ISC, Information Systems and Controls
Sources for Regulations, Standards, and Frameworks: COSO, COBIT, NIST, ISO, and the TSC
Last reviewed
The standards and authorities behind PocketCPA's ISC lessons on Regulations, Standards, and Frameworks: COSO, COBIT, NIST, ISO, and the TSC. The topic rests on COSO Internal Control - Integrated Framework and COSO ERM (2017); the GAO Green Book, including Principles 1 and 5; COBIT 2019 (EDM, APO, BAI, DSS, MEA); the NIST Cybersecurity Framework 2.0 (NIST CSWP 29), SP 800-37 Rev. 2 (the RMF), SP 800-53 Rev. 5, SP 800-171 Rev. 3, SP 800-61 Rev. 3 and SP 800-34 Rev. 1; ISO/IEC 27001 and ISO/IEC 27002; ITIL; the AICPA Trust Services Criteria (CC1-CC9); SOC 1 under SSAE 18 (AT-C 320), SOC 2 and SOC 3; SOX Sections 302 and 404; GLBA (Safeguards Rule and Privacy Rule), HIPAA, CCPA and GDPR Article 3; and PCI DSS.
About this topic
ISC.II.A is about knowing which framework or law governs a given question. Frameworks are voluntary guidance. Regulations carry the force of law. The exam repeatedly tests the boundaries between them.
The question this group answers. Which source governs a described situation, and what power does that source hold to require anything of the entity?
Key points
- COSO Internal Control provides the five-component framework; COSO ERM adds strategy and performance.
- COBIT is the IT governance framework that bridges business goals and IT processes.
- NIST CSF organizes cybersecurity into six functions: Govern, Identify, Protect, Detect, Respond, and Recover.
- ISO/IEC 27001 is the certifiable information security management system standard.
- SOX Section 404 requires management's assessment and (for accelerated filers) the auditor's attestation on internal control over financial reporting.
What the lessons cover
- Governance, management, and control frameworks
- COSO Internal Control - Integrated Framework
- COSO Enterprise Risk Management (ERM)
- COBIT and IT governance
- NIST frameworks
- ISO/IEC 27001 and ITIL
- AICPA Trust Services Criteria (TSC)
- Laws that mandate controls
- Applying and mapping frameworks
- Control classification: preventive, detective, and corrective
- IT general controls
- SOC reporting: SOC 1, SOC 2, SOC 3, and Type 1 versus Type 2
Authoritative references
Control and governance frameworks:
- COSO Internal Control - Integrated Framework, the five components and 17 principles, and COSO Enterprise Risk Management: Integrating with Strategy and Performance (2017).
- GAO Standards for Internal Control in the Federal Government (the Green Book), including Principles 1 and 5.
- COBIT 2019, the governance objectives of its domains: Evaluate, Direct and Monitor (EDM); Align, Plan and Organize (APO); Build, Acquire and Implement (BAI); Deliver, Service and Support (DSS); and Monitor, Evaluate and Assess (MEA).
- ISO/IEC 27001 and ISO/IEC 27002, the requirements for an information security management system and the controls guidance; ITIL, the IT service management practice framework.
NIST publications:
- NIST Cybersecurity Framework 2.0 (NIST CSWP 29), the Functions: Govern, Identify, Protect, Detect, Respond, and Recover.
- NIST SP 800-37 Rev. 2, the Risk Management Framework; SP 800-53 Rev. 5, the control catalog; SP 800-171 Rev. 3, protection of controlled unclassified information in nonfederal systems.
- NIST SP 800-61 Rev. 3, incident response, which supersedes Rev. 2; SP 800-34 Rev. 1, contingency planning.
Assurance and the laws that mandate controls:
- AICPA Trust Services Criteria (CC1 through CC9 for the common criteria), the criteria for SOC 2 and SOC 3 reports, and SOC 1 under SSAE No. 18 (AT-C 320).
- Sarbanes-Oxley Act Section 302, management certification of financial reports, and Section 404, management's assessment of internal control over financial reporting.
- The Gramm-Leach-Bliley Act (Safeguards Rule and Privacy Rule), HIPAA, the California Consumer Privacy Act, and GDPR Article 3, the territorial scope of the regulation.
- PCI DSS, the Payment Card Industry Data Security Standard, a contractual standard and not a law.
How PocketCPA uses these sources
Every lesson is written in original words and cites the paragraph each rule comes from. No standard's text is reproduced. How lessons and questions are written and checked is set out in our methodology.