One or more internal or external risks, that are During the risk assessment and management significant, threaten the achievement of [security, process, risk management office personnel availability, processing integrity, confidentiality, or identify changes to business objectives, privacy] commitments and requirements that can commitments and requirements, internal be addressed by security controls, are not operations, and external factors that threaten the identified. achievement of business objectives and update the potential threats to system objectives. Identified risks are rated using a risk evaluation process and ratings are reviewed by management. The risk and controls group evaluates the effectiveness of controls and mitigation strategies in meeting identified risks and recommends changes based on its evaluation. The risk and controls group's recommendations are reviewed and approved by senior management. The entity uses a configuration management database and related process to capture key system components, technical and installation specific implementation details, and to support ongoing asset and service management commitments and requirements. CC3.2 The entity designs, develops, and implements Controls and mitigation strategies selected, Control self-assessments are performed by controls, including policies and procedures, to developed, and deployed do not adequately operating units on a quarterly basis. implement its risk mitigation strategy. mitigate risk.
One or more internal or external risks, that are significant, threaten the achievement of [security, availability, processing integrity, confidentiality, or privacy] commitments and requirements that can be addressed by security controls, are not identified. During the risk assessment and management process, risk management office personnel identify changes to business objectives, commitments and requirements, internal operations, and external factors that threaten the achievement of business objectives and update the potential threats to system objectives. Identified risks are rated using a risk evaluation process and ratings are reviewed by management. The risk and controls group evaluates the effectiveness of controls and mitigation strategies in meeting identified risks and recommends changes based on its evaluation. The risk and controls group's recommendations are reviewed and approved by senior management. The entity uses a configuration management database and related process to capture key system components, technical and installation specific implementation details, and to support ongoing asset and service management commitments and requirements. CC3.2 The entity designs, develops, and implements controls, including policies and procedures, to implement its risk mitigation strategy. Controls and mitigation strategies selected, developed, and deployed do not adequately mitigate risk. Control self-assessments are performed by operating units on a quarterly basis.
AICPA-FINAL-ED-Trust-Services-Principles.docx