CC1.1
CC1.1
Demonstrates commitment to integrity and ethical values
The entity demonstrates a commitment to integrity and ethical values (COSO Principle 1)
Category
Security
Subcategory
Control Environment
Points of Focus
Sets the Tone at the Top
The board of directors and management, at all levels, demonstrate through their directives, actions, and behavior the importance of integrity and ethical values to support the functioning of the system of internal control.
Establishes Standards of Conduct
The expectations of the board of directors and senior management concerning integrity and ethical values are defined in the entity's standards of conduct and understood at all levels of the entity and by outsourced service providers and business partners.
Evaluates Adherence to Standards of Conduct
Processes are in place to evaluate the performance of individuals and teams against the entity's expected standards of conduct.
Addresses Deviations in a Timely Manner
Deviations from the entity's expected standards of conduct are identified and remedied in a timely and consistent manner.
Considers Contractors and Vendor Employees in Demonstrating Its Commitment
Management and the board of directors consider the use of contractors and vendor employees in its processes for establishing standards of conduct, evaluating adherence to those standards, and addressing deviations in a timely manner.
Establishes Structures, Reporting Lines, and Authorities to Support Compliance With Legal and Contractual Privacy Requirements
When establishing structures, reporting lines, and authorities, management considers legal and contractual privacy requirements and objectives.
Evidence Requests
| Area of Focus | Artifact | Description |
|---|---|---|
| Compliance | Control Assessments | Documented evidence of internal or third-party control assessments to provide governance oversight of cybersecurity & data privacy controls. |
| Compliance | Non-Compliance Oversight Reporting | Documented evidence of governance oversight reporting of non-compliance to the organization's executive leadership. |
| Cybersecurity & Data Protection Management | Charter - Data Privacy Steering Committee | Documented evidence of an executive steering committee, or advisory board, that is formed to perform oversight of privacy management decisions and is comprised of key cybersecurity, technology, risk, privacy and business executives. |
| Cybersecurity & Data Protection Management | Charter - Audit Committee | Documented evidence of an executive steering committee, or advisory board, that is formed to perform oversight of internal and external audit management decisions and is comprised of key cybersecurity, technology, risk, privacy and business executives. |
| Cybersecurity & Data Protection Management | Charter - Risk Committee | Documented evidence of an executive steering committee, or advisory board, that is formed to perform oversight of risk management decisions and is comprised of key cybersecurity, technology, risk, privacy and business executives. |
| Cybersecurity & Data Protection Management | Measures of Performance (Metrics) | Documented evidence of formal measure of performance that are used to track the health of the cybersecurity & data protection program (e.g., metrics, KPIs, KRIs). |
| Risk Management | Plan of Actions & Milestones (POA&M) / Risk Register | Documented evidence of a POA&M, or risk register, that tracks control deficiencies from identification through remediation. |
| Cybersecurity & Data Protection Management | Charter - Cybersecurity Program | Documented evidence of a charter to establish and resource the organization's cybersecurity program. |
| Cybersecurity & Data Protection Management | Charter - Data Privacy Program | Documented evidence of a charter to establish and resource the organization's data privacy program. |
| Human Resources | Position Categorization | Documented evidence of a discrete roles for cybersecurity & data privacy functions (e.g., position categorization). |
| Human Resources | Role Assignment - Chief Information Security Officer (CISO) | Documented evidence of a formal role assignment to the CISO position. |
| Human Resources | Role Assignment - COO | Documented evidence of a formal role assignment to the Chief Operations Officer (COO) position. |
| Human Resources | Role Assignment - CIO | Documented evidence of a formal role assignment to the Chief Information Officer (CIO) position. |
| Human Resources | Role Assignment - Chief Privacy Officer (CPO) | Documented evidence of a formal role assignment to the CPO position. |
| Human Resources | Role Assignment - Chief Risk Officer (CRO) | Documented evidence of a formal role assignment to the CRO position. |
| Human Resources | Role Assignment - Data Protection Officer (DPO) | Documented evidence of a formal role assignment to DPO positions. |
| Human Resources | Defined Cybersecurity & Data Privacy Responsibilities | Documented evidence of a role-based cybersecurity & data privacy responsibilities to ensure personnel are both educated on the role and are responsible for the associated control execution. |
| Human Resources | Organization Chart | Current and accurate organization chart that depicts logical staff hierarchies. |
| Human Resources | Personnel Sanctions | Documented evidence of personnel management practices to formally sanction unacceptable behavior(s). |
| Human Resources | Rules of Behavior | Documented evidence of personnel management practices to define "acceptable use" or "rules of behavior" criteria that specify acceptable and unacceptable user behaviors. |
| Data Protection | Authorized Users To Post Publicly Accessible Content | Documented evidence of list of users authorized to post publicly accessible content on organizational systems. |
Policies
- Information Security Management Standard - Overarching policy defining the organization's approach to information security
Example Organization Controls
- CC1.1.1 - A code of conduct is included within the employee handbook to communicate company values and behavioral standards to personnel.
- CC1.1.2 - Employees complete an acknowledgment form upon hire indicating that they have been given access to the employee manual and understand their responsibility for adhering to the code of conduct outlined within the manual.
- CC1.1.3 - New hires are required to complete an acknowledgment form upon hire consenting to not disclose confidential or proprietary client and company information to unauthorized parties.
- CC1.1.4 - Background checks are performed for employees as a component of the hiring process.
Example Control Objectives
- Control environment integrity - The organization demonstrates commitment to integrity and ethical values through documented policies, procedures, and accountability measures.
Example Evidence
- Current Employee Roster - Listing of current employees with hire dates and job titles