Most boards and auditors judge control through COSO, while most security teams describe their work through NIST CSF, ISO 27001 or CIS, and the two sides often talk past each other. COSO's Internal Control Integrated Framework (2013) and its Enterprise Risk Management framework (2017 update, "Integrating with Strategy and Performance") are not security standards, yet they decide how cyber control failures are classified, reported and remediated in many listed companies. COSO itself has published cyber-specific guidance that applies both frameworks to cyber risk, and in 2026 added guidance on internal control over generative AI. This guide explains how the components and principles translate into security practice, how to build evidence that satisfies a COSO-based assessment, and where the approach breaks down. It is written for CISOs, GRC leads, internal auditors and finance control owners.
Key takeaways
- COSO is the control language of the audit committee. Mapping your security programme to its 17 internal control principles and 20 ERM principles lets the board read cyber risk in the same terms it reads financial risk.
- Principle 11 is where security lives day to day. General control activities over technology (access, change, operations, acquisition) are the main home of cyber controls, and they include machine and service accounts.
- Effectiveness is binary at the component level. Every component and relevant principle must be present and functioning and operating together; a major deficiency means the system cannot be concluded effective.
- ERM adds appetite and strategy. COSO's 2019 cyber paper recommends setting cyber risk appetite separately for critical and non-critical assets and reviewing it whenever the business context changes.
- COSO does not prescribe controls. You still need a control catalogue such as NIST SP 800-53, ISO/IEC 27001 Annex A or CIS Controls; COSO tells you whether the system around those controls works.
The COSO frameworks and cyber guidance at a glance
COSO (the Committee of Sponsoring Organizations of the Treadway Commission) is sponsored by the AAA, AICPA, FEI, IMA and The IIA. Its framework set has grown in layers, and cyber teams need to know which document answers which question.
| Publication | Year | What it gives a security team |
|---|---|---|
| Internal Control Integrated Framework (ICIF) | 1992, refreshed 2013 (1992 edition superseded 15 December 2014) | Five components, 17 principles and the effectiveness test used for ICFR assessments |
| Enterprise Risk Management: Integrating with Strategy and Performance | 2017 (updates the 2004 ERM framework) | Five components and 20 principles linking risk to strategy, appetite and performance |
| COSO in the Cyber Age | 2015 | Applies the 17 internal control principles to cyber risk; emphasises Principle 11 and monitoring of service providers |
| Managing Cyber Risk in a Digital Age | 2019 | Applies the 2017 ERM components and principles to cyber risk; written by Deloitte for COSO |
| Realize the Full Potential of Artificial Intelligence | 2021 | ERM perspective on AI adoption |
| Achieving Effective Internal Control Over Generative AI | 2026 | Maps all 17 principles to GenAI use cases; eight capability types; six-step roadmap |
| Leveraging COSO Across the Three Lines of Defense | Undated on COSO's page | How COSO responsibilities divide across management, risk and compliance, and internal audit |
The ICIF defines internal control as a process, effected by an entity's board of directors, management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives relating to operations, reporting and compliance. "Reasonable" matters for cyber: no control set prevents every intrusion, and COSO's cyber papers start from the premise that cyber risk cannot be avoided, only managed.
Mapping the 17 internal control principles to security practice
The 2013 framework groups 17 principles under five components. The table below shows what each principle means for a cyber programme and typical evidence. Principle wording is paraphrased from the COSO executive summary.
