SOC2-CC2.3 CC2.3 Communication with external parties about internal control (COSO principle 15)
SOC2-CC2.3 in SOC 2 (the AICPA 2017 Trust Services Criteria with the revised points of focus). All SOC 2 controls held. Open SOC 2 on the standards site.
The control as we hold it
CC2.3 Communication with external parties about internal control (COSO principle 15). The organisation communicates with outside parties on matters that affect how internal control functions. Points of focus: relevant, timely information reaches shareholders, partners, regulators, customers and other external parties; open channels let customers, suppliers, auditors and regulators provide input; findings from external assessments reach the board; separate confidential channels exist; the method reflects timing, audience and legal or fiduciary expectations; confidentiality and privacy objectives and their changes are communicated to users, vendors and partners in engagements covering those.
Reviewed and closest counterparts in the other frameworks
Reviewed rows come from a released pair; a closest match is the nearest held text and is not a reviewed row.
HIPAA Security Rule
- 164.314(a)(2)(i) Business Associate Contract Required Provisions (closest match)
NIST SP 800-53 Rev 5
- NIST800-AU-16 AU-16 Cross-organizational Audit Logging (closest match)
- NIST800-CA-3 CA-3 Information Exchange (closest match)
- NIST800-IR-6 IR-6 Incident Reporting (closest match)
- NIST800-PM-15 PM-15 Security and Privacy Groups and Associations (closest match)
- NIST800-PS-7 PS-7 External Personnel Security (closest match)
- NIST800-SR-8 SR-8 Notification Agreements (closest match)
What an auditor commonly asks for
General guidance for this control area (domain: CC - Common Criteria (Security)), in our words, not a statement of the standard and not binding on an assessor.
- the board or management oversight record
- the risk assessment and its treatment
- the access-review and change-approval records
- the monitoring, logging and incident records