External users fail to address risks for which they System descriptions are available to authorized are responsible that arise outside the boundaries external users that delineate the boundaries of of the system. the system and describe significant system as well as the purpose and design of the system. The system description is available to users via ongoing communications with or via the customer website. CC2.2 The entity's [insert the principle(s) being Users misunderstand the capabilities of the The entity's [security, availability, processing on; for example, security, availability, in providing for [security, availability, and confidentiality] commitments and take the system are included in the master integrity, and confidentiality] integrity, and confidentiality] are communicated to external users, as actions based on the misunderstanding. agreement and customer-specific service appropriate, and those commitments and the level agreements. In addition, a summary of associated system requirements are these commitments is available on the entity's to internal system users to enable them to customer facing website. carry out their responsibilities. The entity fails to meet its commitments due to Policy and procedures documents for significant lack of understanding on the part of personnel processes are available on the intranet. entity’s responsible for providing the service. Personnel are required to attend annual security, confidentiality, and privacy training. Personnel are required to read and accept the code of conduct and the statement of entity’s confidentiality, and privacy practices upon hire and annually thereafter. Processes are monitored through service level management procedures that monitor
External users fail to address risks for which they are responsible that arise outside the boundaries of the system. System descriptions are available to authorized external users that delineate the boundaries of the system and describe significant system as well as the purpose and design of the system. The system description is available to users via ongoing communications with or via the customer website. CC2.2 The entity's [insert the principle(s) being on; for example, security, availability, integrity, and confidentiality] are communicated to external users, as appropriate, and those commitments and the associated system requirements are to internal system users to enable them to carry out their responsibilities. Users misunderstand the capabilities of the in providing for [security, availability, integrity, and confidentiality] and take actions based on the misunderstanding. The entity's [security, availability, processing and confidentiality] commitments the system are included in the master agreement and customer-specific service level agreements. In addition, a summary of these commitments is available on the entity's customer facing website. The entity fails to meet its commitments due to lack of understanding on the part of personnel responsible for providing the service. Policy and procedures documents for significant processes are available on the entity’s intranet. Personnel are required to attend annual security, confidentiality, and privacy training. Personnel are required to read and accept the entity’s code of conduct and the statement of confidentiality, and privacy practices upon hire and annually thereafter. Processes are monitored through service level management procedures that monitor