SOC2-CC5.3 CC5.3 Deploying controls through policies and procedures (COSO principle 12)
SOC2-CC5.3 in SOC 2 (the AICPA 2017 Trust Services Criteria with the revised points of focus). All SOC 2 controls held. Open SOC 2 on the standards site.
The control as we hold it
CC5.3 Deploying controls through policies and procedures (COSO principle 12). Control activities are put into practice through policies that state expectations and procedures that carry them out. Points of focus: policies and procedures embed management's directives in daily work; responsibility and accountability sit with the managers of the unit where the risk lives; controls are performed on time; issues found while performing controls are investigated and acted on; competent people with enough authority perform them diligently; and policies and procedures are reviewed periodically and refreshed when needed.
Reviewed and closest counterparts in the other frameworks
Reviewed rows come from a released pair; a closest match is the nearest held text and is not a reviewed row.
HIPAA Security Rule
- 164.308(a)(1)(i) Security Management Process (Standard) (closest match)
- 164.308(a)(4)(ii)(B) Access Authorization (Addressable) (closest match)
- 164.308(a)(4)(ii)(C) Access Establishment and Modification (Addressable) (closest match)
- 164.310(b) Workstation Use (Standard) (closest match)
- 164.316(a) Policies and Procedures (Standard) (closest match)
- 164.316(b)(1) Documentation (Standard) (closest match)
- 164.316(b)(2)(ii) Availability (Documentation) (closest match)
- 164.316(b)(2)(iii) Updates (Documentation) (closest match)
NIST SP 800-53 Rev 5
- NIST800-AC-1 AC-1 Policy and Procedures (closest match)
- NIST800-AT-1 AT-1 Policy and Procedures (closest match)
- NIST800-AU-1 AU-1 Policy and Procedures (closest match)
- NIST800-CA-1 CA-1 Policy and Procedures (closest match)
- NIST800-CM-1 CM-1 Policy and Procedures (closest match)
- NIST800-CP-1 CP-1 Policy and Procedures (closest match)
- NIST800-IA-1 IA-1 Policy and Procedures (closest match)
- NIST800-IR-1 IR-1 Policy and Procedures (closest match)
What an auditor commonly asks for
General guidance for this control area (domain: CC - Common Criteria (Security)), in our words, not a statement of the standard and not binding on an assessor.
- the board or management oversight record
- the risk assessment and its treatment
- the access-review and change-approval records
- the monitoring, logging and incident records