SOX.6.1.1:: Difference between revisions
No edit summary |
No edit summary |
||
| Line 1: | Line 1: | ||
<blockquote style="background: #C8CDC7; padding: 1em; margin-left: 0.5em;"> | <blockquote style="background: #C8CDC7; padding: 1em; margin-left: 0.5em;"> | ||
[[Image:Key-control.jpg]]<br> | [[Image:Key-control.jpg]]<br> | ||
::'''1. Risk: | ::'''1. Risk: Availability of critical systems is decreased because system changes have not been evaluated and tested prior to | ||
:::a. [[SOX.1.1:|'''SOX.1.1''']] | moving the changes to production.'''<br> | ||
:::a. [[SOX.6.1.1:|'''SOX.6.1.1''']] Requests for program changes, system changes and maintenance (including changes to | |||
system software) is standardized, logged, approved, documented and subject to formal change management procedures. | |||
<br> | |||
<br> | |||
</blockquote> | </blockquote> | ||
'''Testing Procedures''' | '''Testing Procedures''' | ||
<blockquote style="background: white; border: 1px solid black; padding: 1em;"> | <blockquote style="background: white; border: 1px solid black; padding: 1em;"> | ||
1. Determine that a documented change management process exists and is maintained to reflect the current process. Consider | |||
if change management procedures exist for all changes to the production environment, including program changes, system | |||
Consider whether | maintenance and infrastructure changes. Evaluate the process used to control and monitor change requests. Consider whether | ||
change requests are properly initiated, approved and tracked. Determine whether program change is performed in a segregated, | |||
controlled environment. | |||
<br> | <br> | ||
2. Select a sample of changes made to applications/systems to determine whether they were adequately tested and approved | |||
before being placed into a production environment. Establish if the following are included in the approval process: | |||
operations, security, IT infrastructure management and IT management. | |||
Evaluate procedures designed to determine that only authorized/approved changes are moved into production. | |||
Trace the sample of changes back to the change request log and supporting documentation. Confirm that these procedures | |||
address the timely implementation of patches to system software. | |||
Select a sample to determine compliance with the documented procedures. | |||
</blockquote> | </blockquote> | ||
Revision as of 19:22, 22 June 2006
- 1. Risk: Availability of critical systems is decreased because system changes have not been evaluated and tested prior to
moving the changes to production.
- a. SOX.6.1.1 Requests for program changes, system changes and maintenance (including changes to
system software) is standardized, logged, approved, documented and subject to formal change management procedures.
Testing Procedures
1. Determine that a documented change management process exists and is maintained to reflect the current process. Consider if change management procedures exist for all changes to the production environment, including program changes, system maintenance and infrastructure changes. Evaluate the process used to control and monitor change requests. Consider whether change requests are properly initiated, approved and tracked. Determine whether program change is performed in a segregated, controlled environment.
2. Select a sample of changes made to applications/systems to determine whether they were adequately tested and approved before being placed into a production environment. Establish if the following are included in the approval process: operations, security, IT infrastructure management and IT management.Evaluate procedures designed to determine that only authorized/approved changes are moved into production. Trace the sample of changes back to the change request log and supporting documentation. Confirm that these procedures address the timely implementation of patches to system software.
Select a sample to determine compliance with the documented procedures.
Testing Frequency
This should be an integral part of development in house. During the planning stages of development security, availability, and processing integrity must be considered.
Evidence Archive Location
Insert hyperlink or location of evidence archive.
Control Stewards Process Narrative
Provide control steward commentary indicating the formal methodology in place.
Control Steward – Jane Manager
Process Illustration
Replace this test by inserting a process diagram, flowchart or other visual representation to illustrate the process narrative as necessary. Include a brief description of the process illustration.
Control Status and Auditors Commentary
The control is effective.
File:Greenlock.jpg
Status is acceptable.
Control Exception Commentary
Status is acceptable.
Remediation Plan
Remediation is not required at this time.