SOX.6.1.4:: Difference between revisions

From HORSE - Holistic Operational Readiness Security Evaluation.
Jump to navigation Jump to search
No edit summary
No edit summary
 
(4 intermediate revisions by the same user not shown)
Line 1: Line 1:
<blockquote style="background: #C8CDC7; padding: 1em; margin-left: 0.5em;">
<blockquote style="background: #C8CDC7; padding: 1em; margin-left: 0.5em;">
[[Image:Key-control.jpg]]<br>
[[Image:Key-control.jpg]]<br>
[[Image:Key-control.jpg]]<br>
::'''2. Risk: System integrity and availability is compromised because emergency changes are made without management approval.'''
::'''2. Risk: System integrity and availability is compromised because emergency changes are made without management approval.'''
<br>
:::a. [[SOX.6.1.4:|'''SOX.6.1.4''']] Emergency change requests are documented and subject to formal change management procedures.  
:::a. [[SOX.6.1.4:|'''SOX.6.1.4''']] Emergency change requests are documented and subject to formal change management procedures.  
<br>
<br>
Line 11: Line 9:
'''Testing Procedures'''
'''Testing Procedures'''
<blockquote style="background: white; border: 1px solid black; padding: 1em;">
<blockquote style="background: white; border: 1px solid black; padding: 1em;">
1. Determine that a documented change management process exists and is maintained to reflect the current process. Consider if change management procedures exist for all changes to the production environment, including program changes, system
1. Determine if a process exists to control and supervise emergency changes.  
maintenance and infrastructure changes. Evaluate the process used to control and monitor change requests. Consider whether change requests are properly initiated, approved and tracked. Determine whether program change is performed in a segregated,
controlled environment.  
<br>
<br>
<br>
<br>
2. Select a sample of changes made to applications/systems to determine whether they were adequately tested and approved before being placed into a production environment. Establish if the following are included in the approval process:
2. Determine if an audit trail exists of all emergency activity and verify that it is independently reviewed.  
::1.) operations,
::2.) security,
::3.) IT infrastructure management and IT management.  
<br>
<br>
3. Evaluate procedures designed to determine that only authorized/approved changes are moved into production.
<br>
<br>
3. Determine that procedures require emergency changes to be supported by appropriate documentation.
<br>
<br>
4. Trace the sample of changes back to the change request log and supporting documentation.
<br>
<br>
4. Establish that backout procedures are developed for emergency changes.
<br>
<br>
5. Confirm that these proceduresaddress the timely implementation of patches to system software.
<br>
<br>
5. Evaluate procedures ensuring that all emergency changes are tested and subject to standard approval procedures after they have been made.
<br>
<br>
6. Select a sample to determine compliance with the documented procedures.
<br>
<br>
6. Review a sample of changes that are recorded as “emergency” changes, and determine if they contain the needed approval and the needed access was terminated after a set period of time. Establish that the sample of changes was well documented.
</blockquote>
<br>
<br>
</blockquote>
'''Testing Frequency'''
'''Testing Frequency'''
<blockquote style="background: white; border: 1px solid black; padding: 1em;">
<blockquote style="background: white; border: 1px solid black; padding: 1em;">
Line 43: Line 32:
<br>
<br>
</blockquote>
</blockquote>
'''Evidence Archive Location'''
'''Evidence Archive Location'''
<blockquote style="background: white; border: 1px solid black; padding: 1em;">
<blockquote style="background: white; border: 1px solid black; padding: 1em;">
Line 49: Line 37:
<br>
<br>
</blockquote>
</blockquote>
'''Control Stewards Process Narrative'''
'''Control Stewards Process Narrative'''
<blockquote style="background: white; border: 1px solid black; padding: 1em;">
<blockquote style="background: white; border: 1px solid black; padding: 1em;">
<p><font color=#008000>Provide control steward commentary indicating the formal methodology in place.</font></p>
<p><font color=#008000>Provide control steward commentary indicating the formal methodology in place.</font></p>
<br>
<br>
'''Control Steward – Jane Manager'''
'''Control Steward – Jane Manager'''
<br>
<br>
</blockquote>
</blockquote>
'''Process Illustration'''
'''Process Illustration'''
<blockquote style="background: white; border: 1px solid black; padding: 1em;">
<blockquote style="background: white; border: 1px solid black; padding: 1em;">

Latest revision as of 13:56, 23 June 2006


2. Risk: System integrity and availability is compromised because emergency changes are made without management approval.
a. SOX.6.1.4 Emergency change requests are documented and subject to formal change management procedures.




Testing Procedures

1. Determine if a process exists to control and supervise emergency changes.

2. Determine if an audit trail exists of all emergency activity and verify that it is independently reviewed.

3. Determine that procedures require emergency changes to be supported by appropriate documentation.

4. Establish that backout procedures are developed for emergency changes.

5. Evaluate procedures ensuring that all emergency changes are tested and subject to standard approval procedures after they have been made.

6. Review a sample of changes that are recorded as “emergency” changes, and determine if they contain the needed approval and the needed access was terminated after a set period of time. Establish that the sample of changes was well documented.


Testing Frequency

Annually

Evidence Archive Location

Insert hyperlink or location of evidence archive.

Control Stewards Process Narrative

Provide control steward commentary indicating the formal methodology in place.


Control Steward – Jane Manager

Process Illustration

Replace this test by inserting a process diagram, flowchart or other visual representation to illustrate the process narrative as necessary. Include a brief description of the process illustration.

Control Status and Auditors Commentary

The control is effective.


File:Greenlock.jpg

Status is acceptable.

Control Exception Commentary

Status is acceptable.

Remediation Plan

Remediation is not required at this time.

Retrieved from "http://horseproject.wiki/index.php?title=SOX.6.1.4:&oldid=2061"