SOC2 - Is it a reequipment that an organization needs to have controls for "every" common criteria? Or do they pick and choose which to follow?

Just a suggestion, there should be a "compliance flair". ***Oops spell check wrote reequipment instead of requirement in my title.***

For SOC2, Looking at the "`Security`" TSC (which includes 9 common criteria). Does an organization need to have controls for every common criteria or they can pick and chose which ones they want to have apply to them? Example "`Control Environment`" has CC1.1 - CC1.5.

Can someone chose not to apply all five? Or does the organization need to make …

check compliance controls cybersecurity organization security soc2 spell check