.png)
What Is The CDPAS?
The Cybersecurity & Data Protection Assessment Standards (CDPAS) serve as a comprehensive framework for third-party assessments, detailing the necessary preparations for organizations and assessors. It outlines the specific requirements for organizations seeking assessment, including the documentation and controls they must have in place. Assessors are guided on how to conduct evaluations, ensuring that all procedures are followed meticulously. The CDPAS also provides a clear methodology for reporting results, ensuring transparency and consistency in assessments.
The CDPAS applies to Third-Party Assessment, Attestation and Certification Services (3PAAC Services). It gives the organization being assessed and the assessor the same set of expectations, from preparation through the final Report on Conformity, so that assessments are performed consistently.
As part of 3PAAC Services, a Third-Party Assessment Organization (3PAO) is expected to conduct an assessment of the applicable controls within an assessment boundary, provide an attestation based on the findings in a Report on Conformity (ROC) and authorize the issue of a certification, if sufficient conformity is achieved.
Assessment vs. Audit
The CDPAS focuses on third-party assessments, not internal or external audits. Per the National Institute of Standards and Technology (NIST), an assessment is the testing or evaluation of security controls to determine the extent to which they are implemented correctly, operating as intended and producing the desired outcome. An audit is the independent examination of records and activities to ensure compliance with established controls, policy and operational procedures.
Who Is The CDPAS For?
The CDPAS is written for the whole assessment ecosystem: Organizations Seeking Assessment (OSAs), Third-Party Assessment Organizations (3PAOs), assessors and External Service Providers (ESPs) such as consultants, Cloud Service Providers (CSPs), Managed Service Providers (MSPs) and Managed Security Services Providers (MSSPs).
Organizations Seeking Assessment (OSAs)
Organizations being assessed use Standards 3, 5 and 9 to prepare for an assessment and maintain conformity afterward.
Third-Party Assessment Organizations (3PAOs)
3PAOs follow Standards 2, 4, 6, 7 and 8 when they perform assessment, attestation and certification services.
Individual Assessors
Assessors, including the Assessment Team Lead (ATL) and any Assessment Technical Experts (ATEs), are held to the ethics, independence, competency and conflict of interest requirements in Standard 1.
Consultants
Consultants that support an organization are part of the ecosystem as ESPs. Standard 1.4 bars an assessor from assessing an organization whose program the assessor materially shaped within the past five years.
MSPs And MSSPs
Controls a provider operates for an organization can be inherited when a First-Party Declaration (1PD) or Third-Party Attestation (3PA) names them and covers the same assessment boundary.
Cloud Service Providers (CSPs)
A CSP's System and Organization Controls (SOC) 2 Type 2 report can cover the physical security of its data centers, but not the organization's own on-premises physical security.
How Is The CDPAS Organized?
The CDPAS has nine standards, each broken into numbered sub-standards. Every sub-standard states the requirement, a justification for why it exists and guidance on how to meet it.
How Do Organizations Use The CDPAS?
An assessment under the CDPAS follows five phases.
Prepare The Organization
The organization being assessed defines its assessment boundary, stakeholders, applicable controls, risk tolerance and materiality, then performs an internal assessment before engaging a 3PAO.
Plan The Engagement
The assessor confirms independence, agrees the statement of work, validates the assessment boundary and provides an Evidence Request List before the assessment starts.
Assess The Controls
Each applicable control is evaluated against its Assessment Objectives and designated Satisfactory, Deficient, Alternative Control or Not Applicable.
Report The Result
Findings are peer reviewed and issued in a Report on Conformity with one of four designations: Strictly Conforms, Conforms, Significant Deficiency or Material Weakness.
Maintain Conformity
The organization remediates deficiencies, tracks open items in a Plan of Action and Milestones (POA&M) and affirms its conformity every year.
The full requirements, justification and guidance for each standard are in the CDPAS.
Materiality: The Foundation of Risk-Based Assessment
A material impact is a potential financial impact on business operations that has a significant, meaningful and measurable effect. The threshold for material impact is set by the organization's executive leadership team.
Under Standards 3.10 to 3.13, the organization being assessed defines its materiality threshold and designates its material risks, threats and incidents.
Material Control: A control so fundamental that it is not capable of having compensating controls, and whose absence or failure could have a material impact.
Material Risk: A scenario where exposure to danger, harm or loss has a material impact, such as significant financial impact, a potential class action lawsuit or death related to product usage.
Material Threat: A vector that causes damage or danger with a material impact, such as poorly governed AI initiatives, nation state hacking operations or dysfunctional internal management practices.
Material Incident: An occurrence that jeopardizes the Confidentiality, Integrity, Availability and/or Safety (CIAS) of a system, application, service or its data, or violates policies, standards, procedures or acceptable use practices, with a material impact.
Material Weakness: A deficiency, or combination of deficiencies, where it is probable that reasonable threats will not be prevented or detected in a timely manner, affecting assurance that the organization can adhere to its stated risk tolerance.
Assessment Rigor: Three Levels
Standard 6.2 defines three levels of rigor, and the statement of work sets the level for each assessment:
- Level 1, Standard: whether the applicable controls are implemented and free of obvious errors.
- Level 2, Enhanced: adds increased grounds for confidence that the controls are implemented correctly and operating as intended.
- Level 3, Comprehensive: adds further confidence that the controls operate as intended on an ongoing and consistent basis, and support for continuous improvement in their effectiveness.
CDPAS Works With The SCF Assessment Ecosystem
The CDPAS draws on other free Secure Controls Framework (SCF) content for evidence, scoping, maturity and assessment objectives.
Evidence Request List (ERL)
Standard 4.4 requires the 3PAO to give the organization an ERL, a finite list of supporting evidence, before the assessment starts. The SCF's ERL is part of the SCF download.
SCR-CMM Maturity Model
The CDPAS uses the six maturity levels of the Secure, Compliant & Resilient Capability Maturity Model (SCR-CMM), Level 0 to Level 5, for the current and target maturity an organization defines under Standard 3.9.
Unified Scoping Guide (USG)
The USG gives 3PAOs a method for validating assessment boundaries and scoping sensitive and regulated data under Standard 4.2.
SCF Workbook
The SCF has a catalog of Assessment Objectives (AOs) that 3PAOs can use under Standard 6.4, and Appendix A of the CDPAS lists the SCF-designated material controls.
CDPAS Standards: Complete Requirements
Each of the nine CDPAS standards is broken into numbered sub-standards. The requirement, justification and guidance for each sub-standard are in the CDPAS.
%20(white).png)