CC3.1
Points of Focus
Reflects Management's Choices
Operations objectives reflect management's choices about structure, industry considerations, and performance of the entity.
Considers Tolerances for Risk
Management considers the acceptable levels of variation relative to the achievement of operations objectives.
Includes Operations and Financial Performance Goals
The organization reflects the desired level of operations and financial performance for the entity within operations objectives.
Forms a Basis for Committing of Resources
Management uses operations objectives as a basis for allocating resources needed to attain desired operations and financial performance. External Financial Reporting Objectives:
Complies With Applicable Accounting Standards
Financial reporting objectives are consistent with accounting principles suitable and available for that entity. The accounting principles selected are appropriate in the circumstances.
Considers Materiality
Management considers materiality in financial statement presentation.
Reflects Entity Activities
External reporting reflects the underlying transactions and events to show qualitative characteristics and assertions. External Nonfinancial Reporting Objectives:
Complies With Externally Established Frameworks
Management establishes objectives consistent with laws and regulations or standards and frameworks of recognized external organizations.
Considers the Required Level of Precision
Management reflects the required level of precision and accuracy suitable for user needs and based on criteria established by third parties in nonfinancial reporting.
Reflects Entity Activities
External reporting reflects the underlying transactions and events within a range of acceptable limits. Internal Reporting Objectives:
Reflects Management's Choices
Internal reporting provides management with accurate and complete information regarding management's choices and information needed in managing the entity.
Considers the Required Level of Precision
Management reflects the required level of precision and accuracy suitable for user needs in nonfinancial reporting objectives and materiality within financial reporting objectives.
Reflects Entity Activities
Internal reporting reflects the underlying transactions and events within a range of acceptable limits. Compliance Objectives:
Reflects External Laws and Regulations
Laws and regulations establish minimum standards of conduct, which the entity integrates into compliance objectives.
Considers Tolerances for Risk
Management considers the acceptable levels of variation relative to the achievement of operations objectives.
Establishes Sub-Objectives for Risk Management
Management identifies sub-objectives for use in risk assessment related to security, availability, processing integrity, confidentiality, or privacy to support the achievement of the entity's objectives.
Evidence Requests
| Area of Focus | Artifact | Description |
|---|---|---|
| Cybersecurity & Data Protection Management | Cybersecurity & Data Protection Controls | Documented evidence of an appropriately-scoped cybersecurity & data protection controls. Controls are technical, administrative or physical safeguards. Controls are the nexus used to manage risks through preventing, detecting or lessening the ability of a particular threat from negatively impacting business processes. Controls directly map to standards, since control testing is designed to measure specific aspects of how standards are actually implemented. |
| Resource Management | Portfolio Roadmap | Documented evidence of the organization's roadmap for implementing cybersecurity-related initiatives and technologies. |
| Resource Management | Secure Development Lifecycle (SDLC) | Documented evidence of a secure development lifecycle that the organization utilizes for new initiatives or significant changes to existing initiatives to ensure cybersecurity & data privacy principles are identified and implemented by default. |
| Risk Management | Risk Management Program (RMP) | Documented evidence of a Risk Management Program (RMP). This is program-level documentation in the form of a runbook, playbook or a similar format provides guidance on organizational practices that support existing policies and standards. |
| Risk Management | Supply Chain Risk Management (SCRM) Plan | Documented evidence of a Supply Chain Risk Management (SCRM) Plan. This is program-level documentation in the form of a playbook, concept of operations or a similar format provides guidance on organizational practices that support existing policies and standards. |
| Technology Design & Acquisition | Design and Development Plan (DDP) | Documented evidence of an engineering method to control the design process and govern the lifecycle of the product/service. |
| Technology Design & Acquisition | Security Architecture View | Documented evidence that identifies security-relevant system elements and their interfaces: • Define security context, domains, boundaries, and external interfaces of the system; • Align the architecture with (a) the system security objectives and requirements, (b) security design characteristics; and • Establish traceability of architecture elements to user and system security requirements. |
Policies
- Risk Management Standard - Establishes the framework for identifying, assessing, and managing information security risks
Example Organization Controls
- CC3.1.1 - The entity establishes organizational strategies and objectives that are used to determine entity structure and performance metrics.
- CC3.1.2 - Key performance indicators (KPIs) of both the business performance and employee performance are developed in alignment with entity objectives and strategies.
Example Control Objectives
- Risk identification and management - Risks to achievement of objectives are identified, analyzed, and managed through a formal risk assessment process.
Example Evidence
- Annual Strategic Objectives and KPI Review - Organizational strategies, objectives, and KPIs used to determine entity structure and performance measurement