CC1.3
CC1.3
Establishes structure, authority, and responsibility
Management establishes, with board oversight, structures, reporting lines, and appropriate authorities and responsibilities in the pursuit of objectives. (COSO Principle 3)
Category
Security
Subcategory
Control Environment
Points of Focus
Considers All Structures of the Entity
Management and the board of directors consider the multiple structures used (including operating units, legal entities, geographic distribution, and outsourced service providers) to support the achievement of objectives.
Establishes Reporting Lines
Management designs and evaluates lines of reporting for each entity structure to enable execution of authorities and responsibilities and flow of information to manage the activities of the entity.
Defines, Assigns, and Limits Authorities and Responsibilities
Management and the board of directors delegate authority, define responsibilities, and use appropriate processes and technology to assign responsibility and segregate duties as necessary at the various levels of the organization.
Addresses Specific Requirements When Defining Authorities and Responsibilities
Management and the board of directors consider requirements relevant to security, availability, processing integrity, confidentiality, and privacy when defining authorities and responsibilities.
Considers Interactions With External Parties When Establishing Structures, Reporting Lines, Authorities, and Responsibilities
Management and the board of directors consider the need for the entity to interact with and monitor the activities of external parties when establishing structures, reporting lines, authorities, and responsibilities.
Establishes Structures, Reporting Lines, and Authorities to Support Compliance With Legal and Contractual Privacy Requirements
When establishing structures, reporting lines, and authorities, management considers legal and contractual privacy requirements and objectives.
Evidence Requests
| Area of Focus | Artifact | Description |
|---|---|---|
| Human Resources | Position Categorization | Documented evidence of a discrete roles for cybersecurity & data privacy functions (e.g., position categorization). |
| Human Resources | Role Assignment - Chief Information Security Officer (CISO) | Documented evidence of a formal role assignment to the CISO position. |
| Human Resources | Role Assignment - COO | Documented evidence of a formal role assignment to the Chief Operations Officer (COO) position. |
| Human Resources | Role Assignment - CIO | Documented evidence of a formal role assignment to the Chief Information Officer (CIO) position. |
| Human Resources | Role Assignment - Chief Privacy Officer (CPO) | Documented evidence of a formal role assignment to the CPO position. |
| Human Resources | Role Assignment - Chief Risk Officer (CRO) | Documented evidence of a formal role assignment to the CRO position. |
| Human Resources | Role Assignment - Data Protection Officer (DPO) | Documented evidence of a formal role assignment to DPO positions. |
| Human Resources | Defined Cybersecurity & Data Privacy Responsibilities | Documented evidence of a role-based cybersecurity & data privacy responsibilities to ensure personnel are both educated on the role and are responsible for the associated control execution. |
| Human Resources | Organization Chart | Current and accurate organization chart that depicts logical staff hierarchies. |
| Human Resources | Assigned Roles - Application Developers | List of employed or contract personnel assigned to application development roles. |
| Human Resources | Assigned Roles - Cybersecurity Staff | List of employed or contract personnel assigned to cybersecurity roles. |
| Human Resources | Assigned Roles - Data Privacy Staff | List of employed or contract personnel assigned to data privacy roles. |
| Human Resources | Role Assignment - Sensitive / Regulated Data | Documented evidence of a formal role assignment to personnel who are cleared to handle sensitive/regulated data. |
| Human Resources | Provisioning Checklist (Onboarding) | Documented evidence of personnel management practices to formally onboard personnel into their assigned roles. |
| Human Resources | Rules of Behavior | Documented evidence of personnel management practices to define "acceptable use" or "rules of behavior" criteria that specify acceptable and unacceptable user behaviors. |
| Human Resources | Authorized Personnel Access List | Documented evidence of an authorized personnel access list. |
| Human Resources | Position Competency Requirements | Documented evidence of personnel management practices to define minimum competency requirements for cybersecurity & data privacy-related roles. |
| Human Resources | Critical Cybersecurity & Data Privacy Skills | Documented evidence of personnel management practices to formally identify critical cybersecurity skills needed to support business operations. |
| Resource Management | Secure Development Lifecycle (SDLC) | Documented evidence of a secure development lifecycle that the organization utilizes for new initiatives or significant changes to existing initiatives to ensure cybersecurity & data privacy principles are identified and implemented by default. |
Policies
- Information Security Management Standard - Overarching policy defining the organization's approach to information security
Example Organization Controls
- CC1.3.1 - Organizational charts are in place to communicate the defined key areas of authority, responsibility, and lines of reporting to personnel.
- CC1.3.2 - Documented position descriptions are in place to define the skills, responsibilities, and knowledge levels required for particular jobs.
- CC1.3.3 - Senior management has assigned authorities for defining and implementing security policies to the designated security leadership.
- CC1.3.4 - Leadership planning meetings are held on a quarterly basis to review audit plans and business operations.
Example Control Objectives
- Control environment integrity - The organization demonstrates commitment to integrity and ethical values through documented policies, procedures, and accountability measures.
Example Evidence
- Information Security Roles and Responsibilities Matrix - Documented assignment of security policy definition and implementation authorities to designated security leadership
- Quarterly Leadership Meeting Minutes - Minutes from quarterly leadership planning meetings covering audit plans and business operations review
- Organizational Chart - Current organizational chart showing defined areas of authority, responsibility, and reporting lines
- Position Description Samples - Documented position descriptions defining skills, responsibilities, and knowledge levels for key roles