SOC2-CC9.1 CC9.1 Mitigating risks of business disruption
SOC2-CC9.1 in SOC 2 (the AICPA 2017 Trust Services Criteria with the revised points of focus). All SOC 2 controls held. Open SOC 2 on the standards site.
The control as we hold it
CC9.1 Mitigating risks of business disruption. Measures to reduce the risk of business disruption are identified, selected and developed. Points of focus: policies, procedures, communication plans and fallback processing are prepared in advance so the organisation can respond, limit the damage and recover from disruptive security events, with monitoring and information flows to meet objectives during those efforts; and insurance is considered to cover the financial cost of loss events.
Reviewed and closest counterparts in the other frameworks
Reviewed rows come from a released pair; a closest match is the nearest held text and is not a reviewed row.
HIPAA Security Rule
- 164.306 Security Standards: General Rules (closest match)
- 164.308(a)(1)(ii)(B) Risk Management (Required) (closest match)
- 164.308(a)(7)(i) Contingency Plan (Standard) (closest match)
- 164.308(a)(7)(ii)(C) Emergency Mode Operation Plan (Required) (closest match)
- 164.308(a)(7)(ii)(E) Applications and Data Criticality Analysis (Addressable) (closest match)
- 164.310(a)(2)(i) Contingency Operations (Addressable) (closest match)
- 164.312(a)(2)(ii) Emergency Access Procedure (Required) (closest match)
NIST SP 800-53 Rev 5
- NIST800-CP-2 CP-2 Contingency Plan (closest match)
- NIST800-CP-3 CP-3 Contingency Training (closest match)
- NIST800-CP-4 CP-4 Contingency Plan Testing (closest match)
- NIST800-CP-6 CP-6 Alternate Storage Site (closest match)
- NIST800-CP-7 CP-7 Alternate Processing Site (closest match)
- NIST800-IR-8 IR-8 Incident Response Plan (closest match)
- NIST800-PL-1 PL-1 Policy and Procedures (closest match)
- NIST800-PM-4 PM-4 Plan of Action and Milestones Process (closest match)
What an auditor commonly asks for
General guidance for this control area (domain: CC - Common Criteria (Security)), in our words, not a statement of the standard and not binding on an assessor.
- the board or management oversight record
- the risk assessment and its treatment
- the access-review and change-approval records
- the monitoring, logging and incident records