Page 40 - CITP Review

AICPA cybersecurity risk management

reporting framework (SOC for

35
Cybersecurity)

Purpose

Cybersecurity has become a top concern for boards of directors and senior executives of many entities
throughout the country, regardless of their size or the industry in which they operate. In addition,
governmental officials are also concerned about cybersecurity at governmental agencies and
departments. For most entities, cybersecurity is a significant business risk that needs to be identified,
assessed, and managed along with other business risks the entity faces, and it is management's
responsibility to ensure that all employees throughout the entity, not only those in the information
technology department, address cybersecurity risks. Managing this business issue is especially
challenging because even an entity with a highly sophisticated cybersecurity risk management program
has a residual risk that a material cybersecurity breach can occur and not be detected in a timely manner.
In other words, an effective cybersecurity risk management program provides reasonable, but not
absolute, assurance that material breaches are prevented or detected, and mitigated in a timely manner.

To achieve the entity's business objectives, senior management, as well as others within the entity,
frequently need information about the effectiveness of the entity's cybersecurity risk management
program, including the processes and controls designed, implemented, and operated to mitigate threats
against the entity's sensitive information and systems.

Content

In the cybersecurity risk management examination, there are two distinct but complementary subject
matters: (1) the description of the entity's cybersecurity risk management program and (2) the
effectiveness of controls within that program to achieve the entity's cybersecurity objectives.

The cybersecurity risk management examination results in the issuance of a cybersecurity risk
management examination report. The cybersecurity risk management examination report includes three
key components:

 Management's description of the entity's cybersecurity risk management program. The first
component is a management-prepared narrative description of the entity's cybersecurity risk
management program (description). This description should include information on how the entity

35
Reporting on an Entity’s Cybersecurity Risk Management Program and Controls: Attestation Guide, Durham, NC:
AICPA, 2017.

© 2019 Association of International Certified Professional Accountants. All rights reserved. 1-32