DS5.2:
DS 5.2 IT Security Plan
Control Objective:
Controls provide reasonable assurance that financial reporting systems and subsystems are appropriately secured to prevent unauthorized use, disclosure, modification, damage or loss of data.
Translate business information requirements, IT configuration, information risk action plans and information security culture into an overall IT security plan. The plan is implemented in security policies and procedures together with appropriate investments in services, personnel, software and hardware. Security policies and procedures are communicated to stakeholders and users.
Rationale — Managing systems security includes both physical and logical controls that prevent unauthorized access. These controls typically support authorization, authentication, nonrepudiation, data classification and security monitoring. Deficiencies in this area could significantly impact financial reporting. For instance, insufficient controls over transaction authorization may result in inaccurate financial reporting.
Applicability:
- Sarbanes-Oxley
- HIPAA
- GLBA
- PCI
- FISMA
- NIST SP 800-66
- Ditscap
- Control Exception
- User Defined
Risk Association Control Activities:
- 1. Risk: Insufficient control over authorization, authentication, nonrepudiation, data classification and security monitoring may result in inaccurate financial reporting.
- a. SOX.2.0.17 An information security policy exists and has been approved by an appropriate level of executive management.
- 1. Risk: Insufficient control over authorization, authentication, nonrepudiation, data classification and security monitoring may result in inaccurate financial reporting.
- 2. Risk: Financial systems fail due to a lack of operational procedures being executed.
- a. SOX.2.0.2: Controls provide reasonable assurance that IT daily operation procedures are executed.
- 2. Risk: Financial systems fail due to a lack of operational procedures being executed.
- 3. Risk: Third party processors create unacceptable control risks to the Company.
- a. SOX.2.0.5: Selection of Vendors for outsourced services is performed in accordance with the organization's vendor management policy.
- 3. Risk: Third party processors create unacceptable control risks to the Company.
- 4. Risk: Users may have inappropriate access to the application system.
- a. SOX.5.1.1: Access to the application system is appropriately restricted to prevent unauthorized activity.
- 4. Risk: Users may have inappropriate access to the application system.
- 5. PCI-12.1.1 Addresses all requirements in this specification.
- 6. PCI-12.1.2 Includes an annual process that identifies threats, and vulnerabilities, and results in a formal risk assessment.
- 7. PCI-12.1.3 Includes a review at least once a year and updates when the environment changes.
- 8. PCI.12.2 Develop daily operational security procedures that are consistent with requirements in this specification (e.g., user account maintenance procedures, log review procedures).
- 9. PCI-12.3.1 Explicit management approval.
- 10. PCI-12.3.2 Authentication for use of the technology.
- 11. PCI-12.3.3 A list of all such devices and personnel with access.
- 12. PCI-12.3.4 Labeling of devices with owner, contact information, and purpose.
- 13. PCI-12.3.5 Acceptable uses of the technology.
- 14. PCI-12.3.6 Acceptable network locations for these technologies.
- 15. PCI-12.3.7 A list of company-approved products.
- 16. PCI-12.3.8 Automatic disconnect of modem sessions after a specific period of inactivity.
- 17. PCI-12.3.9 Activation of modems for vendors only when needed by vendors, with immediate deactivation after use.
- 18. PCI-12.3.10 When accessing cardholder data remotely via modem, disable storage of cardholder data onto local hard drives, floppy disks or other external media. Also disable cut-and paste, and print functions during remote access.
- 19. PCI.12.4: Ensure the security policy and procedures clearly define information security responsibilities for all employees and contractors.
Implementation Guide:
Process Narrative
Insert a description of the process narration that is applicable to the existing control statement this narrative refers to.
Process Illustration
Insert a process diagram, flowchart or other visual representation here to illustrate the process narrative.
File:Someimage.jpg
Control Commentary
Insert a description of the control that is applicable to the existing control statement this commentary refers to.
Control Exception Commentary
Insert a description of the control exception that is applicable to the existing control statement this commentary refers to.
Evidence Archive Location
Insert Evidence Description Here.
Control Status and Auditors Commentary
Describe the condition of the applicable control and its effectiveness. Set the color icon to a redlock.jpg, yellowlock.jpg or greenlock.jpg.
File:Redlock.jpg
Remediation Plan
Insert remediation plan, applicability, or any information that indicates what needs to be done.
Supplemental Information:
ITIL Security Management
ITIL Fundamental of Information Security
ITIL 2.3.1.2 Plan Security Management
ITIL Security Management Measures
ITIL 4.1 Control
ISO 3.1 Information security policy
ISO 4.1 Information security infrastructure
ISO 7.1 Secure areas
ISO 8.1 Operational procedures and responsibilities
ISO 8.5 Network management
ISO 8.6 Media handling and security
ISO 9.1 Business requirement for access control
ISO 9.2 User access management
ISO 9.3 User responsibilities
ISO 9.4 Network access control
ISO 9.5 Operating System Access Control
ISO 9.6 Application access control
ISO 10.3 Cryptographic controls
