City of Milwaukee Employes Retirement System (ERS)
|
|
|
- Godwin Wade
- 7 years ago
- Views:
Transcription
1 City of Milwaukee Employes Retirement System (ERS) Change Management Audit Report OCTOBER 1, 2009 JEFFERSON WELLS 330 EAST KILBOURN AVENUE, SUITE 1075 MILWAUKEE, WI (414) JACK BULLIS, ENGAGEMENT MANAGER CONNIE MCDONALD, DIRECTOR
2 TABLE OF CONTENTS EXECUTIVE SUMMARY... 3 Scope... 3 Conclusion... 4 PROCEDURES PERFORMED... 5 ISSUE, RECOMMENDATIONS & MANAGEMENT S RESPONSE... 6 Formal Change Management Policy and Procedures... 6 Page 2 of 6
3 EXECUTIVE SUMMARY Scope As part of the annual audit plan, Jefferson Wells completed an audit of the change management process at ERS. Change management is the process used to monitor and control modifications made to systems. Modifications should be monitored and controlled to help ensure unauthorized or untested changes are not installed on production equipment. An increase in system vulnerabilities and downtime can occur when change management processes are not in place. Change management policies and procedures help ensure that all modifications are approved and fully tested before they are moved to the production environment. The objective of the change management audit was to determine whether ERS has implemented a change management process that assesses the risk of its application, hardware, operating system, and database changes; and requires appropriate efforts to monitor and mitigate those risks. A comprehensive change management program generally includes an assessment of risks to identify needs, the importance and criticality of the function, and the necessary controls and reporting processes over the activity. Based on the risk level, the process should define the need for, and extent of the following activities: Controls provide reasonable assurance that system changes are authorized and appropriately tested before being moved to production Requests for program changes, system changes, and maintenance are standardized, logged, approved, documented, and subject to formal change management procedures Emergency change requests are documented and subject to formal change management procedures Controls are in place to restrict migration of programs to production by authorized individuals only Fieldwork was completed from March 16, 2009, through April 30, The audit included interviews (IT and business unit personnel), observations, sample testing, and review of documentation. Page 3 of 6
4 Conclusion This report reflects the results of the Jefferson Wells change management audit. Based on the results of this review, ERS has implemented certain elements of a comprehensive change management program including the following: Requests for MERITS application changes are standardized, documented, and subject to formal change management procedures Requests for changes to the MERITS application are prioritized, using clearly defined criteria, and are addressed following pre-defined schedules based on severity or priority Emergency application change requests are documented and subject to formal change management procedures A log is maintained of change history steps for application changes as a part of the PIR (Program Investigation Request) or CCR (Change Control Request) ticket A separate test environment is used for the testing of all changes before being migrated into production Controls are in place to restrict migration of application programs to production only by authorized individuals ERS does not have a formalized change management policy. It has developed draft MERITS Testing Standards (Guidelines) and has implemented an Operating System Updates Procedure. Established procedures appear to be followed. At the time of this audit, changes such as patches and actions taken to mitigate vulnerabilities were not being formally documented. These changes go through the technical change management process by deploying and testing first in the development environment, then in system test and ultimately in production. Significant changes related to software upgrades are tracked through a change control request in the tracking system. (See change management finding in the Information Security Audit report dated July 20, 2009.) ERS has taken steps to develop formal policies and procedures, including change management. Page 4 of 6
