SOC2-CC5.2 CC5.2 General controls over technology (COSO principle 11)
SOC2-CC5.2 in SOC 2 (the AICPA 2017 Trust Services Criteria with the revised points of focus). All SOC 2 controls held. Open SOC 2 on the standards site.
The control as we hold it
CC5.2 General controls over technology (COSO principle 11). General controls over technology are selected and developed to support objectives. Points of focus: management understands how business processes and automated controls depend on technology general controls; controls over infrastructure support complete, accurate and available processing; security management controls limit access rights to authorised users in line with their jobs and protect assets from external threats; and controls over acquisition, development and maintenance of technology support management's objectives.
Reviewed and closest counterparts in the other frameworks
Reviewed rows come from a released pair; a closest match is the nearest held text and is not a reviewed row.
HIPAA Security Rule
- 164.306 Security Standards: General Rules (closest match)
- 164.308(a)(1)(ii)(A) Risk Analysis (Required) (closest match)
- 164.308(a)(1)(ii)(D) Information System Activity Review (Required) (closest match)
- 164.308(a)(5)(ii)(B) Protection from Malicious Software (Addressable) (closest match)
- 164.308(a)(7)(i) Contingency Plan (Standard) (closest match)
- 164.308(a)(7)(ii)(A) Data Backup Plan (Required) (closest match)
- 164.312(a)(2)(iv) Encryption and Decryption (Addressable) (closest match)
- 164.312(b) Audit Controls (Standard) (closest match)
NIST SP 800-53 Rev 5
- NIST800-AC-2 AC-2 Account Management (closest match)
- NIST800-AC-18 AC-18 Wireless Access (closest match)
- NIST800-AC-21 AC-21 Information Sharing (closest match)
- NIST800-CM-2 CM-2 Baseline Configuration (closest match)
- NIST800-CM-3 CM-3 Configuration Change Control (closest match)
- NIST800-CM-5 CM-5 Access Restrictions for Change (closest match)
- NIST800-CM-6 CM-6 Configuration Settings (closest match)
- NIST800-CM-7 CM-7 Least Functionality (closest match)
What an auditor commonly asks for
General guidance for this control area (domain: CC - Common Criteria (Security)), in our words, not a statement of the standard and not binding on an assessor.
- the board or management oversight record
- the risk assessment and its treatment
- the access-review and change-approval records
- the monitoring, logging and incident records