CC3.2
Points of Focus
Includes Entity, Subsidiary, Division, Operating Unit, and Functional Levels
The entity identifies and assesses risk at the entity, subsidiary, division, operating unit, and functional levels relevant to the achievement of objectives.
Analyzes Internal and External Factors
Risk identification considers both internal and external factors and their impact on the achievement of objectives.
Involves Appropriate Levels of Management
The entity puts into place effective risk assessment mechanisms that involve appropriate levels of management.
Estimates Significance of Risks Identified
Identified risks are analyzed through a process that includes estimating the potential significance of the risk.
Determines How to Respond to Risks
Risk assessment includes considering how the risk should be managed and whether to accept, avoid, reduce, or share the risk.
Identifies Threats to Objectives
The entity identifies threats to the achievement of its objectives from intentional (including malicious) and unintentional acts and environmental events.
Identifies Vulnerability of System Components
The entity identifies the vulnerabilities of system components, including system processes, infrastructure, software, and other information assets.
Analyzes Threats and Vulnerabilities From Vendors, Business Partners, and Other Parties
The entity's risk assessment process includes the analysis of potential threats and vulnerabilities arising from vendors providing goods and services, as well as threats and vulnerabilities arising from business partners, customers, and other third parties with access to the entity's information systems.
Assesses the Significance of the Risks
The entity assesses the significance of the identified risks, including (1) determining the criticality of system components, including information assets, in achieving the objectives; (2) assessing the susceptibility of the identified vulnerabilities to the identified threats (3) assessing the likelihood of the identified risks (4) assessing the magnitude of the effect of potential risks to the achievement of the objectives; (5) considering the potential effects of unidentified threats and vulnerabilities on the assessed risks; (6) developing risk mitigation strategies to address the assessed risks; and (7) evaluating the appropriateness of residual risk (including whether to accept, reduce, or share such risks).
Evidence Requests
| Area of Focus | Artifact | Description |
|---|---|---|
| Risk Management | Risk Management Program (RMP) | Documented evidence of a Risk Management Program (RMP). This is program-level documentation in the form of a runbook, playbook or a similar format provides guidance on organizational practices that support existing policies and standards. |
| Risk Management | Risk Threshold | Documented evidence the organization has a defined risk threshold. |
| Risk Management | Risk Tolerance | Documented evidence the organization has a defined risk tolerance. |
| Risk Management | Risk Appetite | Documented evidence the organization has a defined risk appetite. |
| Risk Management | Cybersecurity Risk Assessment (RA) | Documented evidence of a cybersecurity-specific risk assessment. |
| Business Continuity | Continuity of Operations Plan (COOP) Criticality Analysis | Documented evidence of a COOP-related criticality analysis. |
| Third-Party Management | Third-Party Criticality Assessment | Documented evidence of third-party criticality assessment that evaluates the critical nature of each third-party the organization works with. |
| Change Management | Business Impact Analysis (BIA) | Documented evidence of a Business Impact Analysis (BIA) for proposed changes. |
| Risk Management | Supply Chain Risk Management (SCRM) Plan | Documented evidence of a Supply Chain Risk Management (SCRM) Plan. This is program-level documentation in the form of a playbook, concept of operations or a similar format provides guidance on organizational practices that support existing policies and standards. |
| Privacy | Data Protection Impact Assessment (DPIA) | Documented evidence of Data Protection Impact Assessment (DPIA). |
| Technology Design & Acquisition | Secure Software Development Principles (SSDP) | Documented evidence of a Secure Software Development Principles (SSDP). This is program-level documentation in the form of a runbook, playbook or a similar format provides guidance on organizational practices that support existing policies and standards. |
| Technology Design & Acquisition | Secure Engineering & Data Privacy (SEDP) | Documented evidence of a Secure Engineering & Data Privacy (SEDP) program. This is program-level documentation in the form of a runbook, playbook or a similar format provides guidance on organizational practices that support existing policies and standards. |
| Technology Design & Acquisition | Design and Development Plan (DDP) | Documented evidence of an engineering method to control the design process and govern the lifecycle of the product/service. |
| Technology Design & Acquisition | Secure Engineering Principles (SEP) | Documented evidence of defined secure engineering principles used to ensure Sensitivity, Integrity, Availability & Safety (CIAS) concerns are properly addressed in the design and implementation of systems, applications and services. |
| Technology Design & Acquisition | Security Architecture View | Documented evidence that identifies security-relevant system elements and their interfaces: • Define security context, domains, boundaries, and external interfaces of the system; • Align the architecture with (a) the system security objectives and requirements, (b) security design characteristics; and • Establish traceability of architecture elements to user and system security requirements. |
Policies
- Risk Management Standard - Establishes the framework for identifying, assessing, and managing information security risks
Example Organization Controls
- CC3.2.1 - A risk assessment is performed on an annual basis that considers risks to achievement of objectives. Identified risks are rated using a risk evaluation process and formally documented with mitigation strategies.
- CC3.2.2 - Fraud scoring and monitoring is in place for user accounts to detect and review suspicious activity.
Example Control Objectives
- Risk identification and management - Risks to achievement of objectives are identified, analyzed, and managed through a formal risk assessment process.
Example Evidence
- Annual Risk Assessment Report - Annual risk assessment covering objectives, fraud, change, and business disruption risks with documented ratings and mitigation strategies
- Fraud Detection Monitoring Configuration - Fraud scoring and monitoring configuration for user accounts showing detection and review of suspicious activity