5 PROCEDURES PERFORMED The following procedures were performed during the internal audit. Conducted interviews with key IS personnel. Reviewed all policies and procedures (finalized or draft) related to change management practices. Tested a sample of 25 Change Control Requests and Program Investigation Requests for changes occurring during the period January 2, 2008, through March 23, 2009, including: o Evidence of priority determination o Ownership o Release assignment o Testing o Status o Documentation of steps performed o Production migration or closing without change Reviewed the process for emergency changes. Conducted interviews with business process owners and QA personnel regarding change initiation, testing, and implementation approval. Verified segregation of duties regarding migration of changes into the production environment. Page 5 of 6
6 ISSUES, RECOMMENDATIONS & MANAGEMENT S RESPONSE Formal Change Management Policy and Procedures A formal, documented Change Management Policy does not exist. Although the guidelines followed for MERITS changes appear to be consistently followed, they are in draft form. Finalizing, approving, and implementing policies and procedures could only help enforce and standardize the practices in place within ERS. Recommendation: Management should develop a formal Change Management Policy that provides specific guidance regarding application changes, operating system changes, hardware changes, emergency changes, and patch management. Procedures should be formalized to address hardware (configuration settings, maintenance, planned, unplanned, and emergency changes) as well as application and database changes. Management Response: The ERS has a fairly consistent change management approach and methodology. We are currently in the process of documenting our procedures. Estimated Completion Date: December 31, 2009 Responsible Party: Martin Matson Page 6 of 6
City of Milwaukee Employes Retirement System (ERS)
City of Milwaukee Employes Retirement System (ERS) Vendor Management Audit Report JANUARY 30, 2009 JEFFERSON WELLS 330 EAST KILBOURN AVENUE, SUITE 1075 MILWAUKEE, WI 53202 (414) 347-2345 SUSAN OBERMILLER,
05.0 Application Development
Number 5.0 Policy Owner Information Security and Technology Policy Application Development Effective 01/01/2014 Last Revision 12/30/2013 Department of Innovation and Technology 5. Application Development
Standard CIP 007 3a Cyber Security Systems Security Management
A. Introduction 1. Title: Cyber Security Systems Security Management 2. Number: CIP-007-3a 3. Purpose: Standard CIP-007-3 requires Responsible Entities to define methods, processes, and procedures for
FOLLOW-UP REPORT Change Management Practices
FOLLOW-UP REPORT Change Management Practices May 2016 Office of the Auditor Audit Services Division City and County of Denver Timothy M. O Brien, CPA The Auditor of the City and County of Denver is independently
Tackling Medical Device Cybersecurity
Tackling Medical Device Cybersecurity Anthony J. Coronado Methodist Hospital of Southern California Biomedical Engineering Manager Overview of Initiative With the advancement of technology in the design
Change Management Control Procedure
Change Management Control Procedure Procedure Name: Procedure Number: Prepared By: Approved By: Change Management Control ESS100 Nancy Severance Director, Administrative Computing Services Paul Foley Director,
How To Control Vcloud Air From A Microsoft Vcloud 1.1.1 (Vcloud)
SOC 1 Control Objectives/Activities Matrix goes to great lengths to ensure the security and availability of vcloud Air services. In this effort, we have undergone a variety of industry standard audits,
Performance Audit E-Service Systems Security
Performance Audit E-Service Systems Security October 2009 City Auditor s Office City of Kansas City, Missouri 15-2008 October 21, 2009 Honorable Mayor and Members of the City Council: This performance
Feedback Ferret. Security Incident Response Plan
Feedback Ferret Security Incident Response Plan Document Reference Feedback Ferret Security Incident Response Plan Version 3.0 Date Created June 2013 Effective From 20 June 2013 Issued By Feedback Ferret
ROSS PHILO EXECUTIVE VICE PRESIDENT AND CHIEF INFORMATION OFFICER
July 22, 2010 ROSS PHILO EXECUTIVE VICE PRESIDENT AND CHIEF INFORMATION OFFICER DEBORAH J. JUDY DIRECTOR, INFORMATION TECHNOLOGY OPERATIONS CHARLES L. MCGANN, JR. MANAGER, CORPORATE INFORMATION SECURITY
PDS (The Planetary Data System) Information Technology Security Plan for The Planetary Data System: [Node Name]
![PDS (The Planetary Data System) Information Technology Security Plan for The Planetary Data System: [Node Name]](/thumbs/26/8303709.jpg "PDS (The Planetary Data System) Information Technology Security Plan for The Planetary Data System: [Node Name]")
PDS (The Planetary Data System) Information Technology Security Plan for The Planetary Data System: [Node Name] [Date] [Location] 1 Prepared by: [Author] [Title] Date Approved by: [Name] [Title] Date 2
