CC1.5
Points of Focus
Enforces Accountability Through Structures, Authorities, and Responsibilities
Management and the board of directors establish the mechanisms to communicate and hold individuals accountable for performance of internal control responsibilities across the entity and implement corrective action as necessary.
Establishes Performance Measures, Incentives, and Rewards
Management and the board of directors establish performance measures, incentives, and other rewards appropriate for responsibilities at all levels of the entity, reflecting appropriate dimensions of performance and expected standards of conduct, and considering the achievement of both short-term and longer-term objectives.
Evaluates Performance Measures, Incentives, and Rewards for Ongoing Relevance
Management and the board of directors align incentives and rewards with the fulfillment of internal control responsibilities in the achievement of objectives.
Considers Excessive Pressures
Management and the board of directors evaluate and adjust pressures associated with the achievement of objectives as they assign responsibilities, develop performance measures, and evaluate performance.
Evaluates Performance and Rewards or Disciplines Individuals
Management and the board of directors evaluate performance of internal control responsibilities, including adherence to standards of conduct and expected levels of competence, and provide rewards or exercise disciplinary action, as appropriate.
Takes Disciplinary Actions
A sanctions process is defined, and applied as needed, when an employee violates the entity's privacy policies or when an employee's negligent behavior causes a privacy incident.
Evidence Requests
| Area of Focus | Artifact | Description |
|---|---|---|
| Compliance | Statutory, Regulatory & Contractual Obligations | Documented evidence of applicable statutory, regulatory and/or contractual obligations for cybersecurity & data privacy controls. |
| Cybersecurity & Data Protection Management | Cybersecurity & Data Protection Controls | Documented evidence of an appropriately-scoped cybersecurity & data protection controls. Controls are technical, administrative or physical safeguards. Controls are the nexus used to manage risks through preventing, detecting or lessening the ability of a particular threat from negatively impacting business processes. Controls directly map to standards, since control testing is designed to measure specific aspects of how standards are actually implemented. |
| Compliance | Internal Audit (IA) Findings | Documented evidence of a centrally-managed and prioritized repository Internal Audit (IA) findings. |
| Cybersecurity & Data Protection Management | Measures of Performance (Metrics) | Documented evidence of formal measure of performance that are used to track the health of the cybersecurity & data protection program (e.g., metrics, KPIs, KRIs). |
| Human Resources | Position Competency Requirements | Documented evidence of personnel management practices to define minimum competency requirements for cybersecurity & data privacy-related roles. |
| Human Resources | Critical Cybersecurity & Data Privacy Skills | Documented evidence of personnel management practices to formally identify critical cybersecurity skills needed to support business operations. |
| Human Resources | Access Agreements | Documented evidence of personnel management practices protecting sensitive/regulated data through formal access agreements. |
| Human Resources | Non-Disclosure Agreements (NDAs) | Documented evidence of the use of Non-Disclosure Agreements (NDAs) that restricts unauthorized sharing of sensitive/regulated data. |
| Human Resources | Personnel Sanctions | Documented evidence of personnel management practices to formally sanction unacceptable behavior(s). |
| Human Resources | Personnel Actions Documentation | Documented evidence of notifications or records of recently transferred, separated, or terminated employees. |
| Human Resources | Deprovisioning Checklist (Offboarding) | Documented evidence of personnel management practices to formally offboard personnel from their assigned roles due to employment termination or role change. |
Policies
- Human Resource Policy - Defines security requirements related to human resources management
Example Organization Controls
- CC1.5.1 - Employee sanction policies are documented to communicate consequences for disciplinary actions, up to and including termination, for violations to company policies and the code of conduct.
- CC1.5.2 - A whistleblower protection policy and ethics hotline is in place for employees to anonymously report violations, complaints or concerns related to company policies and the code of conduct.
- CC1.5.3 - Management conducts a performance review of employees on an annual basis to evaluate individual performance against expected levels of performance and conduct.
- CC1.5.4 - Employees are required to complete new hire security awareness training and annual security awareness training thereafter.
- CC1.5.5 - Employees complete an acknowledgment form upon hire indicating that they have been given access to the employee manual and understand their responsibility for adhering to the code of conduct.
- CC1.5.6 - New hires are required to complete an acknowledgment form upon hire consenting to not disclose confidential or proprietary information to unauthorized parties.
Example Control Objectives
- Control environment integrity - The organization demonstrates commitment to integrity and ethical values through documented policies, procedures, and accountability measures.
Example Evidence
- Terminated Employees Report - Listing of employees terminated during audit period with access revocation evidence