SOX.1.1.1:: Difference between revisions
No edit summary |
No edit summary |
||
| (2 intermediate revisions by the same user not shown) | |||
| Line 1: | Line 1: | ||
<blockquote style="background: #C8CDC7; padding: 1em; margin-left: 0.5em;"> | <blockquote style="background: #C8CDC7; padding: 1em; margin-left: 0.5em;"> | ||
''' | [[Image:Key-control.jpg]]<br> | ||
:a. SOX. | ::'''1. Risk: Information security and business requirements may be compromised. Inaccurate results are produced.'''<br> | ||
:::a. [[SOX.1.1.1:|'''SOX.1.1.1''']] A formal, documented systems development methodology should be established and implemented by management. This systems development life cycle (SDLC) describes the stages involved in information system development projects, from an initial feasibility study through maintenance of the completed application. Verify that security, availability, and process integrity requirements are included.<br> | |||
<br> | |||
</blockquote> | </blockquote> | ||
'''Testing Procedures''' | '''Testing Procedures''' | ||
<blockquote style="background: white; border: 1px solid black; padding: 1em;"> | <blockquote style="background: white; border: 1px solid black; padding: 1em;"> | ||
Obtain a copy of the | Obtain a copy of the organizations SDLC methodology. Review the methodology to determine if it addresses security, availability, and processing integrity.<br> | ||
<br> | <br> | ||
Consider whether there are appropriate steps to determine if these requirements are considered throughout the development or acquisition life cycle, e.g., security and availability and processing integrity should be considered during the requirements phase. | |||
<br> | <br> | ||
</blockquote> | </blockquote> | ||
| Line 18: | Line 16: | ||
'''Testing Frequency''' | '''Testing Frequency''' | ||
<blockquote style="background: white; border: 1px solid black; padding: 1em;"> | <blockquote style="background: white; border: 1px solid black; padding: 1em;"> | ||
This should be an integral part of development in house. During the planning stages of development security, availability, and processing integrity must be considered. | |||
<br> | <br> | ||
</blockquote> | </blockquote> | ||
| Line 30: | Line 28: | ||
'''Control Stewards Process Narrative''' | '''Control Stewards Process Narrative''' | ||
<blockquote style="background: white; border: 1px solid black; padding: 1em;"> | <blockquote style="background: white; border: 1px solid black; padding: 1em;"> | ||
<p><font color=#008000> | <p><font color=#008000>Provide control steward commentary indicating the formal methodology in place.</font></p> | ||
<br> | <br> | ||
'''Control Steward – | '''Control Steward – Jane Manager''' | ||
<br> | <br> | ||
</blockquote> | </blockquote> | ||
| Line 45: | Line 43: | ||
'''Control Status and Auditors Commentary''' | '''Control Status and Auditors Commentary''' | ||
<blockquote style="background: white; border: 1px solid black; padding: 1em;"> | <blockquote style="background: white; border: 1px solid black; padding: 1em;"> | ||
<p><font color=#008000>The control is effective | <p><font color=#008000>The control is effective.</font></p> | ||
<br> | <br> | ||
[[Image:greenlock.jpg]]<br> | [[Image:greenlock.jpg]]<br> | ||
Latest revision as of 16:09, 21 June 2006
- 1. Risk: Information security and business requirements may be compromised. Inaccurate results are produced.
- a. SOX.1.1.1 A formal, documented systems development methodology should be established and implemented by management. This systems development life cycle (SDLC) describes the stages involved in information system development projects, from an initial feasibility study through maintenance of the completed application. Verify that security, availability, and process integrity requirements are included.
Testing Procedures
Obtain a copy of the organizations SDLC methodology. Review the methodology to determine if it addresses security, availability, and processing integrity.
Consider whether there are appropriate steps to determine if these requirements are considered throughout the development or acquisition life cycle, e.g., security and availability and processing integrity should be considered during the requirements phase.
Testing Frequency
This should be an integral part of development in house. During the planning stages of development security, availability, and processing integrity must be considered.
Evidence Archive Location
Insert hyperlink or location of evidence archive.
Control Stewards Process Narrative
Provide control steward commentary indicating the formal methodology in place.
Control Steward – Jane Manager
Process Illustration
Replace this test by inserting a process diagram, flowchart or other visual representation to illustrate the process narrative as necessary. Include a brief description of the process illustration.
Control Status and Auditors Commentary
The control is effective.
File:Greenlock.jpg
Status is acceptable.
Control Exception Commentary
Status is acceptable.
Remediation Plan
Remediation is not required at this time.