Control definition
Every control declares a test, at least one criterion and at least one implementer before it merges.
Satisfies
| Criterion | Text |
|---|---|
| SOC2 CC5.1 | The entity selects and develops control activities that mitigate risks to its objectives to acceptable levels. |
| SOC2 CC5.3 | The entity deploys control activities through policies that set expectations and procedures that put them into action. |
Implemented by
Test
| Step | Rule |
|---|---|
| Kind | Preventive: it stops the failure before it happens. |
| Select | Every merged Change that adds or edits a control or its test. |
| Assert | Each control has a test, a criterion and an implementer, and no test was loosened without a Decision. |
Owner
Compliance Officer, Legal Team.
Example
A Change adds a control for supplier Credentials to a home-appraisal service. It merges only once it names its test, one criterion and the Credential check Workflow as implementer.