CC9.1

Identifies, selects, and develops risk mitigation activities

SecurityPartialSecurity (Common Criteria)

AICPA Trust Services Criteria

The entity identifies, selects, and develops risk mitigation activities for risks arising from potential business disruptions.

How this is tested during the audit

Auditor reviews the BCDR plan, vendor concentration analysis, and the cyber-insurance policy.

No evidence on file yet

No evidence attached

Upload at least one artifact before the audit window opens.

Last reviewed

78d

Within 180-day window

Evidence on file

COO

Accountable for design + operating effectiveness

Recent control history