SOX.6.1.1:: Difference between revisions

From HORSE - Holistic Operational Readiness Security Evaluation.
Jump to navigation Jump to search
No edit summary
No edit summary
 
(14 intermediate revisions by the same user not shown)
Line 1: Line 1:
<blockquote style="background: #C8CDC7; padding: 1em; margin-left: 0.5em;">
<blockquote style="background: #C8CDC7; padding: 1em; margin-left: 0.5em;">
[[Image:Key-control.jpg]]<br>
[[Image:Key-control.jpg]]<br>
::'''1. Risk: Availability of critical systems is decreased because system changes have not been evaluated and tested prior to  
::'''1. Risk: Availability of critical systems is decreased because system changes (regular or emergency) have not been evaluated and tested prior to moving the changes to production.'''<br>
moving the changes to production.'''<br>
:::a. SOX.6.1.1: Requests for program changes, system changes and maintenance (including changes to system software) is standardized, logged, approved, documented and subject to formal change management procedures.  
:::a. [[SOX.6.1.1:|'''SOX.6.1.1''']] Requests for program changes, system changes and maintenance (including changes to system software) is standardized, logged, approved, documented and subject to formal change management procedures.  
<br>
<br>
<br>
<br>
Line 10: Line 9:
'''Testing Procedures'''
'''Testing Procedures'''
<blockquote style="background: white; border: 1px solid black; padding: 1em;">
<blockquote style="background: white; border: 1px solid black; padding: 1em;">
1. Determine that a documented change management process exists and is maintained to reflect the current process. Consider  
1. Determine that a documented change management process exists and is maintained to reflect the current process. Consider if change management procedures exist for all changes to the production environment, including program changes, system  
if change management procedures exist for all changes to the production environment, including program changes, system  
maintenance and infrastructure changes. Evaluate the process used to control and monitor change requests. Consider whether change requests are properly initiated, approved and tracked. Determine whether program change is performed in a segregated,
maintenance and infrastructure changes. Evaluate the process used to control and monitor change requests. Consider whether  
change requests are properly initiated, approved and tracked. Determine whether program change is performed in a segregated,
controlled environment.  
controlled environment.  
<br>
<br>
<br>
<br>
2. Select a sample of changes made to applications/systems to determine whether they were adequately tested and approved  
2. Select a sample of changes made to applications/systems to determine whether they were adequately tested and approved before being placed into a production environment. Establish if the following are included in the approval process:  
before being placed into a production environment. Establish if the following are included in the approval process:  
::1.) operations,  
operations, security, IT infrastructure management and IT management.  
::2.) security,  
::3.) IT infrastructure management and IT management.  
<br>


Evaluate procedures designed to determine that only authorized/approved changes are moved into production.  
3. Evaluate procedures designed to determine that only authorized/approved changes are moved into production.
Trace the sample of changes back to the change request log and supporting documentation. Confirm that these procedures
<br>
address the timely implementation of patches to system software.  
<br>
4. Trace the sample of changes back to the change request log and supporting documentation.
<br>
<br>
5. Confirm that these proceduresaddress the timely implementation of patches to system software.  
<br>
<br>
6. Select a sample to determine compliance with the documented procedures.
<br>
<br>


Select a sample to determine compliance with the documented procedures.


</blockquote>
</blockquote>
Line 31: Line 38:
'''Testing Frequency'''
'''Testing Frequency'''
<blockquote style="background: white; border: 1px solid black; padding: 1em;">
<blockquote style="background: white; border: 1px solid black; padding: 1em;">
This should be an integral part of development in house. During the planning stages of development security, availability, and processing integrity must be considered.
Annually
<br>
<br>
</blockquote>
</blockquote>

Latest revision as of 13:36, 23 June 2006


1. Risk: Availability of critical systems is decreased because system changes (regular or emergency) have not been evaluated and tested prior to moving the changes to production.
a. SOX.6.1.1: Requests for program changes, system changes and maintenance (including changes to system software) is standardized, logged, approved, documented and subject to formal change management procedures.




Testing Procedures

1. Determine that a documented change management process exists and is maintained to reflect the current process. Consider if change management procedures exist for all changes to the production environment, including program changes, system maintenance and infrastructure changes. Evaluate the process used to control and monitor change requests. Consider whether change requests are properly initiated, approved and tracked. Determine whether program change is performed in a segregated, controlled environment.

2. Select a sample of changes made to applications/systems to determine whether they were adequately tested and approved before being placed into a production environment. Establish if the following are included in the approval process:

1.) operations,
2.) security,
3.) IT infrastructure management and IT management.


3. Evaluate procedures designed to determine that only authorized/approved changes are moved into production.

4. Trace the sample of changes back to the change request log and supporting documentation.

5. Confirm that these proceduresaddress the timely implementation of patches to system software.

6. Select a sample to determine compliance with the documented procedures.


Testing Frequency

Annually

Evidence Archive Location

Insert hyperlink or location of evidence archive.

Control Stewards Process Narrative

Provide control steward commentary indicating the formal methodology in place.


Control Steward – Jane Manager

Process Illustration

Replace this test by inserting a process diagram, flowchart or other visual representation to illustrate the process narrative as necessary. Include a brief description of the process illustration.

Control Status and Auditors Commentary

The control is effective.


File:Greenlock.jpg

Status is acceptable.

Control Exception Commentary

Status is acceptable.

Remediation Plan

Remediation is not required at this time.