on; for example, security, availability, achieve [security, availability, processing processing integrity, and confidentiality] of the and confidentiality] commitments and system, have the information necessary to carry out those responsibilities. Processes are monitored following service level management procedures that monitor with commitments and requirements. are shared according to policies. Customer responsibilities are described on the customer website and in system documentation. CC2.5 Internal and external system users have been System anomalies are detected by internal or Policy and procedures documents for significant provided with information on how to report external users but the failures are not reported to processes, which include responsibility for the principle(s) being reported on; for appropriate personnel resulting in the system operational failures, incidents, system security, availability, processing integrity, failing to achieve its [security, availability, concerns, and user complaints (and the and confidentiality] failures, incidents, concerns, integrity, and confidentiality] process for doing so) are published and available and other complaints to appropriate personnel. and requirements. on the intranet. Customer responsibilities, which include for reporting operational failures, incidents, problems, concerns and complaints, and the for doing so, are described on the customer website and in system documentation. CC2.6 System changes that affect internal and external Users misunderstand changes in system Proposed system changes affecting customers system user responsibilities or the entity's or their responsibilities in providing for are published on the customer website 90 days commitments and requirements relevant to availability, processing integrity, and before their implementation. Users are given the the principle(s) being reported on; for due to system changes and take chance to participate in user acceptance testing security, availability, processing integrity, based on the misunderstanding. for major changes 60 days prior to and confidentiality] are communicated to those Changes made to systems are users in a timely manner. and confirmed with customers through communications mechanisms such as
on; for example, security, availability, processing integrity, and confidentiality] of the system, have the information necessary to carry out those responsibilities. achieve [security, availability, processing and confidentiality] commitments and Processes are monitored following service level management procedures that monitor with commitments and requirements. are shared according to policies. Customer responsibilities are described on the customer website and in system documentation. CC2.5 Internal and external system users have been provided with information on how to report the principle(s) being reported on; for security, availability, processing integrity, and confidentiality] failures, incidents, concerns, and other complaints to appropriate personnel. System anomalies are detected by internal or external users but the failures are not reported to appropriate personnel resulting in the system failing to achieve its [security, availability, integrity, and confidentiality] and requirements. Policy and procedures documents for significant processes, which include responsibility for operational failures, incidents, system concerns, and user complaints (and the process for doing so) are published and available on the intranet. Customer responsibilities, which include for reporting operational failures, incidents, problems, concerns and complaints, and the for doing so, are described on the customer website and in system documentation. CC2.6 System changes that affect internal and external system user responsibilities or the entity's commitments and requirements relevant to the principle(s) being reported on; for security, availability, processing integrity, and confidentiality] are communicated to those users in a timely manner. Users misunderstand changes in system or their responsibilities in providing for availability, processing integrity, and due to system changes and take based on the misunderstanding. Proposed system changes affecting customers are published on the customer website 90 days before their implementation. Users are given the chance to participate in user acceptance testing for major changes 60 days prior to Changes made to systems are and confirmed with customers through communications mechanisms such as
FINAL-ED-Trust-Services-Principles.docx