SOC2-CC1.5 CC1.5 Accountability for internal control responsibilities (COSO principle 5)
SOC2-CC1.5 in SOC 2 (the AICPA 2017 Trust Services Criteria with the revised points of focus). All SOC 2 controls held. Open SOC 2 on the standards site.
The control as we hold it
CC1.5 Accountability for internal control responsibilities (COSO principle 5). People are held answerable for the internal control duties assigned to them. Points of focus: structures and authority are used to communicate duties and apply corrective action; performance measures, incentives and rewards reflect control responsibilities and expected conduct across short and longer terms; those incentives are reviewed for continued relevance; pressures created by targets are weighed when assigning work and measuring performance; and performance of control duties, including conduct and competence, is evaluated with reward or discipline as warranted. The 2022 revision adds, for privacy.
Reviewed and closest counterparts in the other frameworks
Reviewed rows come from a released pair; a closest match is the nearest held text and is not a reviewed row.
HIPAA Security Rule
- 164.308(a)(1)(ii)(C) Sanction Policy (Required) (closest match)
- 164.308(a)(3)(ii)(A) Authorization and Supervision (Addressable) (closest match)
NIST SP 800-53 Rev 5
- NIST800-AC-5 AC-5 Separation of Duties (closest match)
- NIST800-AT-3 AT-3 Role-based Training (closest match)
- NIST800-AU-10 AU-10 Non-repudiation (closest match)
- NIST800-PL-4 PL-4 Rules of Behavior (closest match)
- NIST800-PM-10 PM-10 Authorization Process (closest match)
- NIST800-PS-1 PS-1 Policy and Procedures (closest match)
- NIST800-PS-8 PS-8 Personnel Sanctions (closest match)
- NIST800-PS-9 PS-9 Position Descriptions (closest match)
What an auditor commonly asks for
General guidance for this control area (domain: CC - Common Criteria (Security)), in our words, not a statement of the standard and not binding on an assessor.
- the board or management oversight record
- the risk assessment and its treatment
- the access-review and change-approval records
- the monitoring, logging and incident records