CC1.4
Points of Focus
Establishes Policies and Practices
Policies and practices reflect expectations of competence necessary to support the achievement of objectives.
Evaluates Competence and Addresses Shortcomings
The board of directors and management evaluate competence across the entity and in outsourced service providers in relation to established policies and practices and act as necessary to address shortcomings.
Attracts, Develops, and Retains Individuals
The entity provides the mentoring and training needed to attract, develop, and retain sufficient and competent personnel and outsourced service providers to support the achievement of objectives.
Plans and Prepares for Succession
Senior management and the board of directors develop contingency plans for assignments of responsibility important for internal control.
Considers the Background of Individuals
The entity considers the background of potential and existing personnel, contractors, and vendor employees when determining whether to employ and retain the individuals.
Considers the Technical Competency of Individuals
The entity considers the technical competency of potential and existing personnel, contractors, and vendor employees when determining whether to employ and retain the individuals.
Provides Training to Maintain Technical Competencies
The entity provides training programs, including continuing education and training, to ensure skill sets and technical competency of existing personnel, contractors, and vendor employees are developed and maintained.
Evidence Requests
| Area of Focus | Artifact | Description |
|---|---|---|
| Human Resources | Position Categorization | Documented evidence of a discrete roles for cybersecurity & data privacy functions (e.g., position categorization). |
| Human Resources | Organization Chart | Current and accurate organization chart that depicts logical staff hierarchies. |
| Human Resources | Personnel Sanctions | Documented evidence of personnel management practices to formally sanction unacceptable behavior(s). |
| Resource Management | Portfolio Roadmap | Documented evidence of the organization's roadmap for implementing cybersecurity-related initiatives and technologies. |
| Resource Management | Cybersecurity Business Plan (CBP) | Documented evidence of a cybersecurity-specific business plan that documents a strategic plan and discrete objectives. |
| Education | Initial User Training | Documented evidence of initial user training for cybersecurity and/ord ata privacy topics. |
| Education | Recurring User Training | Documented evidence of recurring (e.g., annual) user training for cybersecurity and/or data privacy topics. |
| Education | Role-Based Training | Documented evidence of specialized user training for privileged users, executives, individuals who handle sensitive/regulated data, etc. |
| Education | Continuing Professional Education (CPE) | Documented evidence of Continuing Professional Education (CPE) requirements for cybersecurity & data privacy personnel. |
Policies
- Human Resource Policy - Defines security requirements related to human resources management
- Training and Awareness Procedure - Defines requirements for security awareness and training programs
Example Organization Controls
- CC1.4.1 - New employee hiring procedures are in place to guide the hiring process and include verification that candidates possess the required qualifications to perform the duties as outlined in the job description.
- CC1.4.2 - Training courses are available to new and existing employees to maintain and advance the skill level of personnel.
- CC1.4.3 - Employees are required to complete new hire security awareness training and annual security awareness training thereafter to understand their obligations and responsibilities to comply with security policies.
- CC1.4.4 - Management conducts a performance review of employees on an annual basis to evaluate individual performance against expected levels of performance and conduct.
Example Control Objectives
- Control environment integrity - The organization demonstrates commitment to integrity and ethical values through documented policies, procedures, and accountability measures.
Example Evidence
- Current Employee Roster - Listing of current employees with hire dates and job titles