State of Oregon. State of Oregon 1
State of Oregon State of Oregon 1 Table of Contents 1. Introduction...1 2. Information Asset Management...2 3. Communication Operations...7 3.3 Workstation Management... 7 3.9 Log management... 11 4. Information
z/os VULNERABILITY SCANNING AND MANAGEMENT Key Resources, Inc. ray.overby@kr-inc.com (312) KRI-0007 www.kr-inc.com
1 z/os VULNERABILITY SCANNING AND MANAGEMENT Key Resources, Inc. ray.overby@kr-inc.com (312) KRI-0007 www.kr-inc.com 2 Ray Overby SKK - ACF2 Developer (1981-1988) Key Resources, Inc. incorporated in 1988
Submitted by: Christopher Mead, Director, Department of Information Technology
Office of the City Manager INFORMATION CALENDAR March 21, 2006 To: From: Honorable Mayor and Members of the City Council Phil Kamlarz, City Manager Submitted by: Christopher Mead, Director, Department
Department of Information Technology Software Change Control Audit - Mainframe Systems Final Report
Department of Information Technology Software Change Control Audit - Mainframe Systems Final Report March 2007 promoting efficient & effective local government Introduction Software change involves modifications
Audit of Cell Phone Device Management and Utilization Controls
Audit of Cell Phone Device Management and Utilization Controls MARTIN MATSON City Comptroller AYCHA SIRVANCI, CPA Audit Manager City of Milwaukee, Wisconsin February 2014 Table of Contents Transmittal
Audit Report. Effectiveness of IT Controls at the Global Fund Follow-up report. GF-OIG-15-20b 26 November 2015 Geneva, Switzerland
Audit Report Effectiveness of IT Controls at the Global Fund Follow-up report GF-OIG-15-20b Geneva, Switzerland Table of Contents I. Background and scope... 3 II. Executive Summary... 4 III. Status of
Project Charter and Scope Statement
Prepared by: Mike Schmidt Version: 1.0 Last Revision Date: April 14, 2010 Create Date: May 6, 2010 EXECUTIVE SUMMARY... 3 1 INTRODUCTION... 4 2 PROJECT OBJECTIVES... 4 2.1 MISSION... 4 2.2 OBJECTIVES...
ITIL Version 3.0 (V.3) Service Transition Guidelines By Braun Tacon
ITIL Version 3.0 (V.3) Service Transition Guidelines By Braun Tacon Executive Summary: This document is seven pages. Page one is informational/background only. What follows over the next six pages are
AUSTIN INDEPENDENT SCHOOL DISTRICT INTERNAL AUDIT DEPARTMENT TRANSPORTATION AUDIT PROGRAM
GENERAL: The Technology department is responsible for the managing of electronic devices and software for the District, as well as the Help Desk for resolution of employee-created help tickets. The subgroups
Evaluation Report. Weaknesses Identified During the FY 2013 Federal Information Security Management Act Review. April 30, 2014 Report Number 14-12
Evaluation Report Weaknesses Identified During the FY 2013 Federal Information Security Management Act Review April 30, 2014 Report Number 14-12 U.S. Small Business Administration Office of Inspector General
Standard CIP 007 3 Cyber Security Systems Security Management
A. Introduction 1. Title: Cyber Security Systems Security Management 2. Number: CIP-007-3 3. Purpose: Standard CIP-007-3 requires Responsible Entities to define methods, processes, and procedures for securing
IMPLEMENTATION DETAILS
Policy: Title: Status: 1. Introduction ISP-I11 Software License Regulations Approved Information Security Policy Documentation IMPLEMENTATION DETAILS 1.1. The Software Management Policy (ISP-S13) makes
POSITION QUALIFICATIONS. Minimum Experience (Yrs)
POSITION QUALIFICATIONS Core Labor Category Skill Minimum Education Minimum Experience (Yrs) Labor Category Description Technical Manager, Principal Bachelors Degree 12 Technical Manager, Senior Bachelors
PREPARED BY: AUDIT PROGRAM Author: Lance M. Turcato. APPROVED BY: Logical Security Operating Systems - Generic. Audit Date:
A SYSTEMS UNDERSTANDING A 1.0 Organization Objective: To ensure that the audit team has a clear understanding of the delineation of responsibilities for system administration and maintenance. A 1.1 Determine
VICNET is G-Cloud7 GOV UK Supplier VISIT DIGITAL MARKET PLACE VICNETCLOUD VICNET CLOUD MIGRATION SERVICES
VICNET is G-Cloud7 GOV UK Supplier VISIT DIGITAL MARKET PLACE VICNETCLOUD VICNET CLOUD MIGRATION SERVICES Consult and assess your business and technical requirements Advise you on the best cloud solutions
Richmond Police Department Police Records Management System (PISTOL) 12 Months ended December 31, 2011
REPORT # 2012-10 AUDIT Of the TABLE OF CONTENTS Executive Summary..... i Comprehensive List of Recommendations. iii Introduction.......... 1 Background........ 2 Conclusion........ 3 Recommendations........
