DS5.1:

DS 5.1 Management of IT Security

Control Objective:

Manage IT security at the highest appropriate organizational level, so the management of security actions is in line with business requirements.

Applicability:

Sarbanes-Oxley

HIPAA

GLBA

PCI

FISMA

NIST SP 800-66

Ditscap

Control Exception

User Defined

Risk Association Control Activities:

1. Risk: Security and business continuity risks are introduced by technical designs incompatible with enterprise standards.

a. SOX.1.15: Controls provide reasonable assurance that business requirements are gathered and approved during the development and maintenance of systems with potential impact to financial reporting.

2. Risk: Users may have inappropriate access to the application system.

a. SOX.5.1.1: Access to the application system is appropriately restricted to prevent unauthorized activity.

Implementation Guide:

Process Narrative
Insert a description of the process narration that is applicable to the existing control statement this narrative refers to.

Process Illustration
Insert a process diagram, flowchart or other visual representation here to illustrate the process narrative.

File:Someimage.jpg

Control Commentary
Insert a description of the control that is applicable to the existing control statement this commentary refers to.

Control Exception Commentary
Insert a description of the control exception that is applicable to the existing control statement this commentary refers to.

Evidence Archive Location
Insert Evidence Description Here.

Control Status and Auditors Commentary
Describe the condition of the applicable control and its effectiveness. Set the color icon to a redlock.jpg, yellowlock.jpg or greenlock.jpg.

File:Redlock.jpg

Remediation Plan
Insert remediation plan, applicability, or any information that indicates what needs to be done.

Supplemental Information:
ITIL Security Management
ITIL Fundamentals of Information Security
ITIL 2.3.1.2 Plan Security Management
ITIL Security Management Measures
ITIL 4.1 Control

ISO3.1 Information security policy
ISO 4.1 Information security infrastructure
ISO 7.1 Secure areas
ISO 8.1 Operational procedures and responsibilities
ISO 8.5 Network management
ISO 8.6 Media handling and security
ISO 9.1 Business requirement for access control
ISO 9.2 User access management
ISO 9.3 User responsibilities
ISO 9.4 Network access control
ISO 9.5 Operating System Access Control
ISO 9.6 Application access control
ISO 10.3 Cryptographic controls