Appendix B — Illustrative Risks and Controls 19. The illustrative risks and controls presented in this appendix are for illustrative purposes only. They are based on a hypothetical entity in a hypothetical industry. They are not intended to be a comprehensive set of risks and controls or applicable to any particular entity. Criteria Risks Illustrative Controls Criteria Common to All [Security, Availability, Processing Integrity, and Confidentiality] Principles CC1.0 Common Criteria Related to Organization and Management CC1.1 The entity has defined organizational structures, reporting authorities, and responsibilities for the design, development, implementation, operation, monitoring, and maintenance of the system enabling it to meet its commitments and requirements as they relate to [insert the principle(s) being reported on; for example, security, availability, processing integrity, and confidentiality]. The entity's organizational structure does not provide the necessary information flow to manage [security, availability, processing integrity, and confidentiality] activities. The entity evaluates its organizational structure, reporting authorities, and responsibilities as part of its business planning process and as part of its ongoing risk assessment and management process and revises these when necessary to help meet changing commitments and requirements. The roles and responsibilities of key managers are not sufficiently defined to permit proper oversight, management, and monitoring of [security, availability, processing integrity, and confidentiality] activities. Roles and responsibilities are defined in written job descriptions and communicated to managers and their supervisors. Job descriptions are reviewed by entity management on an annual basis for needed changes and where job duty changes are required necessary changes to these job descriptions are also made.
The system fails to function as designed due to external users failure to meet their responsibilities. Customer responsibilities are described on the customer website and in system documentation. CC2.4 Internal and external personnel with responsibility for designing, developing, implementing, operating, monitoring, and maintaining controls, relevant to the [insert the principle(s) being reported on; for example, security, availability, processing integrity, and confidentiality] of the system, have the information necessary to carry out those responsibilities. Controls fail to function as designed or operate effectively due to misunderstanding on the part of personnel responsible for implementing and performing those controls resulting in failure to achieve [security, availability, processing integrity, and confidentiality] commitments and requirements. Policy and procedures documents for significant processes are available on the intranet. Processes are monitored following service level management procedures that monitor compliance with commitments and requirements. Results are shared according to policies. Customer responsibilities are described on the customer website and in system documentation. CC2.5 Internal and external system users have been provided with information on how to report [insert the principle(s) being reported on; for example, security, availability, processing integrity, and confidentiality] failures, incidents, concerns, and other complaints to appropriate personnel. System anomalies are detected by internal or external users but the failures are not reported to appropriate personnel resulting in the system failing to achieve its [security, availability, processing integrity, and confidentiality] commitments and requirements. Policy and procedures documents for significant processes, which include responsibility for reporting operational failures, incidents, system problems, concerns, and user complaints (and the process for doing so) are published and available on the intranet.
One or more internal or external risks, that are significant, threaten the achievement of [security, availability, processing integrity, confidentiality, or privacy] commitments and requirements that can be addressed by security controls, are not identified. During the risk assessment and management process, risk management office personnel identify changes to business objectives, commitments and requirements, internal operations, and external factors that threaten the achievement of business objectives and update the potential threats to system objectives. Identified risks are rated using a risk evaluation process and ratings are reviewed by management. The risk and controls group evaluates the effectiveness of controls and mitigation strategies in meeting identified risks and recommends changes based on its evaluation. The risk and controls group's recommendations are reviewed and approved by senior management. The entity uses a configuration management database and related process to capture key system components, technical and installation specific implementation details, and to support ongoing asset and service management commitments and requirements. CC3.2 The entity designs, develops, and implements controls, including policies and procedures, to implement its risk mitigation strategy. Controls and mitigation strategies selected, developed, and deployed do not adequately mitigate risk. Control self-assessments are performed by operating units on a quarterly basis.
CC4.0 Common Criteria Related to Monitoring of Controls CC4.1 The design and operating effectiveness of controls are periodically evaluated against [insert the principle(s) being reported on; for example, security, availability, processing integrity, and confidentiality] commitments and requirements. Controls are not suitably designed, configured in accordance with established policies, or operating in an effective manner resulting in a system that does not meet system commitments and requirements. Monitoring software is used to identify and evaluate ongoing system performance, security threats, changing resource utilization needs, and unusual system activity. This software sends a message to the operations center and automatically opens an incident, problem, or change management “ticket” record when specific predefined thresholds are met. Operations and security personnel follow defined protocols for resolving and escalating reported events. CC5.0 Common Criteria Related to Logical and Physical Access Controls CC5.1 Logical access security software, infrastructure, and architectures have been implemented to support (1) identification and authentication of authorized users; (2) restriction of authorized user access to system components, or portions thereof, authorized by management, including hardware, data, software, mobile devices, output, and offline elements; and (3) prevention and detection of unauthorized access. Not all system infrastructure or system components are protected by logical access security measures resulting in unauthorized modification or use. Established entity standards exist for infrastructure and software hardening and configuration that include requirements for implementation of access control software, entity configuration standards, and standardized access control lists. Network scans are performed for infrastructure elements to identify variance from entity standards.
CC6.1 Vulnerabilities of system components to [insert the principle(s) reported on; for example, security, availability, processing integrity, and confidentiality] breaches and incidents due to malicious acts, natural disasters, or errors are monitored and evaluated and countermeasures are implemented to compensate for known and new vulnerabilities. Vulnerabilities that could lead to a breach or incident are not detected in a timely manner. Logging and monitoring software is used to collect data from system infrastructure components and endpoint systems and used to monitor system performance, potential security threats and vulnerabilities, resource utilization, and to detect unusual system activity or service requests. This software sends a message to the operations center and security organization and automatically opens a priority incident or problem ticket and change management system record item. Call center personnel receive telephone and requests for support, which may include requests to reset user passwords or notify entity personnel of potential breaches and incidents. Call center personnel follow defined protocols for recording, resolving, and escalating received requests. CC6.2 [Insert the principle(s) being reported on; for example, security, availability, processing integrity, and confidentiality] incidents, including logical and physical security breaches, failures, concerns, and other complaints are identified, reported to appropriate personnel, and acted on in accordance with established incident response procedures. Breaches and incidents are not identified, prioritized, or evaluated for impact. Operations personnel follow defined protocols for evaluating reported events. Security related events are assigned to the security group for evaluation Corrective measures to address breaches and incidents are not implemented in a timely manner. Operations and security personnel follow defined protocols for resolving and escalating reported events.