CC2.2
Points of Focus
Communicates Internal Control Information
A process is in place to communicate required information to enable all personnel to understand and carry out their internal control responsibilities.
Communicates With the Board of Directors
Communication exists between management and the board of directors so that both have information needed to fulfill their roles with respect to the entity's objectives.
Provides Separate Communication Lines
Separate communication channels, such as whistle-blower hotlines, are in place and serve as fail-safe mechanisms to enable anonymous or confidential communication when normal channels are inoperative or ineffective.
Selects Relevant Method of Communication
The method of communication considers the timing, audience, and nature of the information.
Communicates Responsibilities
Entity personnel with responsibility for designing, developing, implementing, operating, maintaining, or monitoring system controls receive communications about their responsibilities, including changes in their responsibilities, and have the information necessary to carry out those responsibilities.
Communicates Information on Reporting Failures, Incidents, Concerns, and Other Matters
Entity personnel are provided with information on how to report systems failures, incidents, concerns, and other complaints to personnel.
Communicates Objectives and Changes to Objectives
The entity communicates its objectives and changes to those objectives to personnel in a timely manner.
Communicates Information to Improve Security Knowledge and Awareness
The entity communicates information to improve security knowledge and awareness and to model appropriate security behaviors to personnel through a security awareness training program.
Communicates Information About System Operation and Boundaries
(At system level) The entity prepares and communicates information about the design and operation of the system and its boundaries to authorized personnel to enable them to understand their role in the system and the results of system operation.
Communicates System Objectives
(At system level) The entity communicates its objectives to personnel to enable them to carry out their responsibilities.
Communicates System Changes
(At system level) System changes that affect responsibilities or the achievement of the entity’s objectives are communicated in a timely manner.
Communicates Information to Improve Privacy Knowledge and Awareness
The entity communicates information to improve privacy knowledge and awareness and to model appropriate behaviors to personnel through a privacy awareness training program.
Communicates Incident Reporting Methods
The entity has communicated to employees and others within the entity the process used to report a suspected privacy incident.
Evidence Requests
| Area of Focus | Artifact | Description |
|---|---|---|
| Compliance | Statutory, Regulatory & Contractual Obligations | Documented evidence of applicable statutory, regulatory and/or contractual obligations for cybersecurity & data privacy controls. |
| Cybersecurity & Data Protection Management | Cybersecurity & Data Protection Controls | Documented evidence of an appropriately-scoped cybersecurity & data protection controls. Controls are technical, administrative or physical safeguards. Controls are the nexus used to manage risks through preventing, detecting or lessening the ability of a particular threat from negatively impacting business processes. Controls directly map to standards, since control testing is designed to measure specific aspects of how standards are actually implemented. |
| Compliance | Control Assessments | Documented evidence of internal or third-party control assessments to provide governance oversight of cybersecurity & data privacy controls. |
| Compliance | Non-Compliance Oversight Reporting | Documented evidence of governance oversight reporting of non-compliance to the organization's executive leadership. |
| Cybersecurity & Data Protection Management | Charter - Data Privacy Steering Committee | Documented evidence of an executive steering committee, or advisory board, that is formed to perform oversight of privacy management decisions and is comprised of key cybersecurity, technology, risk, privacy and business executives. |
| Cybersecurity & Data Protection Management | Charter - Audit Committee | Documented evidence of an executive steering committee, or advisory board, that is formed to perform oversight of internal and external audit management decisions and is comprised of key cybersecurity, technology, risk, privacy and business executives. |
| Cybersecurity & Data Protection Management | Charter - Risk Committee | Documented evidence of an executive steering committee, or advisory board, that is formed to perform oversight of risk management decisions and is comprised of key cybersecurity, technology, risk, privacy and business executives. |
| Cybersecurity & Data Protection Management | Measures of Performance (Metrics) | Documented evidence of formal measure of performance that are used to track the health of the cybersecurity & data protection program (e.g., metrics, KPIs, KRIs). |
