PI1.4

PI1.4

The entity implements policies and procedures to make available or deliver output completely, accurately, and timely in accordance with specifications to meet the entity’s objectives.

Category

Processing Integrity

Subcategory

Additional Criteria for Processing Integrity

Points of Focus

Protects Output

Output is protected when stored or delivered, or both, to prevent theft, destruction, corruption, or deterioration that would prevent output from meeting specifications.

Distributes Output Only to Intended Parties

Output is distributed or made available only to intended parties.

Distributes Output Completely and Accurately

Procedures are in place to provide for the completeness, accuracy, and timeliness of distributed output.

Creates and Maintains Records of System Output Activities

Records of system output activities are created and maintained completely and accurately in a timely manner.

Evidence Requests

Area of Focus	Artifact	Description
Asset Management	IT Asset Management (ITAM)	Documented evidence of an IT Asset Management (ITAM) program that addresses the due diligence and due care activities associated with maintaining both secure and compliant systems, applications and services.
Compliance	Statutory, Regulatory & Contractual Obligations	Documented evidence of applicable statutory, regulatory and/or contractual obligations for cybersecurity & data privacy controls.
Technology Design & Acquisition	Secure Engineering Principles (SEP)	Documented evidence of defined secure engineering principles used to ensure Sensitivity, Integrity, Availability & Safety (CIAS) concerns are properly addressed in the design and implementation of systems, applications and services.
Technology Design & Acquisition	Software Assurance Maturity Model (SAMM)	Documented evidence of a Software Assurance Maturity Model (SAMM).