SOC2-CC3.1 CC3.1 Objectives specified clearly enough to assess risk (COSO principle 6)
SOC2-CC3.1 in SOC 2 (the AICPA 2017 Trust Services Criteria with the revised points of focus). All SOC 2 controls held. Open SOC 2 on the standards site.
The control as we hold it
CC3.1 Objectives specified clearly enough to assess risk (COSO principle 6). Objectives are defined precisely enough that risks to them can be identified and assessed. Points of focus: operations objectives reflect management's choices and risk tolerances, include performance goals and guide resource allocation; external financial reporting objectives follow suitable accounting principles, consider materiality and reflect real activity; external non-financial reporting objectives follow applicable laws and recognised frameworks with suitable precision; internal reporting gives management accurate, sufficiently precise information; compliance objectives absorb legal minimums and tolerances;.
Reviewed and closest counterparts in the other frameworks
Reviewed rows come from a released pair; a closest match is the nearest held text and is not a reviewed row.
HIPAA Security Rule
- 164.306 Security Standards: General Rules (closest match)
- 164.308(a)(1)(i) Security Management Process (Standard) (closest match)
NIST SP 800-53 Rev 5
- NIST800-CA-1 CA-1 Policy and Procedures (closest match)
- NIST800-PL-1 PL-1 Policy and Procedures (closest match)
- NIST800-PL-2 PL-2 System Security and Privacy Plans (closest match)
- NIST800-PL-7 PL-7 Concept of Operations (closest match)
- NIST800-PL-11 PL-11 Baseline Tailoring (closest match)
- NIST800-PM-1 PM-1 Information Security Program Plan (closest match)
- NIST800-PM-7 PM-7 Enterprise Architecture (closest match)
- NIST800-PM-9 PM-9 Risk Management Strategy (closest match)
What an auditor commonly asks for
General guidance for this control area (domain: CC - Common Criteria (Security)), in our words, not a statement of the standard and not binding on an assessor.
- the board or management oversight record
- the risk assessment and its treatment
- the access-review and change-approval records
- the monitoring, logging and incident records