SOC for Cybersecurity - Cybersecurity Risk Management Examination MGT-1: MGT-1 Management prepares a description of the program that addresses every criterion without omission or distortion

In the cybersecurity risk management examination (carried out under AT-C 105, AT-C 205 and the AICPA guide on cybersecurity reporting) management, being responsible for the program, prepares and presents a description of it. The description is ordinarily in accordance with the criteria when it describes the program actually placed in operation, gives information on each of DC1 to DC19, and neither leaves out nor distorts information likely to matter to users. Management may organise it and use narrative, flowcharts, tables or graphics as it sees fit, at enough detail for context but not so much that a hostile party could exploit it; quantification is needed only where a criterion asks. It considers additional disclosures where they would affect users (significant interpretations such as what counts as a security incident, subsequent events, and a significant incident elsewhere in the entity when only part of the program is in scope). A description fails the criteria if it omits significant business units in an entity-wide engagement, makes claims that cannot be objectively evaluated ('best in the industry'), implies facts that are untrue, or distorts significant information; immaterial matters may be left out.