Complementary user entity controls
- Term
- Complementary user entity controls
- Exam
- CISA & CISM
- Definition
Controls a service organization assumes its customers operate for its controls to be effective.
- Explained
These are controls the service organization assumes its customers operate, such as removing leavers' accounts from their tenant. The provider's controls achieve their objectives only if customers perform them.
- In practice
A SaaS provider's report assumes customers remove leavers' accounts from their own tenant.
- Often confused with
- Subservice organization controls
- Exam angle
The customer must confirm it performs them.
- Related