Office of the Auditor General Performance Audit Report. Statewide Oracle Database Controls Department of Technology, Management, and Budget
Office of the Auditor General Performance Audit Report Statewide Oracle Database Controls Department of Technology, Management, and Budget March 2015 071-0565-14 State of Michigan Auditor General Doug
Information Shield Solution Matrix for CIP Security Standards
Information Shield Solution Matrix for CIP Security Standards The following table illustrates how specific topic categories within ISO 27002 map to the cyber security requirements of the Mandatory Reliability
STATE OF NORTH CAROLINA
STATE OF NORTH CAROLINA INFORMATION SYSTEMS AUDIT OFFICE OF INFORMATION TECHNOLOGY SERVICES INFORMATION TECHNOLOGY GENERAL CONTROLS OCTOBER 2014 OFFICE OF THE STATE AUDITOR BETH A. WOOD, CPA STATE AUDITOR
Appendix A-2 Generic Job Titles for respective categories
Appendix A-2 for respective categories A2.1 Job Category Software Engineering/Software Development Competency Level Master 1. Participate in the strategic management of software development. 2. Provide
Mecklenburg County Department of Internal Audit. PeopleSoft Application Security Audit Report 1452
Mecklenburg County Department of Internal Audit PeopleSoft Application Security Audit Report 1452 February 9, 2015 Internal Audit s Mission Through open communication, professionalism, expertise and trust,
SYLOGENT DEDICATED HOSTING
HOSTING & PROCESS SYLOGENT DEDICATED HOSTING VM VM VM VM VM VM VM VM VM VM VM VM VM VM VM HYPERVISOR HYPERVISOR HYPERVISOR DB1 active DB2 passive Clustered hypervisors that host dedicated VMs integrated
Centrify Server Suite Management Tools
SERVER SUITE TECHNICAL BRIEF Centrify Server Suite Management Tools Centrify Server Suite includes - at no extra charge - a powerful set of management tools in all editions: Centrify Identity Risk Assessor
EMNAMBITHI/LADYSMITH MUNICIPALITY CHANGE MANAGEMENT POLICY
EMNAMBITHI/LADYSMITH MUNICIPALITY CHANGE MANAGEMENT POLICY Emnambithi/Ladysmith Municipality Change Management Policy 2015/2016 Page 1 of 7 Document Configuration Management Document Identification File
Features. Emerson Solutions for Abnormal Situations
Features Comprehensive solutions for prevention, awareness, response, and analysis of abnormal situations Early detection of potential process and equipment problems Predictive intelligence network to
CYBER SECURITY POLICY For Managers of Drinking Water Systems
CYBER SECURITY POLICY For Managers of Drinking Water Systems Excerpt from Cyber Security Assessment and Recommended Approach, Final Report STATE OF DELAWARE DRINKING WATER SYSTEMS February 206 Kash Srinivasan
TechExcel. ITIL Process Guide. Sample Project for Incident Management, Change Management, and Problem Management. Certified
TechExcel ITIL Process Guide Sample Project for Incident Management, Management, and Problem Management. Certified Incident Management Red Arrows indicate that the transition is done automatically using
Attachment A. Identification of Risks/Cybersecurity Governance
Attachment A Identification of Risks/Cybersecurity Governance 1. For each of the following practices employed by the Firm for management of information security assets, please provide the month and year
Why SaaS (Software as a Service) and not COTS (Commercial Off The Shelf software)?
