SOC2-CC1.3 CC1.3 Structures, reporting lines, authorities and responsibilities (COSO principle 3)
SOC2-CC1.3 in SOC 2 (the AICPA 2017 Trust Services Criteria with the revised points of focus). All SOC 2 controls held. Open SOC 2 on the standards site.
The control as we hold it
CC1.3 Structures, reporting lines, authorities and responsibilities (COSO principle 3). Management, overseen by the board, sets up the structures, reporting lines and authority needed to pursue objectives. Points of focus: every structure is considered, including business units, legal entities, locations and outsourced providers; reporting lines are designed so authority can be exercised and information can flow; authority and responsibility are delegated with segregation of duties where needed; requirements for security, availability, confidentiality, privacy and processing integrity shape how roles are defined; and the need to interact with and oversee external parties is built into the.
Reviewed and closest counterparts in the other frameworks
Reviewed rows come from a released pair; a closest match is the nearest held text and is not a reviewed row.
HIPAA Security Rule
- 164.308(a)(2) Assigned Security Responsibility (Standard) (closest match)
NIST SP 800-53 Rev 5
- NIST800-PL-4 PL-4 Rules of Behavior (closest match)
- NIST800-PM-1 PM-1 Information Security Program Plan (closest match)
- NIST800-PM-2 PM-2 Information Security Program Leadership Role (closest match)
- NIST800-PM-11 PM-11 Mission and Business Process Definition (closest match)
- NIST800-PM-18 PM-18 Privacy Program Plan (closest match)
- NIST800-PM-19 PM-19 Privacy Program Leadership Role (closest match)
- NIST800-PM-23 PM-23 Data Governance Body (closest match)
- NIST800-PM-29 PM-29 Risk Management Program Leadership Roles (closest match)
What an auditor commonly asks for
General guidance for this control area (domain: CC - Common Criteria (Security)), in our words, not a statement of the standard and not binding on an assessor.
- the board or management oversight record
- the risk assessment and its treatment
- the access-review and change-approval records
- the monitoring, logging and incident records