CC4.0 Common Criteria Related to Monitoring of Controls CC4.1 The design and operating effectiveness of Controls are not suitably designed, configured in Monitoring software is used to identify and controls are periodically evaluated against accordance with established policies, or evaluate ongoing system performance, security [insert the principle(s) being reported on; for operating in an effective manner resulting in a threats, changing resource utilization needs, and example, security, availability, processing system that does not meet system commitments unusual system activity. This software sends a integrity, and confidentiality] commitments and and requirements. message to the operations center and requirements. automatically opens an incident, problem, or change management record when “ticket” specific predefined thresholds are met. Operations and security personnel follow defined protocols for resolving and escalating reported events. CC5.0 Common Criteria Related to Logical and Physical Access Controls CC5.1 Logical access security software, infrastructure, Not all system infrastructure or system Established entity standards exist for and architectures have been implemented to components are protected by logical access infrastructure and software hardening and support (1) identification and authentication of security measures resulting in unauthorized configuration that include requirements for authorized users; (2) restriction of authorized modification or use. implementation of access control software, entity user access to system components, or portions configuration standards, and standardized thereof, authorized by management, including access control lists. hardware, data, software, mobile devices, output, and offline elements; and (3) prevention and detection of unauthorized access. Network scans are performed for infrastructure elements to identify variance from entity standards.
CC4.0 Common Criteria Related to Monitoring of Controls CC4.1 The design and operating effectiveness of controls are periodically evaluated against [insert the principle(s) being reported on; for example, security, availability, processing integrity, and confidentiality] commitments and requirements. Controls are not suitably designed, configured in accordance with established policies, or operating in an effective manner resulting in a system that does not meet system commitments and requirements. Monitoring software is used to identify and evaluate ongoing system performance, security threats, changing resource utilization needs, and unusual system activity. This software sends a message to the operations center and automatically opens an incident, problem, or change management “ticket” record when specific predefined thresholds are met. Operations and security personnel follow defined protocols for resolving and escalating reported events. CC5.0 Common Criteria Related to Logical and Physical Access Controls CC5.1 Logical access security software, infrastructure, and architectures have been implemented to support (1) identification and authentication of authorized users; (2) restriction of authorized user access to system components, or portions thereof, authorized by management, including hardware, data, software, mobile devices, output, and offline elements; and (3) prevention and detection of unauthorized access. Not all system infrastructure or system components are protected by logical access security measures resulting in unauthorized modification or use. Established entity standards exist for infrastructure and software hardening and configuration that include requirements for implementation of access control software, entity configuration standards, and standardized access control lists. Network scans are performed for infrastructure elements to identify variance from entity standards.
AICPA-FINAL-ED-Trust-Services-Principles.docx