteria.",
  "paywall": {
    "status": "LOCKED",
    "unlock_cost_usd": "0.01",
    "skyfire_id": "41779894-ece2-4163-9761-b3b1b76e19b0"
  },
  "crosswalks": {
    "_available_keys": [
      "nist_framework",
      "iso_standard",
      "industry_mapping",
      "ai_overlay_2026"
    ],
    "_note": "Full crosswalk values included in vault response"
  },
  "dependencies": [
    "soc-2-type-ii-trust-services-criteria-2024",
    "soc2-security-criterion"
  ],
  "primary_citations_count": 5
}