// Level 3 · Controls

Security (Common Criteria)

CC1–CC9 — controls common to all engagements: governance, risk, access, change management, monitoring.

CC1.1Medium

COSO Principle 1

COSO Principle 1: Demonstrates commitment to integrity and ethical values.

CC1.2Medium

COSO Principle 2

COSO Principle 2: Board exercises oversight of internal control.

CC1.3Medium

COSO Principle 3

COSO Principle 3: Management establishes structures, reporting lines, authorities, and responsibilities.

CC1.4Medium

COSO Principle 4

COSO Principle 4: Demonstrates commitment to attract, develop, and retain competent individuals.

CC1.5Medium

COSO Principle 5

COSO Principle 5: Holds individuals accountable for internal control responsibilities.

CC2.1Medium

Information requirements identified to support the functioning of internal contr

Information requirements identified to support the functioning of internal control.

CC2.2Medium

Internally communicates information necessary to support internal control.

Internally communicates information necessary to support internal control.

CC2.3Medium

Communicates with external parties regarding matters affecting internal control.

Communicates with external parties regarding matters affecting internal control.

CC3.1Medium

Specifies suitable objectives to enable identification and assessment of risk.

Specifies suitable objectives to enable identification and assessment of risk.

CC3.2Medium

Identifies risks to the achievement of objectives and analyzes them as a basis f

Identifies risks to the achievement of objectives and analyzes them as a basis for risk management.

CC3.3Medium

Considers potential for fraud in assessing risks to objectives.

Considers potential for fraud in assessing risks to objectives.

CC3.4Medium

Identifies and assesses changes that could significantly impact the system of in

Identifies and assesses changes that could significantly impact the system of internal control.

CC4.1Medium

Selects, develops, and performs ongoing/separate evaluations to ascertain whethe

Selects, develops, and performs ongoing/separate evaluations to ascertain whether components of internal control are present and functioning.

CC4.2Medium

Evaluates and communicates internal control deficiencies to those responsible fo

Evaluates and communicates internal control deficiencies to those responsible for taking corrective action.

CC5.1Medium

Selects and develops control activities that contribute to the mitigation of ris

Selects and develops control activities that contribute to the mitigation of risks.

CC5.2Medium

Selects and develops general control activities over technology to support objec

Selects and develops general control activities over technology to support objectives.

CC5.3Medium

Deploys control activities through policies and procedures.

Deploys control activities through policies and procedures.

CC6.1Medium

Implements logical access security software, infrastructure, and architectures o

Implements logical access security software, infrastructure, and architectures over protected information assets.

CC6.2Medium

Authorizes, modifies, or removes access based on roles, responsibilities, or sys

Authorizes, modifies, or removes access based on roles, responsibilities, or system design and changes.

CC6.3Medium

Authorizes, modifies, or removes access to data, software, functions, and other

Authorizes, modifies, or removes access to data, software, functions, and other protected information assets.

CC6.4Medium

Restricts physical access to facilities and protected information assets.

Restricts physical access to facilities and protected information assets.

CC6.5Medium

Discontinues logical and physical protections over physical assets only after th

Discontinues logical and physical protections over physical assets only after the ability to read or recover data has been diminished.

CC6.6Medium

Implements logical access security measures to protect against threats from sour

Implements logical access security measures to protect against threats from sources outside its system boundaries.

CC6.7Medium

Restricts the transmission, movement, and removal of information to authorized i

Restricts the transmission, movement, and removal of information to authorized internal/external users and processes.

CC6.8Medium

Implements controls to prevent or detect and act upon the introduction of unauth

Implements controls to prevent or detect and act upon the introduction of unauthorized or malicious software.

CC7.1Medium

Uses detection and monitoring procedures to identify changes to configurations t

Uses detection and monitoring procedures to identify changes to configurations that introduce new vulnerabilities.

CC7.2Medium

Monitors system components and operation for anomalies indicative of malicious a

Monitors system components and operation for anomalies indicative of malicious acts, natural disasters, and errors.

CC7.3Medium

Evaluates security events to determine whether they could or have resulted in a

Evaluates security events to determine whether they could or have resulted in a failure to meet objectives.

CC7.4Medium

Responds to identified security incidents by executing a defined incident respon

Responds to identified security incidents by executing a defined incident response program.

CC7.5Medium

Identifies, develops, and implements activities to recover from identified secur

Identifies, develops, and implements activities to recover from identified security incidents.

CC8.1Medium

Authorizes, designs, develops or acquires, configures, documents, tests, approve

Authorizes, designs, develops or acquires, configures, documents, tests, approves, and implements changes to infrastructure, data, software, and procedures.

CC9.1Medium

Identifies, selects, and develops risk mitigation activities for risks arising f

Identifies, selects, and develops risk mitigation activities for risks arising from potential business disruptions.

CC9.2Medium

Assesses and manages risks associated with vendors and business partners.

Assesses and manages risks associated with vendors and business partners.