Labels

Service Organization Control 2

Progress cannot continue due to external dependencies, resource constraints, or technical obstacles beyond the team's control

Formal business decision made to accept the risk without remediation after following the risk acceptance process

Progress has stopped due to lack of response, resource allocation issues, or other internal factors requiring intervention

Business stakeholder has reviewed and acknowledged the risk - awaiting remediation plan development

Risk has been fully remediated and validated as resolved

Remediation work is underway with active progress monitoring - awaiting completion and validation

Security team has drafted remediation recommendations - awaiting business stakeholder acknowledgment

Detailed remediation plan has been developed and approved - awaiting security validation

Security risk has been discovered and documented - awaiting initial risk rating

Risk has been assessed and assigned priority/severity ratings - awaiting recommendation development

Security team has validated the remediation plan addresses the risk - awaiting remediation implementation

Sarbanes-Oxley

This label is used to indicate the control is under review to determine the appropriate SOX-Control State label

This label is used to indicate that Internal Audit testing has begun. If the results of the Internal Audit testing do not confirm Security Compliance’s belief the process is operating effectively, the control will go back into the Remediation state.

This label is used to indicate that the control has been tested by Internal Audit and confirmed to be operating effectively. Controls in this state need no further active work, but will need to be regularly tested to ensure they continue to operate effectively as we work towards an audit.

This label is used to indicate that the related control has been identified as a priority but we're not yet ready to start remediation because we're still trying to understand the scope and systems involved.

This label is used to indicate that the control has been tested by Security Compliance, confirmed to be operating effectively, and ready for the Internal Audit team to test. Controls in this state need no further active work from Security Compliance.

This label is used to indicate the Security Compliance team believes the control is “audit ready" but hasn't collected the evidence to validate that belief.