System and Organization Controls (SOC) 2/CC5 Control Activities/21 of 61
CC5.2COSO Principle 11: The entity also selects and develops general control activities over technology to support the achievement of objectives
Control family: CC5 Control Activities
Control description
The following points of focus, specified in the COSO framework, highlight important characteristics relating to this criterion:
• Determines Dependency Between the Use of Technology in Business Processes and
Technology General Controls — Management understands and determines the dependency and linkage between business processes, automated control activities, and technology general controls.
• Establishes Relevant Technology Infrastructure Control Activities — Management selects and develops control activities over the technology infrastructure, which are designed and implemented to help ensure the completeness, accuracy, and availabil?ity of technology processing.
• Establishes Relevant Security Management Process Controls Activities — Management selects and develops control activities that are designed and implemented
to restrict technology access rights to authorized users commensurate with their job responsibilities and to protect the entity’s assets from external threats.
• Establishes Relevant Technology Acquisition, Development, and Maintenance Process Control Activities — Management selects and develops control activities over the acquisition, development, and maintenance of technology and its infrastructure to achieve management’s objectives.