• Security — The system is protected
against unauthorized access (both physical
and logical).
• Availability — The system is available for
operation and use as committed or agreed.
• Processing integrity — System processing is
complete, accurate, timely and authorized.
• Confidentiality — Information designated
as confidential is protected as committed
or agreed.
• Privacy — Personal information is collected,
used, retained, disclosed and disposed of in
conformity with the commitments in the
entity’s privacy notice, and with criteria set
forth in Generally Accepted Privacy Principles
(GAPP) issued by the AICPA and Canadian
Institute of Chartered Accountants.