CC1.2
CC1.2
Exercises oversight responsibility
The board of directors demonstrates independence from management and exercises oversight of the development and performance of internal control. (COSO Principle 2)
Category
Security
Subcategory
Control Environment
Points of Focus
Establishes Oversight Responsibilities
The board of directors identifies and accepts its oversight responsibilities in relation to established requirements and expectations.
Applies Relevant Expertise
The board of directors defines, maintains, and periodically evaluates the skills and expertise needed among its members to enable them to ask probing questions of senior management and take commensurate action.
Operates Independently
The board of directors has sufficient members who are independent from management and objective in evaluations and decision making.
Supplements Board Expertise
The board of directors supplements its expertise relevant to security, availability, processing integrity, confidentiality, and privacy, as needed, through the use of a subcommittee or consultants.
Evidence Requests
| Area of Focus | Artifact | Description |
|---|---|---|
| Cybersecurity & Data Protection Management | Charter - Cybersecurity Program | Documented evidence of a charter to establish and resource the organization's cybersecurity program. |
| Cybersecurity & Data Protection Management | Charter - Data Privacy Program | Documented evidence of a charter to establish and resource the organization's data privacy program. |
| Cybersecurity & Data Protection Management | Charter - Cybersecurity Steering Committee | Documented evidence of an executive steering committee, or advisory board, that is formed to perform oversight of cybersecurity management decisions and is comprised of key cybersecurity, technology, risk, privacy and business executives. |
| Cybersecurity & Data Protection Management | Measures of Performance (Metrics) | Documented evidence of formal measure of performance that are used to track the health of the cybersecurity & data protection program (e.g., metrics, KPIs, KRIs). |
| Human Resources | Position Categorization | Documented evidence of a discrete roles for cybersecurity & data privacy functions (e.g., position categorization). |
| Human Resources | Assigned Roles - Application Developers | List of employed or contract personnel assigned to application development roles. |
| Human Resources | Assigned Roles - Cybersecurity Staff | List of employed or contract personnel assigned to cybersecurity roles. |
| Human Resources | Assigned Roles - Data Privacy Staff | List of employed or contract personnel assigned to data privacy roles. |
| Human Resources | Role Assignment - Sensitive / Regulated Data | Documented evidence of a formal role assignment to personnel who are cleared to handle sensitive/regulated data. |
| Human Resources | Rules of Behavior | Documented evidence of personnel management practices to define "acceptable use" or "rules of behavior" criteria that specify acceptable and unacceptable user behaviors. |
| Human Resources | Defined Cybersecurity & Data Privacy Responsibilities | Documented evidence of a role-based cybersecurity & data privacy responsibilities to ensure personnel are both educated on the role and are responsible for the associated control execution. |
| Human Resources | Provisioning Checklist (Onboarding) | Documented evidence of personnel management practices to formally onboard personnel into their assigned roles. |
| Human Resources | Authorized Personnel Access List | Documented evidence of an authorized personnel access list. |
| Human Resources | Position Competency Requirements | Documented evidence of personnel management practices to define minimum competency requirements for cybersecurity & data privacy-related roles. |
| Human Resources | Critical Cybersecurity & Data Privacy Skills | Documented evidence of personnel management practices to formally identify critical cybersecurity skills needed to support business operations. |
Policies
- Information Security Management Standard - Overarching policy defining the organization's approach to information security
Example Organization Controls
- CC1.2.1 - Senior management has assigned authorities for defining and implementing security policies to the designated security leadership.
- CC1.2.2 - Leadership planning meetings are held on a quarterly basis to review audit plans and business operations.
Example Control Objectives
- Control environment integrity - The organization demonstrates commitment to integrity and ethical values through documented policies, procedures, and accountability measures.
Example Evidence
- Information Security Roles and Responsibilities Matrix - Documented assignment of security policy definition and implementation authorities to designated security leadership
- Quarterly Leadership Meeting Minutes - Minutes from quarterly leadership planning meetings covering audit plans and business operations review