SaaS vs. COTS Why SaaS (Software as a Service) and not COTS (Commercial Off The Shelf software)? Unlike COTS solutions, SIMCO s CERDAAC is software that is offered as a service (SaaS). This offers several
Information Technology General Controls (ITGCs) 101
Information Technology General Controls (ITGCs) 101 Presented by Sugako Amasaki (Principal Auditor) University of California, San Francisco December 3, 2015 Internal Audit Webinar Series Webinar Agenda
Advanced Solutions of Microsoft Exchange Server 2013
Advanced Solutions of Microsoft Exchange Server 2013 Course 20342B: 5 days Module 1: Designing and Implementing Site Resilience This module explains how to design and implement site resilience for Exchange
CSUSB Web Application Security Standard CSUSB, Information Security & Emerging Technologies Office
CSUSB, Information Security & Emerging Technologies Office Last Revised: 03/17/2015 Draft REVISION CONTROL Document Title: Author: File Reference: CSUSB Web Application Security Standard Javier Torner
BKDconnect Security Overview
BKDconnect Security Overview 1 Introduction 1.1 What is BKDconnect 1.2 Site Creation 1.3 Client Authentication and Access 2 Security Design 2.1 Confidentiality 2.1.1 Least Privilege and Role Based Security
Department of Information Technology Remote Access Audit Final Report. January 2010. promoting efficient & effective local government
Department of Information Technology Remote Access Audit Final Report January 2010 promoting efficient & effective local government Background Remote access is a service provided by the county to the Fairfax
Enforcing IT Change Management Policy
WHITE paper Everything flows, nothing stands still. Heraclitus page 2 page 2 page 3 page 5 page 6 page 8 Introduction How High-performing Organizations Manage Change Maturing IT Processes Enforcing Change
INFORMATION SECURITY AT THE HEALTH RESOURCES AND SERVICES ADMINISTRATION NEEDS IMPROVEMENT BECAUSE CONTROLS WERE NOT FULLY IMPLEMENTED AND MONITORED
Department of Health and Human Services OFFICE OF INSPECTOR GENERAL INFORMATION SECURITY AT THE HEALTH RESOURCES AND SERVICES ADMINISTRATION NEEDS IMPROVEMENT BECAUSE CONTROLS WERE NOT FULLY IMPLEMENTED
Introduction to Change
Introduction to Management and SDLC Steve Owyoung Sr. Manager KPMG LLP, IT Advisory Doug Mohrland Audit Manager Oracle Corporation Discussiontopics o significance o o s o o o o Software (SDLC) s Organization
Terms and Definitions Table below summarizes the terms as used within this SCG and associated definitions.
Terms and Definitions Table below summarizes the terms as used within this SCG and associated definitions. Term Administrator/ Privileged User Client Contractor EPS Data EPS Operational Data EPS Infrastructure
AUTOMATING THE 20 CRITICAL SECURITY CONTROLS
AUTOMATING THE 20 CRITICAL SECURITY CONTROLS Wolfgang Kandek, CTO Qualys Session ID: Session Classification: SPO-T07 Intermediate 2012 the Year of Data Breaches 2013 continued in a similar Way Background
Exhibit to Data Center Services Service Component Provider Master Services Agreement
Exhibit to Data Center Services Service Component Provider Master Services Agreement DIR Contract No. DIR-DCS-SCP-MSA-002 Between The State of Texas, acting by and through the Texas Department of Information
ITS Change Management Guidelines
ITS Change Management Guidelines Revision 3.0 Original drafted March 5, 2002 Revision 3.1 Version Update November 28, 2011 Revision 3.2 Version Updated February 24, 2012 Revision 3.3 Current Version Updated
Data Privacy and Gramm- Leach-Bliley Act Section 501(b)
Data Privacy and Gramm- Leach-Bliley Act Section 501(b) October 2007 2007 Enterprise Risk Management, Inc. Agenda Introduction and Fundamentals Gramm-Leach-Bliley Act, Section 501(b) GLBA Life Cycle Enforcement
Internal Audit Report ITS CHANGE MANAGEMENT PROCESS. Report No. SC-11-11
Internal Audit Report ITS CHANGE MANAGEMENT PROCESS Report No. SC-11-11 March 2011 SANTA CRUZ: INTERNAL AUDIT March 31, 2011 MARY DOYLE Vice Chancellor Information Technology Re: Internal Audit Report
Final Audit Report -- CAUTION --
U.S. OFFICE OF PERSONNEL MANAGEMENT OFFICE OF THE INSPECTOR GENERAL OFFICE OF AUDITS Final Audit Report Audit of Information Systems General and Application Controls and Administrative Expense Review at
