DS5.2:

DS 5.2 IT Security Plan

Control Objective:

Controls provide reasonable assurance that financial reporting systems and subsystems are appropriately secured to prevent unauthorized use, disclosure, modification, damage or loss of data.

Translate business information requirements, IT configuration, information risk action plans and information security culture into an overall IT security plan. The plan is implemented in security policies and procedures together with appropriate investments in services, personnel, software and hardware. Security policies and procedures are communicated to stakeholders and users.

Rationale — Managing systems security includes both physical and logical controls that prevent unauthorized access. These controls typically support authorization, authentication, nonrepudiation, data classification and security monitoring. Deficiencies in this area could significantly impact financial reporting. For instance, insufficient controls over transaction authorization may result in inaccurate financial reporting.

Applicability:

Sarbanes-Oxley

HIPAA

GLBA

PCI

FISMA

NIST SP 800-66

Ditscap

Control Exception

User Defined

Risk Association Control Activities:

1. Risk: Insufficient control over authorization, authentication, nonrepudiation, data classification and security monitoring may result in inaccurate financial reporting.

a. SOX.2.0.17 An information security policy exists and has been approved by an appropriate level of executive management.

2. Risk: Insufficient control over authorization, authentication, nonrepudiation, data classification and security monitoring may result in inaccurate financial reporting.

a. SOX.2.0.18 A framework of security standards has been developed that supports the objectives of the security policy.

3. Risk: Insufficient control over authorization, authentication, nonrepudiation, data classification and security monitoring may result in inaccurate financial reporting.

a. SOX.2.0.19 An IT security plan exists that is aligned with overall IT strategic plans. The IT security plan is updated to reflect changes in the IT environment as well as security requirements of specific systems.

4. Risk: Insufficient control over authorization, authentication, nonrepudiation, data classification and security monitoring may result in inaccurate financial reporting.

a. SOX.2.0.20 Procedures exist and are followed to authenticate all users of the system to support the validity of transactions.

5. Risk: Insufficient control over authorization, authentication, nonrepudiation, data classification and security monitoring may result in inaccurate financial reporting.

a. SOX.2.0.21 Procedures exist and are followed to maintain the effectiveness of authentication and access mechanisms (e.g., regular password changes).

6. Risk: Insufficient control over authorization, authentication, nonrepudiation, data classification and security monitoring may result in inaccurate financial reporting.

a. SOX.2.0.22 Procedures exist and are followed relating to timely action to requesting, establishing, issuing, suspending and closing user accounts.

7. Risk: Insufficient control over authorization, authentication, nonrepudiation, data classification and security monitoring may result in inaccurate financial reporting.

a. SOX.2.0.23 A control process exists and is followed to periodically review and confirm access rights.

8. Risk: Insufficient control over authorization, authentication, nonrepudiation, data classification and security monitoring may result in inaccurate financial reporting.

a. SOX.2.0.24 Where appropriate, controls exist so that neither party can deny transactions, and controls are implemented to provide nonrepudiation of origin or receipt, proof of submission, and receipt of transactions.

9. Risk: Insufficient control over authorization, authentication, nonrepudiation, data classification and security monitoring may result in inaccurate financial reporting.

a. SOX.2.0.25 Where network connectivity is used, appropriate controls, including firewalls, intrusion detection and vulnerability assessments, exist and are used to prevent unauthorized access.

10. Risk: Insufficient control over authorization, authentication, nonrepudiation, data classification and security monitoring may result in inaccurate financial reporting.

a. SOX.2.0.26 IT security administration monitors and logs security activity at the application and database, and identified security violations are reported to senior management.

11. Risk: Insufficient control over authorization, authentication, nonrepudiation, data classification and security monitoring may result in inaccurate financial reporting.

a. SOX.2.0.27 Controls relating to appropriate segregation of duties over requesting and granting access to systems and data exist and are followed.

12. Risk: Insufficient control over authorization, authentication, nonrepudiation, data classification and security monitoring may result in inaccurate financial reporting.

a. SOX.2.0.28 Access to facilities is restricted to authorized personnel and requires appropriate identification and authentication.

13. Risk: Financial systems fail due to a lack of operational procedures being executed.

a. SOX.2.0.2: Controls provide reasonable assurance that IT daily operation procedures are executed.

3. Risk: Third party processors create unacceptable control risks to the Company.

a. SOX.2.0.5: Selection of Vendors for outsourced services is performed in accordance with the organization's vendor management policy.

14. Risk: Users may have inappropriate access to the application system.

a. SOX.5.1.1: Access to the application system is appropriately restricted to prevent unauthorized activity.

15. PCI-12.1.1 Addresses all requirements in this specification.

16. PCI-12.1.2 Includes an annual process that identifies threats, and vulnerabilities, and results in a formal risk assessment.

17. PCI-12.1.3 Includes a review at least once a year and updates when the environment changes.

18. PCI.12.2 Develop daily operational security procedures that are consistent with requirements in this specification (e.g., user account maintenance procedures, log review procedures).

19. PCI-12.3.1 Explicit management approval.

20. PCI-12.3.2 Authentication for use of the technology.

21. PCI-12.3.3 A list of all such devices and personnel with access.

22. PCI-12.3.4 Labeling of devices with owner, contact information, and purpose.

23. PCI-12.3.5 Acceptable uses of the technology.

24. PCI-12.3.6 Acceptable network locations for these technologies.

25. PCI-12.3.7 A list of company-approved products.

26. PCI-12.3.8 Automatic disconnect of modem sessions after a specific period of inactivity.

27. PCI-12.3.9 Activation of modems for vendors only when needed by vendors, with immediate deactivation after use.

28. PCI-12.3.10 When accessing cardholder data remotely via modem, disable storage of cardholder data onto local hard drives, floppy disks or other external media. Also disable cut-and paste, and print functions during remote access.

29. PCI.12.4: Ensure the security policy and procedures clearly define information security responsibilities for all employees and contractors.

Implementation Guide:

Process Narrative
Insert a description of the process narration that is applicable to the existing control statement this narrative refers to.

Process Illustration
Insert a process diagram, flowchart or other visual representation here to illustrate the process narrative.

File:Someimage.jpg

Control Commentary
Insert a description of the control that is applicable to the existing control statement this commentary refers to.

Control Exception Commentary
Insert a description of the control exception that is applicable to the existing control statement this commentary refers to.

Evidence Archive Location
Insert Evidence Description Here.

Control Status and Auditors Commentary
Describe the condition of the applicable control and its effectiveness. Set the color icon to a redlock.jpg, yellowlock.jpg or greenlock.jpg.

File:Redlock.jpg

Remediation Plan
Insert remediation plan, applicability, or any information that indicates what needs to be done.

Supplemental Information:
ITIL Security Management
ITIL Fundamental of Information Security
ITIL 2.3.1.2 Plan Security Management
ITIL Security Management Measures
ITIL 4.1 Control

ISO 3.1 Information security policy
ISO 4.1 Information security infrastructure
ISO 7.1 Secure areas
ISO 8.1 Operational procedures and responsibilities
ISO 8.5 Network management
ISO 8.6 Media handling and security
ISO 9.1 Business requirement for access control
ISO 9.2 User access management
ISO 9.3 User responsibilities
ISO 9.4 Network access control
ISO 9.5 Operating System Access Control
ISO 9.6 Application access control
ISO 10.3 Cryptographic controls