SOC2-CC3.2 CC3.2 Identifying and analysing risks to objectives (COSO principle 7)
SOC2-CC3.2 in SOC 2 (the AICPA 2017 Trust Services Criteria with the revised points of focus). All SOC 2 controls held. Open SOC 2 on the standards site.
The control as we hold it
CC3.2 Identifying and analysing risks to objectives (COSO principle 7). Risks to objectives are identified across the organisation and analysed as the basis for deciding how to manage them. Points of focus: risk is assessed at entity, subsidiary, division, unit and function level; internal and external factors are considered; appropriate management levels take part; the significance of each risk is estimated; a response of accept, avoid, reduce or share is chosen; information assets are identified and their criticality assessed together with threats and vulnerabilities; threats arising from vendors, partners and others with access are analysed; and significance combines asset criticality,.
Reviewed and closest counterparts in the other frameworks
Reviewed rows come from a released pair; a closest match is the nearest held text and is not a reviewed row.
HIPAA Security Rule
- 164.306 Security Standards: General Rules (closest match)
- 164.308(a)(1)(i) Security Management Process (Standard) (closest match)
- 164.308(a)(1)(ii)(A) Risk Analysis (Required) (closest match)
- 164.308(a)(1)(ii)(B) Risk Management (Required) (closest match)
- 164.308(a)(7)(ii)(E) Applications and Data Criticality Analysis (Addressable) (closest match)
NIST SP 800-53 Rev 5
- NIST800-PM-4 PM-4 Plan of Action and Milestones Process (closest match)
- NIST800-PM-9 PM-9 Risk Management Strategy (closest match)
- NIST800-PM-28 PM-28 Risk Framing (closest match)
- NIST800-RA-1 RA-1 Policy and Procedures (closest match)
- NIST800-RA-3 RA-3 Risk Assessment (closest match)
- NIST800-RA-5 RA-5 Vulnerability Monitoring and Scanning (closest match)
- NIST800-RA-7 RA-7 Risk Response (closest match)
- NIST800-RA-8 RA-8 Privacy Impact Assessments (closest match)
What an auditor commonly asks for
General guidance for this control area (domain: CC - Common Criteria (Security)), in our words, not a statement of the standard and not binding on an assessor.
- the board or management oversight record
- the risk assessment and its treatment
- the access-review and change-approval records
- the monitoring, logging and incident records