SOC2-CC4.1 CC4.1 Ongoing and separate evaluations of control (COSO principle 16)
SOC2-CC4.1 in SOC 2 (the AICPA 2017 Trust Services Criteria with the revised points of focus). All SOC 2 controls held. Open SOC 2 on the standards site.
The control as we hold it
CC4.1 Ongoing and separate evaluations of control (COSO principle 16). The organisation chooses, builds and carries out ongoing or separate evaluations to confirm the control components are present and working. Points of focus: a balance between continuous and point-in-time evaluations; the pace of business change informs their design; a baseline of the control system is established; evaluators understand what they evaluate; ongoing evaluations are built into processes; scope and frequency vary with risk; separate evaluations give objective feedback; and varied techniques are used such as penetration testing, independent certification against a standard and internal audit. The 2022 revision.
Reviewed and closest counterparts in the other frameworks
Reviewed rows come from a released pair; a closest match is the nearest held text and is not a reviewed row.
HIPAA Security Rule
- 164.308(a)(1)(i) Security Management Process (Standard) (closest match)
- 164.308(a)(1)(ii)(D) Information System Activity Review (Required) (closest match)
- 164.308(a)(8) Evaluation (Standard) (closest match)
NIST SP 800-53 Rev 5
- NIST800-AT-6 AT-6 Training Feedback (closest match)
- NIST800-AU-6 AU-6 Audit Record Review, Analysis, and Reporting (closest match)
- NIST800-CA-1 CA-1 Policy and Procedures (closest match)
- NIST800-CA-2 CA-2 Control Assessments (closest match)
- NIST800-CA-6 CA-6 Authorization (closest match)
- NIST800-CA-7 CA-7 Continuous Monitoring (closest match)
- NIST800-CA-8 CA-8 Penetration Testing (closest match)
- NIST800-IR-4 IR-4 Incident Handling (closest match)
What an auditor commonly asks for
General guidance for this control area (domain: CC - Common Criteria (Security)), in our words, not a statement of the standard and not binding on an assessor.
- the board or management oversight record
- the risk assessment and its treatment
- the access-review and change-approval records
- the monitoring, logging and incident records