CMS Policy for Configuration Management
Chief Information Officer Centers for Medicare & Medicaid Services CMS Policy for Configuration April 2012 Document Number: CMS-CIO-POL-MGT01-01 TABLE OF CONTENTS 1. PURPOSE...1 2. BACKGROUND...1 3. CONFIGURATION
Proving Control of the Infrastructure
WHITE paper The need for independent detective controls within Change/Configuration Management page 2 page 3 page 4 page 6 page 7 Getting Control The Control Triad: Preventive, Detective and Corrective
Toronto Maintenance Management System Application Review. the exercise to harmonize business practices is completed;
STAFF REPORT March 30, 2004 To: From: Subject: Audit Committee Auditor General Toronto Maintenance Management System Application Review Purpose: The purpose of this audit was to assess how well the Toronto
AHS Flaw Remediation Standard
AGENCY OF HUMAN SERVICES AHS Flaw Remediation Standard Jack Green 10/14/2013 The purpose of this procedure is to facilitate the implementation of the Vermont Health Connect s security control requirements
Bridging Development and Operations: The Secret of Streamlining Release Management
Bridging Development and Operations: The Secret of Streamlining Release Management Mark Levy, Product Manager Serena Software SERENA SOFTWARE INC. Release Management Goal Deploy application changes into
Office of the State Auditor. Audit Report
Office of the State Auditor Audit Report Department of the Treasury Office of Telecommunications and Information Systems River Road and Barrack Street Data enters March 6, 1995 to September 30, 1995 Department
SRA International Managed Information Systems Internal Audit Report
SRA International Managed Information Systems Internal Audit Report Report #2014-03 June 18, 2014 Table of Contents Executive Summary... 3 Background Information... 4 Background... 4 Audit Objectives...
Performance Audit of the San Diego Convention Center s Information Technology Infrastructure JULY 2012
Performance Audit of the San Diego Convention Center s Information Technology Infrastructure JULY 2012 Audit Report Office of the City Auditor City of San Diego This Page Intentionally Left Blank July
Trusted Geolocation in the Cloud. Based on NIST Interagency Report 7904 - Trusted Geolocation in the Cloud: Proof of Concept Implementation
Trusted Geolocation in the Cloud Based on NIST Interagency Report 7904 - Trusted Geolocation in the Cloud: Proof of Concept Implementation 2 Agenda Definition of cloud computing Trusted Geolocation in
IT ASSET MANAGEMENT Securing Assets for the Financial Services Sector
IT ASSET MANAGEMENT Securing Assets for the Financial Services Sector V.2 Final Draft May 1, 2014 financial_nccoe@nist.gov This revision incorporates comments from the public. Page Use case 1 Comments
Internal Audit Quarterly Report University of Missouri June 2014
Internal Audit Quarterly Report University of Missouri June 2014 Listed below are the internal audit reports that were issued since the April 2014 meeting of the Board of Curators. A summary of action
Service Asset & Configuration Management PinkVERIFY
-11-G-001 General Criteria Does the tool use ITIL 2011 Edition process terms and align to ITIL 2011 Edition workflows and process integrations? -11-G-002 Does the tool have security controls in place to
Welcome to part 2 of the HIPAA Security Administrative Safeguards presentation. This presentation covers information access management, security
Welcome to part 2 of the HIPAA Security Administrative Safeguards presentation. This presentation covers information access management, security awareness training, and security incident procedures. The
UoB Risk Assessment Methodology
[Type here] UoB Risk Assessment Methodology The Risk Assessment Methodology describes how information security risk will be managed, including guidance for assessing, scoring, choosing acceptance or treatment
Office of the Auditor General Performance Audit Report. Statewide UNIX Security Controls Department of Technology, Management, and Budget
Office of the Auditor General Performance Audit Report Statewide UNIX Security Controls Department of Technology, Management, and Budget December 2015 State of Michigan Auditor General Doug A. Ringler,
