Applicable

(Y)es / (N)o

(C)onfidentiality

(I)ntegrity

(A)vailability

RPN

(C+I+A)

(S)atisfactory

L1

M2

H3

L1

M2

H3

L1

M2

H3

(O)ther than satisfactory +##

au-16(2)

cross-organizational auditing | sharing of audit information

assessment objective:

Determine if the organization:

au-16(2)[1]

defines organizations with whom cross-organizational audit information is to be shared;

au-16(2)[2]

defines cross-organizational sharing agreements to be used when providing cross-organizational audit information to organization-defined organizations; and

au-16(2)[3]

provides cross-organizational audit information to organization-defined organizations based on organization-defined cross-organizational sharing agreements.

potential assessment methods and objects:

Examine: [select from: Audit and accountability policy; procedures addressing cross-organizational sharing of audit information; cross-organizational sharing agreements; data sharing agreements; other relevant documents or records].

Interview: [SELECT FROM: Organizational personnel with responsibilities for sharing cross-organizational audit information; organizational personnel with information security responsibilities].