CC5.1
CC5.1
Selects and develops control activities
The entity selects and develops control activities that contribute to the mitigation of risks to the achievement of objectives to acceptable levels. (COSO Principle 10)
Category
Security
Subcategory
Control Activities
Points of Focus
Integrates With Risk Assessment
Control activities help ensure that risk responses that address and mitigate risks are carried out.
Considers Entity-Specific Factors
Management considers how the environment, complexity, nature, and scope of its operations, as well as the specific characteristics of its organization, affect the selection and development of control activities.
Determines Relevant Business Processes
Management determines which relevant business processes require control activities.
Evaluates a Mix of Control Activity Types
Control activities include a range and variety of controls and may include a balance of approaches to mitigate risks, considering both manual and automated controls, and preventive and detective controls.
Considers at What Level Activities Are Applied
Management considers control activities at various levels in the entity.
Addresses Segregation of Duties
Management segregates incompatible duties, and where such segregation is not practical, management selects and develops alternative control activities.
Evidence Requests
| Area of Focus | Artifact | Description |
|---|---|---|
| Human Resources | Separation of Duties (SoD) | Documented evidence of personnel management practices to implement and maintain Separation of Duties (SoD) to prevent potential inappropriate activity without collusion. |
| Resource Management | Secure Development Lifecycle (SDLC) | Documented evidence of a secure development lifecycle that the organization utilizes for new initiatives or significant changes to existing initiatives to ensure cybersecurity & data privacy principles are identified and implemented by default. |
| Risk Management | Risk Management Program (RMP) | Documented evidence of a Risk Management Program (RMP). This is program-level documentation in the form of a runbook, playbook or a similar format provides guidance on organizational practices that support existing policies and standards. |
| Technology Design & Acquisition | Secure Software Development Principles (SSDP) | Documented evidence of a Secure Software Development Principles (SSDP). This is program-level documentation in the form of a runbook, playbook or a similar format provides guidance on organizational practices that support existing policies and standards. |
| Technology Design & Acquisition | Secure Engineering & Data Privacy (SEDP) | Documented evidence of a Secure Engineering & Data Privacy (SEDP) program. This is program-level documentation in the form of a runbook, playbook or a similar format provides guidance on organizational practices that support existing policies and standards. |
| Technology Design & Acquisition | Design and Development Plan (DDP) | Documented evidence of an engineering method to control the design process and govern the lifecycle of the product/service. |
| Technology Design & Acquisition | Secure Engineering Principles (SEP) | Documented evidence of defined secure engineering principles used to ensure Sensitivity, Integrity, Availability & Safety (CIAS) concerns are properly addressed in the design and implementation of systems, applications and services. |
| Technology Design & Acquisition | Security Architecture View | Documented evidence that identifies security-relevant system elements and their interfaces: • Define security context, domains, boundaries, and external interfaces of the system; • Align the architecture with (a) the system security objectives and requirements, (b) security design characteristics; and • Establish traceability of architecture elements to user and system security requirements. |
| Cybersecurity & Data Protection Management | Cybersecurity & Data Protection Controls | Documented evidence of an appropriately-scoped cybersecurity & data protection controls. Controls are technical, administrative or physical safeguards. Controls are the nexus used to manage risks through preventing, detecting or lessening the ability of a particular threat from negatively impacting business processes. Controls directly map to standards, since control testing is designed to measure specific aspects of how standards are actually implemented. |
| Cybersecurity & Data Protection Management | Cybersecurity & Data Protection Policies & Standards Reviews | Documented evidence of a periodic review process for the organization's cybersecurity & data protection policies and standards to identify necessary updates. |
| Cybersecurity & Data Protection Management | Cybersecurity & Data Protection Procedures | Documented evidence of an appropriate appropriately-scoped cybersecurity & data protection procedures. Procedures are a documented set of steps necessary to perform a specific task or process in conformance with an applicable standard. Procedures help address the question of how the organization actually operationalizes a policy, standard or control. The result of a procedure is intended to satisfy a specific control. Procedures are also commonly referred to as “control activities.” |
Policies
- Information Security Management Standard - Overarching policy defining the organization's approach to information security
- Risk Management Standard - Establishes the framework for identifying, assessing, and managing information security risks
Example Organization Controls
- CC5.1.1 - System access is restricted to authorized individuals commensurate with their job responsibilities.
- CC5.1.2 - Incidents are tracked, addressed, and resolved in a timely manner.
Example Control Objectives
- Control activity implementation - Control activities are selected and developed to mitigate risks and achieve objectives.
Example Evidence
- Role-Based Access Control Matrix - Access matrix showing system access is restricted to authorized individuals commensurate with job responsibilities using predefined security groups
- Incident Tracking Register - Incident register demonstrating incidents are tracked, addressed, and resolved in a timely manner