| Component | Principle (paraphrased) | Cyber interpretation | Typical evidence |
|---|---|---|---|
| Control Environment | 1. Commitment to integrity and ethical values | Acceptable use, insider risk and code of conduct cover systems and data | Signed policy acknowledgements |
| 2. Board independence and oversight | Board or committee has cyber competence or independent advisers | Committee charter, minutes showing cyber agenda items | |
| 3. Structures, reporting lines, authorities | CISO reporting line, named system and data owners, RACI for security | Organisation chart, ownership register | |
| 4. Attract, develop and retain competent people | Security skills plans, role-based training | Training records, skills matrix | |
| 5. Accountability for internal control | Control owners measured on control performance | Objectives and appraisal criteria | |
| Risk Assessment | 6. Objectives specified clearly | Security objectives tied to business objectives and critical assets | Security strategy, crown-jewel list |
| 7. Identify and analyse risk | Cyber risk assessment across the entity, including third parties | Risk register, threat assessment | |
| 8. Consider fraud risk | Payment fraud, business email compromise, privileged misuse, deepfakes | Fraud risk assessment that names cyber vectors | |
| 9. Identify significant change | Cloud migrations, acquisitions, new SaaS, AI adoption assessed before go-live | Change risk assessments, architecture reviews | |
| Control Activities | 10. Select and develop control activities | Layered preventive and detective controls chosen against assessed risk | Control matrix mapped to risks |
| 11. General control activities over technology | Access, change, operations and acquisition controls (ITGCs), including service accounts and API credentials | Access reviews, change tickets, job monitoring | |
| 12. Deploy through policies and procedures | Security policies with procedures that make them operable | Policy set, runbooks, procedure walkthroughs | |
| Information and Communication | 13. Relevant, quality information | Logs and alerts turned into actionable information with integrity protection | SIEM use cases, log completeness checks |
| 14. Internal communication | Awareness, escalation paths, board reporting in business terms | Escalation matrix, board packs | |
| 15. External communication | Incident disclosure, regulator notification, threat intelligence sharing | Disclosure procedure, notification logs | |
| Monitoring Activities | 16. Ongoing and separate evaluations | Continuous control monitoring, internal audit, penetration tests, service provider assurance | Test results, SOC reports reviewed |
| 17. Evaluate and communicate deficiencies | Findings reported to owners, senior management and board on time | Issue log with ageing, remediation tracking |
COSO in the Cyber Age makes two points practitioners often miss. First, general IT controls combined with business controls are likely to be the main means of preventing or detecting a breach, so Principle 11 is not just an audit construct. Second, controls at outsourced providers must be monitored, and where a service auditor's report does not adequately cover cyber controls, the user organisation should seek to understand them directly.
Principle 11 in depth: general controls over technology
For organisations subject to SOX, Principle 11 is where security and financial reporting meet. PCAOB AS 2201 does not define ITGCs, but it notes that an automated control is generally lower risk when the relevant IT general controls are effective, and it treats IT risk as part of the top-down approach rather than a separate evaluation. See the SOX IT General Controls (ITGC) Guide for the audit testing detail.
- Logical access: provisioning, periodic review, privileged access and removal of leavers. Include non-human identities: batch job accounts, integration service accounts, database links and API keys that post to the general ledger. See the Service Account Security Guide.
- Change management: authorised, tested and approved changes to in-scope systems, with segregation between developers and those who deploy to production. See the Segregation of Duties Guide.
- IT operations: job scheduling, backup, incident handling and monitoring of interfaces.
- Acquisition and development: security requirements and testing for new systems, including SaaS and cloud configuration.
- Cloud configuration: roles attached to workloads are access controls too. In the Capital One breach a firewall's cloud role had far more data access than it needed, and the OCC later imposed an $80 million penalty linked to cloud risk management weaknesses.
COSO's 2026 GenAI guidance extends Principle 11 explicitly: models, configurations, embeddings and retrieval (RAG) indexes are treated as configuration items subject to access control, segregation of duties and change management. If your organisation relies on AI agents or GenAI outputs in a controlled process, the agent's credentials and permissions belong in your ITGC scope.
Applying COSO ERM (2017) to cyber risk
Managing Cyber Risk in a Digital Age maps the five ERM components and 20 principles to cyber. The useful content is the set of recommendations under each component.
