CC4.2
CC4.2
Evaluates and communicates deficiencies
The entity evaluates and communicates internal control deficiencies in a timely manner to those parties responsible for taking corrective action, including senior management and the board of directors, as appropriate. (COSO Principle 17)
Category
Security
Subcategory
Monitoring Activities
Points of Focus
Assesses Results
Management and the board of directors, as appropriate, assess results of ongoing and separate evaluations.
Communicates Deficiencies
Deficiencies are communicated to parties responsible for taking corrective action and to senior management and the board of directors, as appropriate.
Monitors Corrective Action
Management tracks whether deficiencies are remedied on a timely basis.
Evidence Requests
| Area of Focus | Artifact | Description |
|---|---|---|
| Compliance | Internal Audit (IA) Findings | Documented evidence of a centrally-managed and prioritized repository Internal Audit (IA) findings. |
| Cybersecurity & Data Protection Management | Charter - Cybersecurity Steering Committee | Documented evidence of an executive steering committee, or advisory board, that is formed to perform oversight of cybersecurity management decisions and is comprised of key cybersecurity, technology, risk, privacy and business executives. |
| Compliance | Non-Compliance Oversight Reporting | Documented evidence of governance oversight reporting of non-compliance to the organization's executive leadership. |
| Cybersecurity & Data Protection Management | Charter - Data Privacy Steering Committee | Documented evidence of an executive steering committee, or advisory board, that is formed to perform oversight of privacy management decisions and is comprised of key cybersecurity, technology, risk, privacy and business executives. |
| Cybersecurity & Data Protection Management | Charter - Audit Committee | Documented evidence of an executive steering committee, or advisory board, that is formed to perform oversight of internal and external audit management decisions and is comprised of key cybersecurity, technology, risk, privacy and business executives. |
| Cybersecurity & Data Protection Management | Charter - Risk Committee | Documented evidence of an executive steering committee, or advisory board, that is formed to perform oversight of risk management decisions and is comprised of key cybersecurity, technology, risk, privacy and business executives. |
| Cybersecurity & Data Protection Management | Charter - Data Management Board (DMB) | Documented evidence of the organization's Data Management Board (DMB) charter and mission. |
| Cybersecurity & Data Protection Management | Measures of Performance (Metrics) | Documented evidence of formal measure of performance that are used to track the health of the cybersecurity & data protection program (e.g., metrics, KPIs, KRIs). |
| Risk Management | Plan of Actions & Milestones (POA&M) / Risk Register | Documented evidence of a POA&M, or risk register, that tracks control deficiencies from identification through remediation. |
| Third-Party Management | Third-Party Service Reviews | Documented evidence of a formal, annual stakeholder review of third-party services for each Third-Party Service Provider (TSP). |
| Risk Management | Cybersecurity Risk Assessment (RA) | Documented evidence of a cybersecurity-specific risk assessment. |
| Vulnerability & Patch Management | Vulnerability & Patch Management Program (VPMP) | Documented evidence of a Vulnerability & Patch Management Program (VPMP). This is program-level documentation in the form of a runbook, playbook or a similar format provides guidance on organizational practices that support existing policies and standards. |
| Vulnerability Management | Flaw Remediation Actions | Documented evidence of list of recent security flaw remediation actions performed on the system (e.g., list of installed patches, service packs, hot fixes, and other software updates to correct system flaws). |
| Maintenance | Patch Management | Documented evidence of maintenance activities for systems, applications and services management (e.g., patch management). |
| Threat Management | Threat Mitigation | Documented evidence of steps taken to mitigate identified threats. |
Policies
- Logging and Monitoring Standard - Defines requirements for logging security events and monitoring system activity
Example Organization Controls
- CC4.2.1 - Control deficiencies identified during monitoring activities are evaluated and remediated in a timely manner.
Example Control Objectives
- Control monitoring effectiveness - Controls are monitored through ongoing evaluations and deficiencies are identified and communicated in a timely manner.
Example Evidence
- Control Deficiency Remediation Tracker - Tracker showing control deficiencies identified during monitoring are evaluated and remediated in a timely manner