SOC2-CC1.1 CC1.1 Commitment to integrity and ethical values (COSO principle 1)
SOC2-CC1.1 in SOC 2 (the AICPA 2017 Trust Services Criteria with the revised points of focus). All SOC 2 controls held. Open SOC 2 on the standards site.
The control as we hold it
CC1.1 Commitment to integrity and ethical values (COSO principle 1). The organisation shows through direction, decisions and behaviour that integrity and ethics matter to how it runs its controls. Points of focus: leadership sets the tone at the top; expected conduct is written into a code that staff, outsourced providers and partners understand; performance of individuals and teams is judged against that code; departures from it are found and corrected promptly and consistently; and contractors and vendor staff are brought within the same conduct expectations, adherence checks and corrective action.
Reviewed and closest counterparts in the other frameworks
Reviewed rows come from a released pair; a closest match is the nearest held text and is not a reviewed row.
HIPAA Security Rule
- 164.306 Security Standards: General Rules (closest match)
- 164.308(a)(1)(ii)(C) Sanction Policy (Required) (closest match)
NIST SP 800-53 Rev 5
- NIST800-PL-4 PL-4 Rules of Behavior (closest match)
- NIST800-PS-6 PS-6 Access Agreements (closest match)
- NIST800-PS-8 PS-8 Personnel Sanctions (closest match)
What an auditor commonly asks for
General guidance for this control area (domain: CC - Common Criteria (Security)), in our words, not a statement of the standard and not binding on an assessor.
- the board or management oversight record
- the risk assessment and its treatment
- the access-review and change-approval records
- the monitoring, logging and incident records