Assessment Objectives

In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that:

• PRI-39.5_A01 a process for receiving & acknowledging complaints, concerns or questions from individuals about organizational cybersecurity / data privacy practices is implemented.
  Assessment rigor: 1
  Origin: 53A_R5_PM-26[01]
• PRI-39.5_A02 a process for responding to complaints, concerns or questions from individuals about organizational cybersecurity / data privacy practices is implemented.
  Assessment rigor: 1
  Origin: 53A_R5_PM-26[02]
• PRI-39.5_A03 the time period in which complaints (including concerns or questions) from individuals are to be reviewed and acknowledging is defined.
  Defined parameters: within 10 business days of receipt
  Assessment rigor: 3
  Origin: 53A_R5_PM-26_ODP[01] 53A_R5_PM-26_ODP[03]
• PRI-39.5_A04 the time period in which complaints (including concerns or questions) from individuals are to be addressed is defined.
  Defined parameters: within 45 days of receipt
  Assessment rigor: 3
  Origin: 53A_R5_PM-26_ODP[02] 53A_R5_PM-26_ODP[04]
• PRI-39.5_A05 the complaint management process includes mechanisms that are easy to use by the public.
  Assessment rigor: 3
  Origin: 53A_R5_PM-26a.[01]
• PRI-39.5_A06 the complaint management process includes mechanisms that are readily accessible by the public.
  Assessment rigor: 3
  Origin: 53A_R5_PM-26a.[02]
• PRI-39.5_A07 the complaint management process includes all information necessary for successfully filing complaints.
  Assessment rigor: 3
  Origin: 53A_R5_PM-26b.
• PRI-39.5_A08 the complaint management process includes tracking mechanisms to ensure that all complaints are reviewed within an organization-defined time period.
  Defined parameters: within 10 business days of receipt
  Assessment rigor: 3
  Origin: 53A_R5_PM-26c.[01]
• PRI-39.5_A09 the complaint management process includes tracking mechanisms to ensure that all complaints are addressed within an organization-defined time period.
  Defined parameters: within 45 days of receipt
  Assessment rigor: 3
  Origin: 53A_R5_PM-26c.[02]
• PRI-39.5_A10 the complaint management process includes acknowledging the receipt of complaints, concerns or questions from individuals within an organization-defined time period.
  Defined parameters: within 10 business days of receipt
  Assessment rigor: 3
  Origin: 53A_R5_PM-26d.
• PRI-39.5_A11 the complaint management process includes responding to complaints, concerns or questions from individuals within an organization-defined time period.
  Defined parameters: within 45 days of receipt
  Assessment rigor: 3
  Origin: 53A_R5_PM-26e.

Gekoppelde issues

• Secure Controls Framework -

  EN: GRCA includes the Secure Controls Framework® (SCF) content, © Secure Controls Framework Council, LLC, used under the Creative Commons Attribution-NoDerivatives 4.0 International Public License. SCF control numbers, names, descriptions and mappings appear exactly as published by the SCF Council – https://securecontrolsframework.com. GRCA may group or reorder SCF content for display, which does not change SCF content; the mappings are shown as links to the frameworks they name. Learn more at https://securecontrolsframework.com.

  DE: GRCA enthält Inhalte des Secure Controls Framework® (SCF), © Secure Controls Framework Council, LLC, genutzt unter der Creative Commons Attribution-NoDerivatives 4.0 International Public License. Nummern, Namen, Beschreibungen und Zuordnungen der SCF-Controls erscheinen genau so, wie der SCF Council sie veröffentlicht – https://securecontrolsframework.com. GRCA gruppiert oder sortiert SCF-Inhalte für die Anzeige, ohne sie zu verändern; die Zuordnungen erscheinen als Verknüpfungen zu den genannten Regelwerken. Mehr unter https://securecontrolsframework.com.