Every control, in the open

Management has established an organizational structure with defined reporting lines, responsibilities, and accountability for the operation of the control environment.

Trust Services Criteria

• CC1.1
• CC1.2
• CC1.3

Management has established and communicated a Code of Conduct, ethical expectations, and key organizational policies to personnel.

Trust Services Criteria

• CC1.1
• CC2.2
• CC5.3

Periodic management review meetings are conducted to assess operational performance, security matters, and key business risks requiring corrective action.

Trust Services Criteria

• CC1.2
• CC2.1
• CC3.1
• CC4.1
• CC4.2

Management performs periodic enterprise risk assessments to identify internal and external risks that may impact the achievement of service commitments and system requirements.

Trust Services Criteria

• CC3.1
• CC3.2
• CC3.3
• CC4.1

Key policies and procedures are reviewed periodically and updated for changes in business operations, technology, regulatory, or contractual requirements.

Trust Services Criteria

• CC1.5
• CC2.2
• CC3.4
• CC5.1
• CC5.3

Security and operational responsibilities are assigned to qualified personnel to support the execution of information security, IT, HR, and service delivery processes.

Trust Services Criteria

• CC1.3
• CC1.5
• CC5.1
• CC5.3

Personnel are subject to pre-employment screening, background verification, and reference checks in accordance with defined hiring requirements.

Trust Services Criteria

• CC1.4
• CC5.3

New employees complete onboarding activities, including policy acknowledgement, confidentiality commitments, and induction training, prior to or shortly after joining.

Trust Services Criteria

• CC1.1
• CC1.4
• CC2.2
• CC5.3

Mandatory periodic training covering information security, privacy, acceptable use, and awareness topics is provided to personnel, and completion is monitored.

Trust Services Criteria

• CC1.4
• CC2.2
• CC5.3

Statements of Work, contracts, or service agreements define responsibilities, scope, deliverables, and performance expectations for client engagements.

Trust Services Criteria

• CC2.3
• CC3.1
• CC3.2
• PI1.1
• PI1.2

Significant changes impacting clients, service commitments, or delivery timelines are communicated through formal channels.

Trust Services Criteria

• CC2.3
• PI1.3

Confidentiality obligations with clients, vendors, employees, and other third parties are defined through executed agreements or contractual terms prior to the exchange of sensitive information.

Trust Services Criteria

• CC1.1
• CC2.3
• CC9.2
• C1.1
• P6.4
• P6.5

Third-party service providers with access to confidential or personal information are subject to onboarding due diligence and contractual control requirements.

Trust Services Criteria

• CC1.1
• CC2.3
• CC7.3
• CC7.4
• CC9.2
• C1.1
• P5.2
• P6.1
• P6.3
• P6.4
• P6.5
• P6.6

Critical vendors are periodically reassessed for security, compliance, service performance, and continued suitability.

Trust Services Criteria

• CC3.1
• CC4.1
• CC9.2
• A1.1
• P4.1
• P6.4
• P6.5

Complementary subservice organization controls are identified, and vendor assurance reports, or equivalent evidence, are reviewed where relevant.

Trust Services Criteria

• CC4.1
• CC9.2
• C1.2
• P4.1
• P6.4

Management receives periodic operational, financial, delivery, and security reporting to support oversight responsibilities and decision-making.

Trust Services Criteria

• CC1.2
• CC2.1
• CC2.2
• CC4.1
• PI1.3

Key performance indicators, service metrics, or operational trends are monitored periodically to identify areas requiring management attention.

Trust Services Criteria

• CC2.1
• CC4.1
• A1.1

Control deficiencies, audit observations, or identified improvement opportunities are assigned ownership and tracked through remediation.

Trust Services Criteria

• CC1.5
• CC4.2
• CC5.1
• CC7.4

Internal controls are periodically reviewed and enhanced to address changes in operations, technology, risk conditions, or regulatory requirements.

Trust Services Criteria

• CC1.5
• CC3.4
• CC4.2
• CC5.1

Security responsibilities and accountability are communicated to personnel through role definitions, policies, and management oversight mechanisms.

Trust Services Criteria

• CC1.1
• CC1.3
• CC1.5
• CC2.2
• CC5.1
• CC5.3

Management reviews open risks, incidents, exceptions, and unresolved actions periodically to support oversight and timely resolution.

Trust Services Criteria

• CC1.5
• CC2.1
• CC4.1
• CC4.2
• CC7.3
• CC7.4

Management monitors the effectiveness of the control environment and takes corrective action when deficiencies are identified.

