CC2.3
Points of Focus
Communicates to External Parties
Processes are in place to communicate relevant and timely information to external parties, including shareholders, partners, owners, regulators, customers, financial analysts, and other external parties.
Enables Inbound Communications
Open communication channels allow input from customers, consumers, suppliers, external auditors, regulators, financial analysts, and others, providing management and the board of directors with relevant information.
Communicates With the Board of Directors
Relevant information resulting from assessments conducted by external parties is communicated to the board of directors.
Provides Separate Communication Lines
Separate communication channels, such as whistle-blower hotlines, are in place and serve as fail-safe mechanisms to enable anonymous or confidential communication when normal channels are inoperative or ineffective.
Selects Relevant Method of Communication
The method of communication considers the timing, audience, and nature of the communication and legal, regulatory, and fiduciary requirements and expectations.
Communicates Objectives Related to Confidentiality and Changes to Those Objectives
(For Trust Service Criteria for CONFIDENTIALITY) The entity communicates, to external users, vendors, business partners, and others whose products andor services, or both, are part of the system, objectives and changes to the entity's objectives related to confidentiality and the protection of confidential information, as well as changes to those objectives.
Communicates Objectives Related to Privacy and Changes to Those Objectives
(For Trust Service Criteria for PRIVACY) The entity communicates, to external users, vendors, business partners, and others whose products andor services, or both, are part of the system, the entity's objectives related to privacy and the protection of personal information, as well as changes to those objectives.
Communicates Incident Reporting Methods
(For Trust Service Criteria for PRIVACY) The entity communicates to user entities, third parties, data subjects, and others the process used to report a suspected privacy incident.
Communicates Information About System Operation and Boundaries
(At system level) The entity prepares and communicates information about the design and operation of the system and its boundaries to authorized external users to permit users to understand their role in the system and the results of system operation.
Communicates System Objectives
(At system level) The entity communicates its system objectives to appropriate external users.
Communicates System Responsibilities
(At system level) External users with responsibility for designing, developing, implementing, operating, maintaining, and monitoring system controls receive information about such responsibilities and have the information necessary to carry out such responsibilities.
Communicates Information on Reporting System Failures, Incidents, Concerns, and Other Matters
(At system level) External users are provided with information on how to report systems failures, incidents, concerns, and other complaints to appropriate entity personnel.
Evidence Requests
| Area of Focus | Artifact | Description |
|---|---|---|
| Compliance | Statutory, Regulatory & Contractual Obligations | Documented evidence of applicable statutory, regulatory and/or contractual obligations for cybersecurity & data privacy controls. |
| Cybersecurity & Data Protection Management | Cybersecurity & Data Protection Controls | Documented evidence of an appropriately-scoped cybersecurity & data protection controls. Controls are technical, administrative or physical safeguards. Controls are the nexus used to manage risks through preventing, detecting or lessening the ability of a particular threat from negatively impacting business processes. Controls directly map to standards, since control testing is designed to measure specific aspects of how standards are actually implemented. |
| Compliance | Control Assessments | Documented evidence of internal or third-party control assessments to provide governance oversight of cybersecurity & data privacy controls. |
| Compliance | Non-Compliance Oversight Reporting | Documented evidence of governance oversight reporting of non-compliance to the organization's executive leadership. |
| Cybersecurity & Data Protection Management | Charter - Data Privacy Steering Committee | Documented evidence of an executive steering committee, or advisory board, that is formed to perform oversight of privacy management decisions and is comprised of key cybersecurity, technology, risk, privacy and business executives. |
| Cybersecurity & Data Protection Management | Charter - Audit Committee | Documented evidence of an executive steering committee, or advisory board, that is formed to perform oversight of internal and external audit management decisions and is comprised of key cybersecurity, technology, risk, privacy and business executives. |
| Cybersecurity & Data Protection Management | Charter - Risk Committee | Documented evidence of an executive steering committee, or advisory board, that is formed to perform oversight of risk management decisions and is comprised of key cybersecurity, technology, risk, privacy and business executives. |
| Cybersecurity & Data Protection Management | Measures of Performance (Metrics) | Documented evidence of formal measure of performance that are used to track the health of the cybersecurity & data protection program (e.g., metrics, KPIs, KRIs). |
| Risk Management | Plan of Actions & Milestones (POA&M) / Risk Register | Documented evidence of a POA&M, or risk register, that tracks control deficiencies from identification through remediation. |
| Threat Management | Industry Associations / Memberships | Documented evidence of industry associations the organization utilizes to maintain situational awareness of evolving threats and trends. |
| Incident Response | Incident Response Program (IRP) | Documented evidence of a Incident Response Plan (IRP). This is program-level documentation in the form of a runbook, playbook or a similar format provides guidance on organizational practices that support existing policies and standards. |
| Incident Response | Incident Reporting Capability | Documented evidence of a capability to provide situational awareness of incidents to internal stakeholders and generated necessary reporting to affected clients, applicable third-parties and regulatory authorities. |
Example Organization Controls
- CC2.3.1 - Digital subscriber agreement and customer self-registration process includes required agreement acknowledgment.
- CC2.3.2 - The customer portal is configured to allow customers to report problems, issues, and incidents.
Example Control Objectives
- Information and communication quality - Relevant information is identified, captured, and communicated to internal and external parties to support the functioning of internal controls.
Example Evidence
- Customer Support Portal Configuration - Screenshots of the customer portal showing customers can submit support requests and report problems, issues, and incidents
- Customer Registration Agreement Acknowledgment - Self-registration flow showing required acknowledgment of the digital subscriber agreement before account activation