Aspects
1
Controls
3
Requirements
4
| Aspect ID | Aspect Name | Control ID | Control Name | Requirement ID | Requirement | Level |
|---|---|---|---|---|---|---|
| 2.03 | Governance and Risk | 2.03.1 | Governance | 2.03.1.1 | A member of executive management is responsible for the security of the system and formally acknowledges their responsibilities in writing. | Level I |
| 2.03 | Governance and Risk | 2.03.2 | Risk Management | 2.03.2.1 | The entity has identified security threats to the CCSS Trusted Environment and have defined and implemented controls to reduce the residual risk of an attack to an acceptable level using a threat model. The following considerations are addressed: 1. The entity reviews the threat model periodically to ensure it is up-to-date, the controls currently implemented are still effective, and the risk of an attack is reduced. 2. If a procedure requires a defined frequency to perform tasks for a control, such as reviewing audit logs, the threat model specifies the task frequency. | Level I |
| 2.03 | Governance and Risk | 2.03.2 | Risk Management | 2.03.2.2 | The entity implements a risk management program based on industry recognized risk management standards and frameworks such as ISO/IEC 27005 and NIST SP 800-37. | Level II |
| 2.03 | Governance and Risk | 2.03.3 | Service Provider Management | 2.03.3.1 | Service provider management is implemented for any vendor or service provider that could impact the security of the CCSS Trusted Environment and addresses: 1. Procurement processes to ensure any vendor or service provider meets applicable CCSS requirements before contractual engagement. 2. Annual review of the vendor or service provider's compliance with applicable CCSS requirements. The frequency of review may increase from at least annually based on the entity threat model as defined in requirement 2.03.2.1. | Level I |
Page 1 of 1