Trust Services Criteria

• CC1.5
• CC3.1
• CC3.3
• CC4.1
• CC4.2
• CC5.1

Internal service requests and support tickets are recorded, prioritized, assigned, and tracked through resolution using approved workflow tools.

Trust Services Criteria

• CC3.2
• CC4.1
• A1.1
• PI1.2

Ticket ageing, unresolved issues, and service request trends are periodically reviewed by management to support timely remediation.

Trust Services Criteria

• CC2.1
• CC4.1
• A1.1

Client service commitments, milestones, and delivery timelines are monitored periodically against agreed requirements.

Trust Services Criteria

• CC3.1
• CC3.2
• A1.1
• PI1.2
• PI1.3

Software licenses and subscriptions are periodically reviewed to validate authorized usage, renewal requirements, and compliance with licensing terms.

Trust Services Criteria

• CC4.1
• CC5.2
• A1.1

Employee separations and role changes are formally communicated to relevant departments to support the timely completion of offboarding and access modification activities.

Trust Services Criteria

• CC5.2
• CC6.2
• CC6.3

User access to systems and applications is provisioned based on approved business requirements and job responsibilities prior to granting access.

Trust Services Criteria

• CC6.1
• CC6.2
• CC6.3

Privileged and administrative access rights are restricted to authorized personnel based on business need and elevated access responsibilities.

Trust Services Criteria

• CC3.3
• CC6.1
• CC6.2
• CC6.3

Logical access rights are reviewed periodically to identify inappropriate, excessive, dormant, or unauthorized user access.

Trust Services Criteria

• CC3.3
• CC6.1
• CC6.2
• CC6.3
• CC7.2

Access rights are modified or revoked in a timely manner when employees separate, transfer roles, or no longer require access.

Trust Services Criteria

• CC6.2
• CC6.3
• CC6.5

Password, authentication, and session management settings are configured in accordance with defined security requirements, including complexity and multi-factor authentication where applicable.

Trust Services Criteria

• CC6.1
• CC6.2
• CC6.3
• CC6.6

Segregation of duties is considered when assigning access rights, administrative privileges, and operational responsibilities to reduce incompatible access.

Trust Services Criteria

• CC3.3
• CC6.1
• CC6.2
• CC6.3
• PI1.1

Security exceptions, temporary access, or deviations from standard controls are formally approved, documented, and reviewed periodically.

Trust Services Criteria

• CC6.2
• CC6.3
• CC7.2

Information assets are classified and handled in accordance with defined data classification and protection requirements.

Trust Services Criteria

• C1.1
• C1.2

Access to confidential information is restricted to authorized personnel based on business need and job responsibilities.

Trust Services Criteria

• CC6.1
• CC6.7
• C1.2

Confidential information transmitted externally is protected through approved secure transfer methods and security controls, where applicable.

Trust Services Criteria

• CC6.6
• CC6.7
• C1.2

Data loss prevention, endpoint protection, or equivalent monitoring controls are implemented to detect and restrict unauthorized movement of sensitive information.

Trust Services Criteria

• CC6.7
• CC7.1
• CC7.2
• C1.2
• P6.3

Data retention periods are defined, and records are retained in accordance with legal, regulatory, contractual, and business requirements.

Trust Services Criteria

• CC2.3
• C1.1
• C1.2
• P4.2
• P4.3
• P5.1
• P6.2

Media, devices, or information assets scheduled for disposal are securely sanitized, destroyed, or decommissioned prior to disposal or reassignment.

Trust Services Criteria

• CC6.5
• CC6.7
• C1.2
• P4.3

Encryption is implemented for sensitive data at rest or in transit where required by policy, contractual commitments, or risk considerations.

Trust Services Criteria

• CC6.6
• CC6.7
• C1.2
• P4.3
• P6.1

Privacy notices, internal privacy requirements, or contractual privacy obligations are defined and communicated where personal information is processed.

Trust Services Criteria

• CC2.2
• P1.1
• P2.1
• P3.1
• P3.2

Personal information collected, used, retained, disclosed, and disposed of is limited to authorized business purposes and applicable requirements.

Trust Services Criteria

• CC1.4
• P1.1
• P2.1
• P3.1
• P3.2
• P4.1
• P4.2
• P4.3
• P5.1
• P6.2

Access to personal information is restricted to authorized personnel, and inappropriate access is investigated and remediated where identified.

Trust Services Criteria

• CC6.1
• CC6.7
• CC7.2
• P5.1
• P6.1
• P6.3

Requests, complaints, or inquiries relating to personal information are received, tracked, and responded to through defined processes where applicable.