| Risk Management | Plan of Actions & Milestones (POA&M) / Risk Register | Documented evidence of a POA&M, or risk register, that tracks control deficiencies from identification through remediation. |
| Human Resources | Position Categorization | Documented evidence of a discrete roles for cybersecurity & data privacy functions (e.g., position categorization). |
| Human Resources | Assigned Roles - Application Developers | List of employed or contract personnel assigned to application development roles. |
| Human Resources | Assigned Roles - Cybersecurity Staff | List of employed or contract personnel assigned to cybersecurity roles. |
| Human Resources | Assigned Roles - Data Privacy Staff | List of employed or contract personnel assigned to data privacy roles. |
| Human Resources | Role Assignment - Sensitive / Regulated Data | Documented evidence of a formal role assignment to personnel who are cleared to handle sensitive/regulated data. |
| Human Resources | Defined Cybersecurity & Data Privacy Responsibilities | Documented evidence of a role-based cybersecurity & data privacy responsibilities to ensure personnel are both educated on the role and are responsible for the associated control execution. |
| Human Resources | Provisioning Checklist (Onboarding) | Documented evidence of personnel management practices to formally onboard personnel into their assigned roles. |
| Human Resources | Rules of Behavior | Documented evidence of personnel management practices to define "acceptable use" or "rules of behavior" criteria that specify acceptable and unacceptable user behaviors. |
| Human Resources | Authorized Personnel Access List | Documented evidence of an authorized personnel access list. |
| Resource Management | Portfolio Roadmap | Documented evidence of the organization's roadmap for implementing cybersecurity-related initiatives and technologies. |
| Resource Management | Secure Development Lifecycle (SDLC) | Documented evidence of a secure development lifecycle that the organization utilizes for new initiatives or significant changes to existing initiatives to ensure cybersecurity & data privacy principles are identified and implemented by default. |
| Technology Design & Acquisition | Secure Software Development Principles (SSDP) | Documented evidence of a Secure Software Development Principles (SSDP). This is program-level documentation in the form of a runbook, playbook or a similar format provides guidance on organizational practices that support existing policies and standards. |
| Technology Design & Acquisition | Secure Engineering & Data Privacy (SEDP) | Documented evidence of a Secure Engineering & Data Privacy (SEDP) program. This is program-level documentation in the form of a runbook, playbook or a similar format provides guidance on organizational practices that support existing policies and standards. |
| Technology Design & Acquisition | Design and Development Plan (DDP) | Documented evidence of an engineering method to control the design process and govern the lifecycle of the product/service. |
| Technology Design & Acquisition | Secure Engineering Principles (SEP) | Documented evidence of defined secure engineering principles used to ensure Sensitivity, Integrity, Availability & Safety (CIAS) concerns are properly addressed in the design and implementation of systems, applications and services. |
| Technology Design & Acquisition | Security Architecture View | Documented evidence that identifies security-relevant system elements and their interfaces: • Define security context, domains, boundaries, and external interfaces of the system; • Align the architecture with (a) the system security objectives and requirements, (b) security design characteristics; and • Establish traceability of architecture elements to user and system security requirements. |
| Human Resources | Organization Chart | Current and accurate organization chart that depicts logical staff hierarchies. |
| Human Resources | Personnel Sanctions | Documented evidence of personnel management practices to formally sanction unacceptable behavior(s). |
| Cybersecurity & Data Protection Management | Cybersecurity & Data Protection Procedures | Documented evidence of an appropriate appropriately-scoped cybersecurity & data protection procedures. Procedures are a documented set of steps necessary to perform a specific task or process in conformance with an applicable standard. Procedures help address the question of how the organization actually operationalizes a policy, standard or control. The result of a procedure is intended to satisfy a specific control. Procedures are also commonly referred to as “control activities.” |
Policies
- Training and Awareness Procedure - Defines requirements for security awareness and training programs
Example Organization Controls
- CC2.2.1 - Information security policies are documented and made available to personnel through Notion.
Example Control Objectives
- Information and communication quality - Relevant information is identified, captured, and communicated to internal and external parties to support the functioning of internal controls.
Example Evidence
- Notion Policy Library - Screenshot of the policy library in Notion demonstrating policies are documented and available to all personnel