• The organization has designed effective
controls to address their compliance requirements and that there are no design deficiencies.
• The organization consistently applies the controls they have designed and that there are no operational deficiencies.