on; for example, security, availability, processing integrity, and confidentiality] of the system, have the information necessary to carry out those responsibilities. achieve [security, availability, processing and confidentiality] commitments and Processes are monitored following service level management procedures that monitor with commitments and requirements. are shared according to policies. Customer responsibilities are described on the customer website and in system documentation. CC2.5 Internal and external system users have been provided with information on how to report the principle(s) being reported on; for security, availability, processing integrity, and confidentiality] failures, incidents, concerns, and other complaints to appropriate personnel. System anomalies are detected by internal or external users but the failures are not reported to appropriate personnel resulting in the system failing to achieve its [security, availability, integrity, and confidentiality] and requirements. Policy and procedures documents for significant processes, which include responsibility for operational failures, incidents, system concerns, and user complaints (and the process for doing so) are published and available on the intranet. Customer responsibilities, which include for reporting operational failures, incidents, problems, concerns and complaints, and the for doing so, are described on the customer website and in system documentation. CC2.6 System changes that affect internal and external system user responsibilities or the entity's commitments and requirements relevant to the principle(s) being reported on; for security, availability, processing integrity, and confidentiality] are communicated to those users in a timely manner. Users misunderstand changes in system or their responsibilities in providing for availability, processing integrity, and due to system changes and take based on the misunderstanding. Proposed system changes affecting customers are published on the customer website 90 days before their implementation. Users are given the chance to participate in user acceptance testing for major changes 60 days prior to Changes made to systems are and confirmed with customers through communications mechanisms such as
identified threats, and (3) determines mitigation strategies for those risks (including controls and other mitigation strategies). Personnel involved in the risk management do not have sufficient information to risks and the tolerance of the entity for those risks. The entity has defined a formal risk management process that specifies risk tolerances and the process for evaluating risks based on identified threats and the specified tolerances. One or more internal or external risks, that are significant, threaten the achievement of [security, availability, processing integrity, confidentiality, or privacy] commitments and requirements that can be addressed by security controls, are not During the risk assessment and management process, risk management office personnel changes to business objectives, commitments and requirements, internal operations, and factors that threaten the achievement of objectives and update the potential threats to system objectives. Identified risks are rated using a risk evaluation process and ratings are reviewed by The risk and controls group evaluates the of controls and mitigation strategies in meeting identified risks and recommends based on its evaluation. The risk and controls group's recommendations are reviewed and approved by senior The entity uses a configuration management and related process to capture key components, technical and installation
are initiated as needed based on approved A1.2 Environmental protections, software, data processes, and recovery infrastructure are designed, developed, implemented, operated, monitored, and maintained to meet availability commitments and requirements. Environmental vulnerabilities and changing conditions are not identified or through the use of environmental resulting in a loss of system availability. Environmental protections have been installed including the following: Cooling systems Battery and natural gas generator in the event of power failure Redundant communications lines Smoke detectors Dry pipe sprinklers Environmental vulnerabilities are not monitored or acted upon increasing the severity of an event. Operations personnel monitor the status of protections during each shift. Environmental protections receive maintenance on at least an annual basis. Software or data are lost or not available due to processing error, intentional act, or event. Weekly full-system and daily incremental are performed using an automated system. Backups are monitored for failure using an system and the incident management is automatically invoked. Backups are transported and stored offsite by a third-party storage provider.
Additional Criteria for Confidentiality C1.1 Confidential information is protected during the system design, development, testing, and change processes in accordance with confidentiality commitments and Data used in nonproduction environments is not protected from unauthorized access as The entity creates test data using data masking software that replaces confidential information with test information prior to the creation of test databases. C1.2 Confidential information within the boundaries of the system is protected against unauthorized access, use, and disclosure during input, retention, output, and disposition in accordance with confidentiality commitments and requirements. Unauthorized access to confidential information is obtained during processing. Access to data is restricted to authorized through access control software. Access rules are created and maintained by information security personnel during the application process. Logical access other than through authorized application is restricted to administrators through database management system native security. Creation and modification of access control for the database management systems through the access provisioning process. Application level security restricts the ability to access, modify, and delete data to authenticated users who have been granted access through a record in the access control list. Creation and modification of access control records occurs through the access provisioning process. Unauthorized access to confidential information in output is obtained after processing. Application security restricts output to approved roles or user IDs.
Transmission of digital output beyond the of the system occurs through the use software supporting the advanced standard. C1.4 The entity obtains confidentiality commitments that are consistent with the entity’s requirements, from vendors and other third parties whose products and services comprise part of the system and have access to information. Related party and vendor personnel are unaware of the entity's confidentiality commitments. Formal information sharing agreements are in place with related parties and vendors. These agreements include confidentiality commitments applicable to that entity. Agreement terms include requirements for marking and identifying data as confidential, handling standards for confidential data in the custody of related parties and and return and disposal of confidential when no longer required. Requirements for handling of confidential are not communicated to and agreed to by related parties and vendors. Formal information sharing agreements are in place with related parties and vendors. These agreements include confidentiality commitments applicable to that entity. C1.5 Compliance with confidentiality commitments and requirements by vendors and others third parties whose products and services comprise part of the system is assessed on a periodic and as-needed basis and corrective action is taken, if necessary. Related party and vendor systems are not designed or operating effectively to comply with confidentiality commitments. Related party and vendor systems are subject to review as part of the vendor risk management process. Attestation reports (SOC 2SM reports) are obtained and evaluated when available. Site visits and other assurance procedures are based on the entity's vendor criteria. C1.6 Changes to confidentiality commitments and requirements are communicated to internal and external users, vendors, and other third parties whose products and services are included in the system. Confidentiality practices and commitments are changed without the knowledge or ascent of user entities. The chief information security officer is for changes to confidentiality practices and commitments. A formal process is used to these changes to users, related parties, and vendors.
Confidentiality practices and commitments are changed without the knowledge of related parties or vendors resulting in their systems not with the required practices and not meeting the commitments. The chief information security officer is for changes to confidentiality practices and commitments. A formal process is used to these changes to users, related parties, and vendors. Related party and vendor agreements are to reflect changes in confidentiality practices and commitments. Related party and vendor systems are subject to review as part of the vendor risk management process. Attestation reports (SOC 2SM reports) are obtained and evaluated when available. Site visits and other assurance procedures are based on the entity's vendor criteria.