SOC2-CC5.1 CC5.1 Selecting control activities that mitigate risk (COSO principle 10)
SOC2-CC5.1 in SOC 2 (the AICPA 2017 Trust Services Criteria with the revised points of focus). All SOC 2 controls held. Open SOC 2 on the standards site.
The control as we hold it
CC5.1 Selecting control activities that mitigate risk (COSO principle 10). Control activities are chosen and developed to bring risks to objectives down to acceptable levels. Points of focus: control activities carry out the risk responses from the risk assessment; the environment, complexity and scope of operations shape the choice; the business processes that need controls are determined; a mix of manual and automated, preventive and detective controls is used; controls are applied at appropriate levels; and incompatible duties are segregated, or alternative controls are designed where segregation is impractical.
Reviewed and closest counterparts in the other frameworks
Reviewed rows come from a released pair; a closest match is the nearest held text and is not a reviewed row.
HIPAA Security Rule
- 164.306 Security Standards: General Rules (closest match)
- 164.308(a)(1)(i) Security Management Process (Standard) (closest match)
- 164.308(a)(1)(ii)(B) Risk Management (Required) (closest match)
- 164.308(a)(1)(ii)(C) Sanction Policy (Required) (closest match)
- 164.308(a)(3)(ii)(A) Authorization and Supervision (Addressable) (closest match)
- 164.308(a)(5)(i) Security Awareness and Training (Standard) (closest match)
- 164.308(a)(7)(ii)(E) Applications and Data Criticality Analysis (Addressable) (closest match)
- 164.310(d)(2)(iv) Data Backup and Storage (Addressable) (closest match)
NIST SP 800-53 Rev 5
- NIST800-AC-3 AC-3 Access Enforcement (closest match)
- NIST800-AC-5 AC-5 Separation of Duties (closest match)
- NIST800-AC-6 AC-6 Least Privilege (closest match)
- NIST800-AC-24 AC-24 Access Control Decisions (closest match)
- NIST800-IA-2 IA-2 Identification and Authentication (Organizational Users) (closest match)
- NIST800-PL-8 PL-8 Security and Privacy Architectures (closest match)
- NIST800-PM-1 PM-1 Information Security Program Plan (closest match)
- NIST800-PM-3 PM-3 Information Security and Privacy Resources (closest match)
What an auditor commonly asks for
General guidance for this control area (domain: CC - Common Criteria (Security)), in our words, not a statement of the standard and not binding on an assessor.
- the board or management oversight record
- the risk assessment and its treatment
- the access-review and change-approval records
- the monitoring, logging and incident records