CC4.1
CC4.1
Conducts ongoing and/or separate evaluations
The entity selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning. (COSO Principle 16)
Category
Security
Subcategory
Monitoring Activities
Points of Focus
Considers a Mix of Ongoing and Separate Evaluations
Management includes a balance of ongoing and separate evaluations.
Considers Rate of Change
Management considers the rate of change in business and business processes when selecting and developing ongoing and separate evaluations.
Establishes Baseline Understanding
The design and current state of an internal control system are used to establish a baseline for ongoing and separate evaluations.
Uses Knowledgeable Personnel
Evaluators performing ongoing and separate evaluations have sufficient knowledge to understand what is being evaluated.
Integrates With Business Processes
Ongoing evaluations are built into the business processes and adjust to changing conditions.
Adjusts Scope and Frequency
Management varies the scope and frequency of separate evaluations depending on risk.
Objectively Evaluates
Separate evaluations are performed periodically to provide objective feedback.
Considers Different Types of Ongoing and Separate Evaluations
Management uses a variety of ongoing and separate risk and control evaluations to determine whether internal controls are present and functioning. Depending on the entity's objectives, such risk and control evaluations may include first- and second-line monitoring and control testing, internal audit assessments, compliance assessments, resilience assessments, vulnerability scans, security assessment, penetration testing, and third-party assessments.
Evidence Requests
| Area of Focus | Artifact | Description |
|---|---|---|
| Compliance | Internal Audit (IA) Findings | Documented evidence of a centrally-managed and prioritized repository Internal Audit (IA) findings. |
| Compliance | Control Assessments | Documented evidence of internal or third-party control assessments to provide governance oversight of cybersecurity & data privacy controls. |
| Compliance | Functional Review of Cybersecurity Controls | Documented evidence of control testing to ensure cybersecurity controls function as expected. |
| Cybersecurity & Data Protection Management | Measures of Performance (Metrics) | Documented evidence of formal measure of performance that are used to track the health of the cybersecurity & data protection program (e.g., metrics, KPIs, KRIs). |
| Information Assurance | Information Assurance Program (IAP) | Documented evidence of a Information Assurance Program (IAP). This is program-level documentation in the form of a runbook, playbook or a similar format provides guidance on organizational practices that support existing policies and standards. |
| Information Assurance | Pre-Production Controls Testing | Documented evidence of pre-production cybersecurity & data protection controls testing to determine the extent to which the controls are implemented correctly, operating as intended and producing the desired outcome with respect to meeting expected requirements. |
| Resource Management | Cybersecurity Business Plan (CBP) | Documented evidence of a cybersecurity-specific business plan that documents a strategic plan and discrete objectives. |
| Resource Management | Portfolio Roadmap | Documented evidence of the organization's roadmap for implementing cybersecurity-related initiatives and technologies. |
| Resource Management | Secure Development Lifecycle (SDLC) | Documented evidence of a secure development lifecycle that the organization utilizes for new initiatives or significant changes to existing initiatives to ensure cybersecurity & data privacy principles are identified and implemented by default. |
| Risk Management | Risk Management Program (RMP) | Documented evidence of a Risk Management Program (RMP). This is program-level documentation in the form of a runbook, playbook or a similar format provides guidance on organizational practices that support existing policies and standards. |
| Risk Management | Supply Chain Risk Management (SCRM) Plan | Documented evidence of a Supply Chain Risk Management (SCRM) Plan. This is program-level documentation in the form of a playbook, concept of operations or a similar format provides guidance on organizational practices that support existing policies and standards. |
| Technology Design & Acquisition | Design and Development Plan (DDP) | Documented evidence of an engineering method to control the design process and govern the lifecycle of the product/service. |
| Technology Design & Acquisition | Security Architecture View | Documented evidence that identifies security-relevant system elements and their interfaces: • Define security context, domains, boundaries, and external interfaces of the system; • Align the architecture with (a) the system security objectives and requirements, (b) security design characteristics; and • Establish traceability of architecture elements to user and system security requirements. |
Policies
- Logging and Monitoring Standard - Defines requirements for logging security events and monitoring system activity
Example Organization Controls
- CC4.1.1 - The entity monitors key activities and alerts are generated when those activities are outside normal tolerances.
- CC4.1.2 - Alerts are generated and sent to those responsible for taking action.
- CC4.1.3 - A third-party independent System and Organization Controls 2 (SOC 2) audit is conducted annually.
- CC4.1.4 - A third-party independent penetration test is conducted annually to identify and exploit vulnerabilities identified within the environment.
Example Control Objectives
- Control monitoring effectiveness - Controls are monitored through ongoing evaluations and deficiencies are identified and communicated in a timely manner.
Example Evidence
- Penetration Test Report - Most recent third-party penetration test report and remediation evidence
Example Action Plans
- Annual penetration test - Annual penetration test by qualified third-party vendor to identify vulnerabilities in production systems. Required for SOC 2 compliance.