| ERM component (principles) | Cyber recommendations from COSO's 2019 paper |
|---|---|
| Governance and Culture (1-5) | Build board cyber competence or use independent advisers; form a cross-functional cyber risk team led by the CIO or CISO with finance, risk, legal and operations; internal audit participates or advises; retire legacy systems and dark data |
| Strategy and Objective-Setting (6-9) | Review cyber risk whenever business context changes; set cyber risk appetite separately for critical and non-critical assets; weigh the cost of not adopting new technology; select a security framework (NIST CSF, ISO 27001/2, AICPA reporting); consider quantification such as FAIR to set tolerances |
| Performance (10-14) | Start by identifying the most valuable information and systems and mapping where data lives; assess threats by sector; prioritise funding to critical systems; layer preventive and detective controls; plan recovery; address third-party risk; keep the portfolio view current |
| Review and Revision (15-17) | Assess substantial change (technology, mergers, regulation) before adoption; define indicators and consequences; use independent assurance such as internal audit or a SOC for Cybersecurity engagement; feed incidents back into the assessment |
| Information, Communication and Reporting (18-20) | Protect data integrity and availability; use GRC, IRM and SIEM tools; tier incident reporting so severe events reach executives and the board under agreed thresholds; track indicators, since an absence of breaches does not prove sufficiency; meet disclosure duties and rehearse response |
Appetite is the part most programmes leave vague. A workable cyber appetite statement names the asset tier, the tolerated outcome and a measurable threshold, for example "no tier-1 system with internet-facing remote access lacking phishing-resistant MFA" or "critical vulnerabilities on tier-1 assets remediated within 14 days, with no more than 5% exceptions". See the Cyber Risk Quantification Guide and the Risk Register Template.
Internal control or ERM: which to use when
| Question | Use ICIF (2013) | Use ERM (2017) |
|---|---|---|
| Is the control system around a process effective? | Yes: components, principles, deficiency evaluation | Partly |
| How much cyber risk should we accept to pursue a digital strategy? | No | Yes: appetite, alternative strategies, portfolio view |
| Can management sign an ICFR assertion? | Yes: the usual suitable framework under AS 2201 | No |
| How do we report cyber to the board? | Principles 2, 14, 17 | Principles 1, 19, 20 |
| How do we govern AI adoption? | 2026 GenAI guidance, per principle | 2021 AI paper for strategy and appetite |
Smaller organisations rarely need both in full. Start from the ICIF principle mapping for in-scope systems and add a one-page cyber appetite statement. Large and listed organisations usually run both: ICIF for ICFR and SOX evidence, ERM for the enterprise risk profile that feeds the board and disclosures. See the SEC Cybersecurity Disclosure Rules Guide.
Implementing a COSO-aligned cyber control system
- Scope by objective. List the operations, reporting and compliance objectives that depend on technology. For ICFR, start top-down from significant accounts and the systems and interfaces that feed them, as AS 2201 describes.
- Inventory systems and identities. For each in-scope application, record its database, hosting, interfaces and every human and non-human account with write access. Name an owner for each. See the NHI Ownership Guide.
- Assess risk per principle 7 to 9. Include fraud vectors and significant changes in flight (cloud migration, ERP upgrade, AI agents).
- Map controls to principles and to your catalogue. Keep one control matrix with columns for COSO principle, NIST SP 800-53 or ISO 27001 reference, owner, frequency, and evidence.
- Pilot on one process. Walk through design with internal audit before the year-end test window. Fix design gaps first; operating tests on a poorly designed control waste a cycle.
- Automate monitoring. Move recurring tests (access review completeness, unauthorised changes, MFA coverage) to continuous monitoring under Principle 16.
- Classify and escalate deficiencies. Agree in advance how a cyber deficiency is evaluated: deficiency, significant deficiency or material weakness under AS 2201 Appendix A definitions, and who must be told under Principle 17.
- Roll back safely. When a new automated control misfires, revert to the documented manual control and record the period covered by each, so the auditor can test both without a gap.
Detection, measurement and reporting
Principle 16 needs evidence that controls keep working, and Principle 20 (ERM) needs reporting on risk and performance. Useful metrics:
- Access review completion: percentage of in-scope applications, including service accounts, reviewed on schedule, with revocations completed within the agreed window.
- Unauthorised change rate: production changes without an approved ticket, detected by comparing deployment logs with the change system.
- Remote access MFA coverage: share of remote access paths enforcing MFA, with exceptions listed by owner.
- Deficiency ageing: open control deficiencies by severity and age; overdue significant items go to the audit committee.