Trust Services Criteria

• CC2.3
• P1.1
• P2.1
• P3.1
• P3.2
• P4.2
• P5.1
• P5.2
• P6.1
• P6.2
• P6.3
• P6.6

Privacy-related commitments, data processing terms, or applicable privacy obligations are incorporated into agreements with clients, vendors, and other relevant parties.

Trust Services Criteria

• CC2.3
• CC6.7
• P1.1
• P2.1
• P3.1
• P3.2
• P4.1
• P6.1
• P6.2
• P6.3
• P6.4
• P6.5

Personal information subject to privacy commitments is handled, retained, and disposed of in accordance with applicable privacy obligations and data subject rights.

Trust Services Criteria

• P1.1
• P2.1
• P4.2
• P4.3
• P5.1
• P5.2
• P6.1
• P6.2

Company-owned devices, laptops, and other technology assets are recorded within an asset inventory that is periodically reviewed for completeness and accuracy.

Trust Services Criteria

• CC5.2
• CC6.1
• C1.2

Assets issued to personnel are formally assigned, acknowledged, and tracked through their lifecycle until return, transfer, or disposal.

Trust Services Criteria

• CC5.2
• CC6.1
• CC6.5
• C1.2
• PI1.1

Security alerts generated by endpoint, network, or monitoring tools are reviewed by authorized personnel and investigated where necessary.

Trust Services Criteria

• CC7.1
• CC7.2
• CC7.3

Security logs from critical systems, applications, and infrastructure are retained and available to support monitoring, investigation, and oversight activities.

Trust Services Criteria

• CC2.1
• CC7.2
• CC7.3
• A1.1
• P6.3

Vulnerability assessments and security scans are performed periodically for in-scope systems, and identified issues are tracked through remediation.

Trust Services Criteria

• CC6.8
• CC7.1
• CC7.4
• CC8.1

Formal incident management procedures are established to identify, escalate, investigate, resolve, and close information security incidents.

Trust Services Criteria

• CC6.8
• CC7.2
• CC7.3
• CC7.4
• CC7.5
• P6.3
• P6.5
• P6.6

High-risk security incidents and significant operational issues are escalated to management in a timely manner for oversight and decision-making.

Trust Services Criteria

• CC1.2
• CC4.2
• CC7.3
• CC7.4
• P6.6

Processing errors, failed jobs, service exceptions, or delivery issues are logged, assigned ownership, and tracked through resolution.

Trust Services Criteria

• CC2.1
• CC4.1
• A1.1

Capacity, utilization, and performance of critical systems are monitored to identify service degradation or resource constraints requiring corrective action.

Trust Services Criteria

• CC7.1
• CC9.1
• A1.1
• A1.2

Backup processes are performed for critical systems and data in accordance with defined schedules, and exceptions are investigated.

Trust Services Criteria

• CC7.2
• CC7.5
• CC9.1
• A1.2
• A1.3

Recovery procedures are established for critical systems and are periodically tested to validate restoration capabilities.

Trust Services Criteria

• CC7.5
• CC9.1
• A1.2
• A1.3

Business continuity and disaster recovery plans are documented, reviewed periodically, and updated for significant business or technology changes.

Trust Services Criteria

• CC3.4
• CC7.5
• CC9.1
• A1.2
• A1.3

Service interruptions, outages, or availability incidents are logged, communicated, and managed through defined response procedures.

Trust Services Criteria

• CC7.3
• CC7.5
• CC9.1
• A1.1
• A1.2
• P6.6

Critical systems are configured to synchronize date and time settings to support accurate logging, monitoring, and transaction records.

Trust Services Criteria

• CC7.2
• PI1.3

Sensitive reports, client deliverables, or data outputs are reviewed for completeness and accuracy prior to external release or submission.

Trust Services Criteria

• C1.1
• PI1.1
• PI1.2
• PI1.3

Reconciliations, validation checks, or supervisory reviews are performed over key operational data where completeness or accuracy is critical.

Trust Services Criteria

• CC2.1
• CC3.3
• PI1.1
• PI1.2
• PI1.3

Exceptions identified through reconciliations, quality checks, or operational monitoring are investigated and resolved in a timely manner.

Trust Services Criteria

• CC4.2
• CC7.3

Scheduled jobs, automated workflows, or recurring system tasks are monitored, and failures are investigated and remediated.

