SOX.6.1.1:: Difference between revisions
No edit summary |
No edit summary |
||
| (14 intermediate revisions by the same user not shown) | |||
| Line 1: | Line 1: | ||
<blockquote style="background: #C8CDC7; padding: 1em; margin-left: 0.5em;"> | <blockquote style="background: #C8CDC7; padding: 1em; margin-left: 0.5em;"> | ||
[[Image:Key-control.jpg]]<br> | [[Image:Key-control.jpg]]<br> | ||
::'''1. Risk: Availability of critical systems is decreased because system changes have not been evaluated and tested prior to | ::'''1. Risk: Availability of critical systems is decreased because system changes (regular or emergency) have not been evaluated and tested prior to moving the changes to production.'''<br> | ||
moving the changes to production.'''<br> | :::a. SOX.6.1.1: Requests for program changes, system changes and maintenance (including changes to system software) is standardized, logged, approved, documented and subject to formal change management procedures. | ||
:::a. | |||
<br> | <br> | ||
<br> | <br> | ||
| Line 10: | Line 9: | ||
'''Testing Procedures''' | '''Testing Procedures''' | ||
<blockquote style="background: white; border: 1px solid black; padding: 1em;"> | <blockquote style="background: white; border: 1px solid black; padding: 1em;"> | ||
1. Determine that a documented change management process exists and is maintained to reflect the current process. Consider | 1. Determine that a documented change management process exists and is maintained to reflect the current process. Consider if change management procedures exist for all changes to the production environment, including program changes, system | ||
if change management procedures exist for all changes to the production environment, including program changes, system | maintenance and infrastructure changes. Evaluate the process used to control and monitor change requests. Consider whether change requests are properly initiated, approved and tracked. Determine whether program change is performed in a segregated, | ||
maintenance and infrastructure changes. Evaluate the process used to control and monitor change requests. Consider whether | |||
change requests are properly initiated, approved and tracked. Determine whether program change is performed in a segregated, | |||
controlled environment. | controlled environment. | ||
<br> | <br> | ||
<br> | <br> | ||
2. Select a sample of changes made to applications/systems to determine whether they were adequately tested and approved | 2. Select a sample of changes made to applications/systems to determine whether they were adequately tested and approved before being placed into a production environment. Establish if the following are included in the approval process: | ||
before being placed into a production environment. Establish if the following are included in the approval process: | ::1.) operations, | ||
operations, security, IT infrastructure management and IT management. | ::2.) security, | ||
::3.) IT infrastructure management and IT management. | |||
<br> | |||
Evaluate procedures designed to determine that only authorized/approved changes are moved into production. | 3. Evaluate procedures designed to determine that only authorized/approved changes are moved into production. | ||
Trace the sample of changes back to the change request log and supporting documentation. Confirm that these | <br> | ||
<br> | |||
4. Trace the sample of changes back to the change request log and supporting documentation. | |||
<br> | |||
<br> | |||
5. Confirm that these proceduresaddress the timely implementation of patches to system software. | |||
<br> | |||
<br> | |||
6. Select a sample to determine compliance with the documented procedures. | |||
<br> | |||
<br> | |||
</blockquote> | </blockquote> | ||
| Line 31: | Line 38: | ||
'''Testing Frequency''' | '''Testing Frequency''' | ||
<blockquote style="background: white; border: 1px solid black; padding: 1em;"> | <blockquote style="background: white; border: 1px solid black; padding: 1em;"> | ||
Annually | |||
<br> | <br> | ||
</blockquote> | </blockquote> | ||
Latest revision as of 13:36, 23 June 2006
- 1. Risk: Availability of critical systems is decreased because system changes (regular or emergency) have not been evaluated and tested prior to moving the changes to production.
- a. SOX.6.1.1: Requests for program changes, system changes and maintenance (including changes to system software) is standardized, logged, approved, documented and subject to formal change management procedures.
Testing Procedures
1. Determine that a documented change management process exists and is maintained to reflect the current process. Consider if change management procedures exist for all changes to the production environment, including program changes, system maintenance and infrastructure changes. Evaluate the process used to control and monitor change requests. Consider whether change requests are properly initiated, approved and tracked. Determine whether program change is performed in a segregated, controlled environment.
2. Select a sample of changes made to applications/systems to determine whether they were adequately tested and approved before being placed into a production environment. Establish if the following are included in the approval process:
- 1.) operations,
- 2.) security,
- 3.) IT infrastructure management and IT management.
3. Evaluate procedures designed to determine that only authorized/approved changes are moved into production.
4. Trace the sample of changes back to the change request log and supporting documentation.
5. Confirm that these proceduresaddress the timely implementation of patches to system software.
6. Select a sample to determine compliance with the documented procedures.
Testing Frequency
Annually
Evidence Archive Location
Insert hyperlink or location of evidence archive.
Control Stewards Process Narrative
Provide control steward commentary indicating the formal methodology in place.
Control Steward – Jane Manager
Process Illustration
Replace this test by inserting a process diagram, flowchart or other visual representation to illustrate the process narrative as necessary. Include a brief description of the process illustration.
Control Status and Auditors Commentary
The control is effective.
File:Greenlock.jpg
Status is acceptable.
Control Exception Commentary
Status is acceptable.
Remediation Plan
Remediation is not required at this time.