Common criteria series CC1: integrity and ethics, board oversight, organizational structure, competence and accountability, the COSO control environment principles as applied in SOC 2.
How the organization shows a commitment to integrity and ethical values: standards of conduct, tone at the top, checks on adherence, prompt handling of deviations, and extending the same expectations to contractors and vendor staff.
Whether a board of directors or equivalent oversight body is independent of management and oversees internal control: oversight duties, relevant expertise and independent operation, and what this means for small or closely held service organizations.
How management, with board oversight, sets organizational structures, reporting lines, authorities and responsibilities, including how the organization works with external parties such as vendors. The org chart and role definitions behind every other control.
How the organization attracts, develops and retains competent people: hiring policies, background checks, competence evaluations, technical training and succession planning. Distinct from CC1.5, which holds those people accountable.
How individuals are held accountable for their internal control responsibilities: performance measures, incentives and rewards, attention to excessive pressures, and evaluation or discipline. Closes the CC1 control environment series.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.