Trust Services Criteria

• CC7.2
• CC7.3
• A1.1

Firewall, network perimeter, and traffic filtering rules are configured to restrict unauthorized network access and reviewed periodically.

Trust Services Criteria

• CC6.6

Remote access to internal systems or environments is restricted through secure methods, authentication controls, and monitoring mechanisms.

Trust Services Criteria

• CC6.1
• CC6.6
• CC7.2

Endpoint devices are protected through centrally managed antivirus, anti-malware, encryption, and security configuration controls.

Trust Services Criteria

• CC6.6
• CC6.8

Configuration baselines or approved hardening standards are established for critical servers, endpoints, or network devices.

Trust Services Criteria

• CC5.1
• CC5.2
• CC6.6
• CC6.8
• CC7.1

Non-compliant devices, outdated software, or unsupported systems are identified and remediated through defined patching or upgrade processes.

Trust Services Criteria

• CC6.6
• CC7.1
• A1.1

Critical security patches and updates are evaluated and deployed within defined timelines based on risk and business impact.

Trust Services Criteria

• CC6.8
• CC7.1
• CC7.2
• CC7.4

Changes to applications, infrastructure, and system configurations are formally requested, assessed, approved, and tracked prior to implementation.

Trust Services Criteria

• CC3.4
• CC8.1
• PI1.1
• PI1.2

Changes are tested in appropriate environments prior to migration into production to reduce the risk of unauthorized or defective deployments.

Trust Services Criteria

• CC3.4
• CC8.1
• PI1.3

Emergency changes are documented, retrospectively reviewed, and approved by authorized personnel after implementation.

Trust Services Criteria

• CC3.4
• CC8.1
• PI1.1

Source code repositories, development branches, and deployment pipelines are restricted to authorized personnel and governed by defined approval processes.

Trust Services Criteria

• CC6.1
• CC8.1
• PI1.1

Development tasks, defects, enhancements, and sprint activities are tracked through approved workflow management tools.

Trust Services Criteria

• CC3.2
• CC4.1
• PI1.1
• PI1.2
• PI1.3

Deliverables, releases, or client-impacting outputs are subject to review and approval prior to issuance or deployment.

Trust Services Criteria

• PI1.1
• PI1.2
• PI1.3

New systems, tools, or technologies are subject to security and operational review prior to implementation into the production environment.

Trust Services Criteria

• CC3.1
• CC3.2
• CC3.4
• CC8.1

Automated calculations, templates, or configurable system logic used in key processes are reviewed and approved prior to use or significant change.

Trust Services Criteria

• CC1.4
• CC8.1
• PI1.1
• PI1.2
• PI1.3

System and process documentation is maintained, reviewed, and updated to reflect current operational practices and system configurations.

Trust Services Criteria

• CC2.3
• CC3.4
• PI1.1
• PI1.2
• PI1.3

Physical access to office facilities is restricted to authorized personnel through access cards, guards, visitor controls, or equivalent mechanisms.

Trust Services Criteria

• CC2.3
• CC6.4
• CC6.5
• CC9.2

Visitor entry, exit, and escort procedures are maintained for office premises to prevent unauthorized access to restricted areas.

Trust Services Criteria

• CC6.4
• CC7.2

CCTV monitoring or equivalent surveillance controls are implemented at office locations, and recordings are retained in accordance with defined practices.

Trust Services Criteria

• CC6.4
• CC7.2
• CC7.3
• CC9.2
• P6.3
• P6.4
• P6.5
• P6.6

Fire detection, suppression, and emergency response equipment is maintained and periodically serviced through approved vendors.

Trust Services Criteria

• CC6.4
• CC9.1

UPS, power backup, air conditioning, and environmental controls are maintained to support continued office operations where required.

Trust Services Criteria

• CC6.4
• CC9.1
• A1.2
• A1.3

Emergency drills, evacuation exercises, or preparedness activities are conducted periodically, and outcomes are reviewed for improvement opportunities.

Trust Services Criteria

• CC7.5
• CC9.1
• A1.2
• A1.3

Facility access rights are periodically reviewed and updated when personnel roles change or access is no longer required.

Trust Services Criteria

• CC4.1
• CC6.2
• CC6.4
• CC6.5

Emergency response procedures, evacuation plans, and safety responsibilities are communicated to personnel and made available at office locations.

Trust Services Criteria

• CC2.2
• CC6.4
• A1.2

Mock drills or emergency preparedness exercises are conducted periodically, and observations are tracked to completion.

Trust Services Criteria

• CC7.5
• CC9.1
• A1.2
• A1.3