CC3.4
Points of Focus
Assesses Changes in the External Environment
The risk identification process considers changes to the regulatory, economic, and physical environment in which the entity operates.
Assesses Changes in the Business Model
The entity considers the potential impacts of new business lines, dramatically altered compositions of existing business lines, acquired or divested business operations on the system of internal control, rapid growth, changing reliance on foreign geographies, and new technologies.
Assesses Changes in Leadership
The entity considers changes in management and respective attitudes and philosophies on the system of internal control.
Assess Changes in Systems and Technology
The risk identification process considers changes arising from changes in the entity's systems and changes in the technology environment.
Assess Changes in Vendor and Business Partner Relationships
The risk identification process considers changes in vendor and business partner relationships.
Assesses Changes in Threats and Vulnerabilities
The risk identification process assesses changes in (1) internal and external threats to and vulnerabilities of the components of the entity's systems and (2) the likelihood and magnitude of the resultant risks to the achievement of the entity's objectives.
Evidence Requests
| Area of Focus | Artifact | Description |
|---|---|---|
| Change Management | Charter - Change Control Board (CCB) | Documented evidence of the organization's Change Control Board (CCB) charter and mission to govern the organization's change control processes. |
| Change Management | Change Control Records | Documented evidence of change control records. |
| Change Management | Change Control Board (CCB) Minutes | Documented evidence of Change Control Board (CCB) meeting minutes |
| Change Management | Evidence of Cybersecurity / Data Privacy Reviews | Documented evidence of Change Control Board (CCB) meeting-related cybersecurity and/or data privacy reviews for proposed change(s). |
| Resource Management | Portfolio Roadmap | Documented evidence of the organization's roadmap for implementing cybersecurity-related initiatives and technologies. |
| Resource Management | Secure Development Lifecycle (SDLC) | Documented evidence of a secure development lifecycle that the organization utilizes for new initiatives or significant changes to existing initiatives to ensure cybersecurity & data privacy principles are identified and implemented by default. |
| Third-Party Management | Third-Party Contracts | Documented evidence of third-party contractual obligations for cybersecurity & data privacy protections. |
| Third-Party Management | Third-Party Criticality Assessment | Documented evidence of third-party criticality assessment that evaluates the critical nature of each third-party the organization works with. |
| Third-Party Management | Third-Party Service Reviews | Documented evidence of a formal, annual stakeholder review of third-party services for each Third-Party Service Provider (TSP). |
Policies
- Business Continuity Policy - Defines the framework for maintaining business operations during disruptions
- Risk Management Standard - Establishes the framework for identifying, assessing, and managing information security risks
Example Organization Controls
- CC3.4.1 - The annual risk assessment includes consideration of risks from changes to business operations, systems, and external factors.
Example Control Objectives
- Risk identification and management - Risks to achievement of objectives are identified, analyzed, and managed through a formal risk assessment process.
Example Evidence
- Annual Risk Assessment Report - Annual risk assessment covering objectives, fraud, change, and business disruption risks with documented ratings and mitigation strategies