CC5.3
CC5.3
Deploys through policies and procedures
The entity deploys control activities through policies that establish what is expected and in procedures that put policies into action. (COSO Principle 12)
Category
Security
Subcategory
Control Activities
Points of Focus
Establishes Policies and Procedures to Support Deployment of Management's Directives
Management establishes control activities that are built into business processes and employees' day-to-day activities through policies establishing what is expected and relevant procedures specifying actions.
Establishes Responsibility and Accountability for Executing Policies and Procedures
Management establishes responsibility and accountability for control activities with management (or other designated personnel) of the business unit or function in which the relevant risks reside.
Performs in a Timely Manner
Responsible personnel perform control activities in a timely manner as defined by the policies and procedures.
Takes Corrective Action
Responsible personnel investigate and act on matters identified as a result of executing control activities.
Performs Using Competent Personnel
Competent personnel with sufficient authority perform control activities with diligence and continuing focus.
Reassesses Policies and Procedures
Management periodically reviews control activities to determine their continued relevance and refreshes them when necessary.
Evidence Requests
| Area of Focus | Artifact | Description |
|---|---|---|
| Cybersecurity & Data Protection Management | Cybersecurity & Data Protection Policies | Documented evidence of an appropriately-scoped cybersecurity & data protection policies. Policies are high-level statements of management intent from an organization's executive leadership that are designed to influence decisions and guide the organization to achieve the desired outcomes. Policies are enforced by standards and further implemented by procedures to establish actionable and accountable requirements. |
| Cybersecurity & Data Protection Management | Cybersecurity & Data Protection Standards | Documented evidence of an appropriately-scoped cybersecurity & data protection standards. Standards are mandatory requirements regarding processes, actions and configurations. Standards are intended to be granular and prescriptive to ensure systems, applications and processes are designed and operated to include appropriate cybersecurity & data protection protections |
| Cybersecurity & Data Protection Management | Cybersecurity & Data Protection Procedures | Documented evidence of an appropriate appropriately-scoped cybersecurity & data protection procedures. Procedures are a documented set of steps necessary to perform a specific task or process in conformance with an applicable standard. Procedures help address the question of how the organization actually operationalizes a policy, standard or control. The result of a procedure is intended to satisfy a specific control. Procedures are also commonly referred to as “control activities.” |
| Cybersecurity & Data Protection Management | Cybersecurity & Data Protection Policies & Standards Reviews | Documented evidence of a periodic review process for the organization's cybersecurity & data protection policies and standards to identify necessary updates. |
| Human Resources | Position Competency Requirements | Documented evidence of personnel management practices to define minimum competency requirements for cybersecurity & data privacy-related roles. |
| Human Resources | Critical Cybersecurity & Data Privacy Skills | Documented evidence of personnel management practices to formally identify critical cybersecurity skills needed to support business operations. |
| Human Resources | Access Agreements | Documented evidence of personnel management practices protecting sensitive/regulated data through formal access agreements. |
| Human Resources | Provisioning Checklist (Onboarding) | Documented evidence of personnel management practices to formally onboard personnel into their assigned roles. |
| Human Resources | Rules of Behavior | Documented evidence of personnel management practices to define "acceptable use" or "rules of behavior" criteria that specify acceptable and unacceptable user behaviors. |
Policies
- Information Security Management Standard - Overarching policy defining the organization's approach to information security
Example Organization Controls
- CC5.3.1 - Policies and procedures are documented and communicated to personnel to support the deployment of management directives.
Example Control Objectives
- Control activity implementation - Control activities are selected and developed to mitigate risks and achieve objectives.
Example Evidence
- Notion Policy Library - Screenshot of the policy library in Notion demonstrating policies are documented and available to all personnel