CC3.1 Specifying objectives
Setting objectives clearly enough that risks to them can be identified and assessed: operations, reporting and compliance objectives, risk tolerances and sub-objectives. The starting point for the SOC 2 risk assessment.
CC3 Risk assessment
Common criteria series CC3: setting objectives, identifying and analyzing risks, considering fraud, and assessing changes that could affect internal control, the risk assessment backbone of a SOC 2.
CC3.2 Risk identification and analysis
Identifying risks to objectives across the organization and analyzing them to decide how to respond: threats, vulnerabilities of system components, vendor and partner risks, and significance. The core risk assessment criterion of SOC 2.
CC3.3 Fraud risk assessment
Considering the potential for fraud when assessing risks: types of fraud, incentives and pressures, opportunities, attitudes and rationalizations, and the risks that come with IT use and access to information.
CC3.4 Assessing significant changes
Identifying and assessing changes that could significantly affect internal control: shifts in the external environment, business model, leadership, systems and technology, vendor relationships, and threats and vulnerabilities.
