SOC2-CC3.4 CC3.4 Identifying and assessing significant changes (COSO principle 9)
SOC2-CC3.4 in SOC 2 (the AICPA 2017 Trust Services Criteria with the revised points of focus). All SOC 2 controls held. Open SOC 2 on the standards site.
The control as we hold it
CC3.4 Identifying and assessing significant changes (COSO principle 9). Changes that could significantly affect the system of internal control are identified and assessed. Points of focus: changes in the regulatory, economic and physical environment; changes to the business model such as new lines, acquisitions, divestments, rapid growth, geographic reliance and new technology; changes in leadership and their attitudes to control; changes in the organisation's systems and technology environment; and changes in vendor and partner relationships. The 2022 revision adds that the process also tracks shifts in internal and external threats and in the weaknesses of system components, and how those.
Reviewed and closest counterparts in the other frameworks
Reviewed rows come from a released pair; a closest match is the nearest held text and is not a reviewed row.
HIPAA Security Rule
- 164.308(a)(1)(ii)(A) Risk Analysis (Required) (closest match)
- 164.308(a)(7)(i) Contingency Plan (Standard) (closest match)
- 164.308(a)(8) Evaluation (Standard) (closest match)
- 164.316(b)(2)(iii) Updates (Documentation) (closest match)
NIST SP 800-53 Rev 5
- NIST800-CA-7 CA-7 Continuous Monitoring (closest match)
- NIST800-CM-3 CM-3 Configuration Change Control (closest match)
- NIST800-CM-4 CM-4 Impact Analyses (closest match)
- NIST800-PL-7 PL-7 Concept of Operations (closest match)
- NIST800-PM-11 PM-11 Mission and Business Process Definition (closest match)
- NIST800-PM-16 PM-16 Threat Awareness Program (closest match)
- NIST800-PM-31 PM-31 Continuous Monitoring Strategy (closest match)
- NIST800-RA-3 RA-3 Risk Assessment (closest match)
What an auditor commonly asks for
General guidance for this control area (domain: CC - Common Criteria (Security)), in our words, not a statement of the standard and not binding on an assessor.
- the board or management oversight record
- the risk assessment and its treatment
- the access-review and change-approval records
- the monitoring, logging and incident records