|
1) - Does your organization have a formal proce=
ss for
reviewing user access to sensitive data? ![](3D"1Mhtm-FreeITGovernanceSymantecComplianceAssessmentToolsCOBITCOSOSy=)
COBIT Domain: Deliver & Support
Process: 5 Ensure Systems Security
Control Objective: 5.5 – Management Review of User Accounts
Management should have a control process in place to review and confirm
access rights periodically. Periodic comparison of resources with recorded
accountability should be made to help reduce the risk of errors, fraud,
misuse or unauthorized alteration.
=
2) - Is
a formal process in place for supporting the principle of least privilege=
by
requiring approval by the information owner for all user access to sensit=
ive
data?
COBIT Domain: Deliver & Support
Process: 5 Ensure Systems Security
Control Objective: 5.3 Security of Online Access to Data
In an online IT environment, IT management should implement procedures in
line with the security policy that provides access security control based=
on
the individual’s demonstrated need to view, add, change or delete d=
ata
=
3) - Is
a mechanism in place for tracking user acceptance of new and updated corp=
orate
security policies?
COBIT Domain: Planning & Organization
Process: 6 Communicate Management Aims and Direction
Control Objective: 6.3 Communication of Organization Policies
Management should ensure that organizational policies are clearly
communicated, understood and accepted by all levels in the organization. =
=
4) -
Does your organization have an automated tool to identify systems that do=
not
conform to corporate mandated configuration standards?
COBIT Domain: Deliver & Support
Process: 9 Manage the Configuration
Control Objective: 9.4 – Configuration Control
Procedures should ensure that the existence and consistency of recording =
of
the IT configuration is periodically checked.
=
5) -
Does your organization use a trouble-ticket system to manage problem
escalation?
COBIT Domain: Deliver & Support
Process: 10 Manage Problems and Incidents
Control Objective: 10.2 – Problem Escalation
IT management should define and implement problem escalation procedures to
ensure that identified problems are solved in the most efficient way on a
timely basis. These procedures should ensure that these priorities are
appropriately set. The procedures should also document the escalation pro=
cess
for the activation of the IT continuity plan.
=
6) - Is a mechanism in place
to provide regular compliance posture and status information to senior
management?
COBIT Domain: Monitoring
Process: 1 Monitor the Process
Control Objective: 1.4 Management Reporting
Management reports should be provided for senior management's review of t=
he
organization’s progress toward identified goals. Status reports sho=
uld
include the extent to which planned objectives have been achieved,
deliverables obtained, performance targets met and risks mitigated. Upon
review, appropriate management action should be initiated and controlled.=
=
7) - Is a process in place
to monitor changes in regulations and how they impact your IT organizatio=
n?
COBIT Domain: Planning and Organization
Process: Monitor Future Trends and Regulations
Detailed Control Objective: 3.2 Continuous monitoring of future trends and
regulatory conditions should be ensured by the IT function so that these
factors can be taken in to consideration during the development and
maintenance of the technological infrastructure plan. <=
/p>
=
8) - Is
a mechanism in place to ensure that user's rights are granted and revoked=
in
accordance with the data ownership throughout the user lifecycle?<=
/strong>
COBIT Domain: Delivery and Service
Process: Ensure Systems Security
Control Objective: 5.9 Central Identification =
and
Access Rights Management.
Controls are in place to ensure that the identification and access rights=
of
users as well as the identity of system and data ownership are established
and managed in a unique and central manner to obtain consistency and
efficiency of global access control.
=
9) - Is a mechanism in place
to ensure proper collection and storage of relevant system security activ=
ity?
COBIT Domain: Delivery and Service
Process: Ensure Systems Security
Control Objective: 5.7 Security Surveillance.<=
br>
IT security administration should ensure that security activity is logged=
and
any indication of imminent security violation is reported immediately to =
all
who may be concerned, internally and externally, and is acted upon in a
timely manner.
=
10) -
Does your organization have a mechanism for maintaining policy alignment =
with
the needs of the organization?
COBIT Domain: Planning and Organization
Process: 6 Communicate Management Aims and Direction
Control Objective: 6.5 Maintenance of Policies=
.
Policies should be adjusted regularly to accommodate changing conditions.
Policies should be re-evaluated, at least annually or upon significant
changes to the operating or business environment, to assess their adequacy
and appropriateness, and amended as necessary. Management should provide a
framework and process for the periodic review and approval of standards,
policies, directives and procedures.
|