- Appetite breaches: number of metrics outside stated cyber appetite thresholds, and time to return within tolerance.
- Third-party assurance coverage: critical providers with a reviewed SOC report or equivalent and mapped complementary user entity controls.
Log sources that support these metrics include identity provider sign-in logs, privileged session records, CI/CD and change system logs, and cloud audit trails (NIST SP 800-53 AU-6 and CA-7). See the Board Cyber Risk Reporting Guide.
Framework mapping
| COSO element | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 | ISO/IEC 27001:2022 |
|---|---|---|---|
| ICIF P2, P3; ERM Governance and Culture | GV.RR, GV.OV | PM-9 | Clause 5 (Leadership) |
| ERM Principle 7 (appetite) | GV.RM-02 | PM-9 | Clause 6.1 |
| ICIF P6, P7; ERM Performance | GV.OC, ID.RA | RA-3, PM-11 | Clauses 6.1.2, 8.2 |
| ICIF P11 (access) | PR.AA-05 | AC-2, AC-5, AC-6, IA-9 | Annex A 5.15, 5.18, 8.2 |
| ICIF P11 (change) | PR.PS-01 | CM-3, CM-8 | Annex A 8.32 |
| ICIF P12 | GV.PO | PL-2 | Annex A 5.1 |
| ICIF P15 and service providers | GV.SC | SR-6, PM-30 | Annex A 5.19 to 5.22 |
| ICIF P16, P17 | DE.CM, ID.IM | CA-2, CA-5, CA-7, PM-4 | Clauses 9.2, 10.2 |
This mapping is NHI Mgmt Group's own interpretation; COSO does not publish a crosswalk to these catalogues. For another governance view of the same territory see the COBIT 2019 Guide.
Common failure patterns
- Treating COSO as a finance-only exercise. Security owns Principle 11 controls but is absent from the walkthroughs, so ITGC evidence is assembled by people who do not run the controls.
- Human-only access scope. Access reviews cover employees but skip interface accounts, scheduler accounts and API keys that can post journals.
- Legacy exceptions left out of the risk assessment. The Change Healthcare breach began with a Citrix remote access portal that did not have MFA; a Principle 7 assessment that enumerated every remote path, and a Principle 16 check of MFA coverage, are the controls designed to catch that gap.
- Appetite with no numbers. "Low appetite for cyber risk" cannot be monitored or breached, so Review and Revision never triggers.
- Relying on SOC reports unread. Service auditor reports are filed but complementary user entity controls are never implemented, contrary to the monitoring point in COSO in the Cyber Age.
- Deficiencies that never reach the board. Cyber findings sit in a security tool rather than the issue log that feeds Principle 17 reporting.
Practitioner checklist
- Map every security control in scope to one or more of the 17 ICIF principles, with owner and evidence.
- Include non-human identities (service accounts, API keys, AI agent credentials) in Principle 11 access controls.
- Write a cyber appetite statement with measurable thresholds by asset tier and have the board approve it.
- Agree deficiency severity criteria for cyber findings with internal audit and the external auditor before testing starts.
- Review SOC reports for critical providers and implement and test the complementary user entity controls.
- Assess significant changes (cloud, M&A, AI) under Principle 9 before go-live.
- Report cyber metrics and deficiency ageing to the audit or risk committee at least quarterly.
- Coordinate roles with the Three Lines Model for Cyber Risk Guide so ownership, oversight and assurance are distinct.
Standards and references
- COSO: Internal Control Integrated Framework, Executive Summary
- COSO: Enterprise Risk Management, Integrating with Strategy and Performance
- COSO: Managing Cyber Risk in a Digital Age
- COSO: COSO in the Cyber Age
- COSO: Internal Control Guidance, including Achieving Effective Internal Control Over Generative AI
- PCAOB: AS 2201, An Audit of Internal Control Over Financial Reporting
- NIST: Cybersecurity Framework 2.0
- NIST: SP 800-53 Rev. 5
Related NHI Mgmt Group resources: SOX IT General Controls (ITGC) Guide · Internal Audit for Cybersecurity Guide · GRC Maturity Model · ISO 31000 Risk Management Guide