CUEC Coverage
Audit complementary user-entity control coverage.
Description
Complementary user-entity controls are controls expected of users alongside service-organization controls.
Complementary user-entity controls are controls expected of users alongside service-organization controls. Mapping labels helps track their assignment.1
Audit complementary user-entity control coverage.
When to use CUEC Coverage
Use this tool to audit complementary user-entity control coverage.
Prepare the documented facts, aligned totals or expected/observed evidence labels requested. Choose applicable requirements and thresholds separately before interpreting a planning screen.
How to use CUEC Coverage and understand its results
- Prepare the documented facts, aligned totals or expected/observed evidence labels requested. Choose applicable requirements and thresholds separately before interpreting a planning screen.
- Enter requiredControls, mappedControls using the field table and calculation rules, then run the tool.
- Read coveragePercent, matched, missing, unexpected. The explanation below defines the units, signs, ordering and any flags or placeholder values.
- If the tool reports an input issue, correct the values and run it again. Apply the stated assumptions when interpreting a successfully returned result.
| Input field | Meaning | Value type; see rules below | Requirement |
|---|---|---|---|
| requiredControls | Required complementary user controls | list of string | Required |
| mappedControls | Mapped controls | list of string | Required |
Enter requiredControls as the nonempty expected list and mappedControls as observations, which may be empty. Trim entries, compare case-insensitively using en-US lowercase and collapse duplicates. Return matched/missing expected labels and unexpected observed labels. Output follows first occurrence order with the last duplicate’s trimmed spelling.
coverage%=100matchedUnique/expectedUnique Units, indexing, boundary conditions and exceptional cases are defined in the calculation rules above.
| Output field | Meaning | Value type |
|---|---|---|
| coveragePercent | Coverage (%) | number; minimum: 0; maximum: 100 |
| matched | Matched items | list of string |
| missing | Missing items | list of string |
| unexpected | Unexpected items | list of string |
{
"input": {
"requiredControls": [
"alpha",
"beta",
"gamma",
"delta"
],
"mappedControls": [
"beta",
"alpha",
"extra"
]
},
"output": {
"coveragePercent": 50,
"matched": [
"alpha",
"beta"
],
"missing": [
"gamma",
"delta"
],
"unexpected": [
"extra"
]
}
}Limitations and assumptions
No control operation or SOC reliance conclusion is established. Blank entries are errors; requirements are entirely caller-supplied and items have equal weight.
Numeric inputs, where present, must be finite. Follow the calculation-specific rules for overflow, underflow and exceptional cases. Lists are limited to 100,000 entries; the rules above may require smaller limits. Missing required fields, extra fields, wrong value types and violations of the calculation rules are input errors.
Alternative or Complementary methods
Use Trust-Criteria Coverage: Audit trust-services criteria coverage. For a complementary task, use Subservice Method Selector: Select a subservice-organization reporting method from supplied evidence facts.
References
-
CUEC Coverage — tool.io
Similar or alternative tools
- Trust-Criteria Coverage
Audit trust-services criteria coverage.
- Subservice Method Selector
Select a subservice-organization reporting method from supplied evidence facts.