AI3.2:

AI 3.2 Infrastructure Resource Protection and Availability

Control Objective:

Implement internal control, security and audit ability measures during configuration, integration and maintenance of hardware and infrastructural software to protect resources and ensure availability and integrity. Responsibilities for using sensitive infrastructure components should be clearly defined and understood by those who develop and integrate infrastructure components. Their use should be monitored and evaluated.

Applicability:

Sarbanes-Oxley

HIPAA

GLBA

PCI

FISMA

NIST SP 800-66

Ditscap

Control Exception

User Defined

Risk Association Control Activities:

3.2.1: Infrastructure

3.2.1.1: Routers

3.2.1.2: Firewalls

3.2.1.3: VPN

3.2.1.4: Managed Switches

3.2.1.5: Intrusion Detection or Prevention System

3.2.2: Operating Systems

3.2.2.1: Unix

3.2.2.2: Windows

3.2.2.2: Mainframe

3.2.2.4: OS/400