SOC2-CC4.2 CC4.2 Evaluating and communicating control deficiencies (COSO principle 17)
SOC2-CC4.2 in SOC 2 (the AICPA 2017 Trust Services Criteria with the revised points of focus). All SOC 2 controls held. Open SOC 2 on the standards site.
The control as we hold it
CC4.2 Evaluating and communicating control deficiencies (COSO principle 17). Control deficiencies are evaluated and reported promptly to those who must fix them, including senior management and the board where appropriate. Points of focus: management and the board assess the results of evaluations; deficiencies go to the parties responsible for correction and upward as appropriate; and management tracks whether they are remedied on time.
Reviewed and closest counterparts in the other frameworks
Reviewed rows come from a released pair; a closest match is the nearest held text and is not a reviewed row.
HIPAA Security Rule
- 164.308(a)(1)(ii)(B) Risk Management (Required) (closest match)
- 164.308(a)(8) Evaluation (Standard) (closest match)
- 164.316(b)(1) Documentation (Standard) (closest match)
NIST SP 800-53 Rev 5
- NIST800-AT-6 AT-6 Training Feedback (closest match)
- NIST800-AU-6 AU-6 Audit Record Review, Analysis, and Reporting (closest match)
- NIST800-CA-1 CA-1 Policy and Procedures (closest match)
- NIST800-CA-2 CA-2 Control Assessments (closest match)
- NIST800-CA-5 CA-5 Plan of Action and Milestones (closest match)
- NIST800-CA-7 CA-7 Continuous Monitoring (closest match)
- NIST800-IR-6 IR-6 Incident Reporting (closest match)
- NIST800-PM-4 PM-4 Plan of Action and Milestones Process (closest match)
What an auditor commonly asks for
General guidance for this control area (domain: CC - Common Criteria (Security)), in our words, not a statement of the standard and not binding on an assessor.
- the board or management oversight record
- the risk assessment and its treatment
- the access-review and change-approval records
- the monitoring, logging and incident records