The organization chooses and builds general controls over technology that help it achieve its objectives. Points of focus (4). Dependency: management understands how business processes, automated controls and the technology general controls beneath them depend on one another. Infrastructure: controls over technology infrastructure support processing that is complete, accurate and available. Security management: controls limit access to authorised users according to their duties and guard assets against outside threats. Acquisition, development and maintenance: controls cover how technology and its infrastructure are acquired, developed and maintained. Approaches the framework suggests for external financial reporting: recording technology dependencies in risk and control matrices; assessing end-user computing; putting in place or monitoring controls where IT functions are outsourced; setting up IT infrastructure to restrict access and separate duties; setting up IT so transactions and data are processed completely and accurately; administering security and access; following a system development life cycle for purchased packages; following a system development life cycle for software built internally.
This control maps to 3 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 3 it maps to, and the evidence behind each claim, over MCP and REST.