EVALUATION REPORT. Weaknesses Identified During the FY 2014 Federal Information Security Management Act Review. March 13, 2015 REPORT NUMBER 15-07
EVALUATION REPORT Weaknesses Identified During the FY 2014 Federal Information Security Management Act Review March 13, 2015 REPORT NUMBER 15-07 EXECUTIVE SUMMARY Weaknesses Identified During the FY 2014
Audit of NSERC Award Management Information System
Internal Audit Audit Report Audit of NSERC Award Management Information System TABLE OF CONTENTS 1. EXECUTIVE SUMMARY... 2 2. INTRODUCTION... 3 3. AUDIT FINDINGS- BUSINESS PROCESS CONTROLS... 5 4. AUDIT
Department of Public Utilities Customer Information System (BANNER)
REPORT # 2010-06 AUDIT of the Customer Information System (BANNER) January 2010 TABLE OF CONTENTS Executive Summary..... i Comprehensive List of Recommendations. iii Introduction, Objective, Methodology
DotNetNuke (DNN) Hosting Environment
Prepared July 27, 2012 R E Q U E S T F O R Q U O T A T I O N Page 1 of 13 Table of Contents INTRODUCTION AND BACKGROUND...3 PURPOSE OF THE REQUEST FOR QUOTATION...3 BACKGROUND...3 ADMINISTRATIVE...5 DUE
Columbia College Process for Change Management Page 1 of 7
Page 1 of 7 Executive Summary Columbia College's Process for Change Management is designed to provide an orderly and documented method in which changes to the College's computing environment are requested
28400 POLICY IT SECURITY MANAGEMENT
Version: 2.2 Last Updated: 30/01/14 Review Date: 27/01/17 ECHR Potential Equality Impact Assessment: Low 1. About This Policy 1.1. The objective of this policy is to provide direction and support for IT
Information Security Policy. Chapter 13. Information Systems Acquisition Development and Maintenance Policy
Information Security Policy Chapter 13 Information Systems Acquisition Development and Maintenance Policy Author: Policy & Strategy Team Version: 0.3 Date: June 2008 Document Control Information Document
Patch and Vulnerability Management Program
Patch and Vulnerability Management Program What is it? A security practice designed to proactively prevent the exploitation of IT vulnerabilities within an organization To reduce the time and money spent
Baker Tilly simplifies Windows 7 deployment with CA Technologies solutions
Customer success story Baker Tilly simplifies Windows 7 deployment with CA Technologies solutions Customer profile Industry: Professional services Company: Baker Tilly Employees: 2,400 Revenue: 204 million
The Business Case For Private Cloud Services
Velocity Technology Solutions / April 2015 This Private Cloud Services guide will: Define a common vocabulary around Private Cloud Service Providers Describe how Private Cloud Services can reduce the total
Application Maintenance and Development Attachment C for RFP#
Application Maintenance and Development Attachment C for RFP# Service Level Agreements and Operating Level Agreements Issue: 1.0 Issue Date: November 17, 2015 Issue 1.0 November 17, 2015 1 Copyright 2015
MONITORING AND VULNERABILITY MANAGEMENT PCI COMPLIANCE JUNE 2014
MONITORING AND VULNERABILITY MANAGEMENT PCI COMPLIANCE JUNE 2014 COMPLIANCE SCHEDULE REQUIREMENT PERIOD DESCRIPTION REQUIREMENT PERIOD DESCRIPTION 8.5.6 As Needed 11.1 Monthly 1.3 Quarterly 1.1.6 Semi-Annually
Domain 1 The Process of Auditing Information Systems
Certified Information Systems Auditor (CISA ) Certification Course Description Our 5-day ISACA Certified Information Systems Auditor (CISA) training course equips information professionals with the knowledge
Information Technology Branch Access Control Technical Standard
Information Technology Branch Access Control Technical Standard Information Management, Administrative Directive A1461 Cyber Security Technical Standard # 5 November 20, 2014 Approved: Date: November 20,
Oracle Maps Cloud Service Enterprise Hosting and Delivery Policies Effective Date: October 1, 2015 Version 1.0
Oracle Maps Cloud Service Enterprise Hosting and Delivery Policies Effective Date: October 1, 2015 Version 1.0 Unless otherwise stated, these Oracle Maps Cloud Service Enterprise Hosting and Delivery Policies
Change Management Process. June 1, 2011 Version 2.7
Change Management Process June 1, 2011 Version 2.7 Contents Document Control... 3 Overview... 4 Definition of a Change... 5 Description... 5 Objectives... 5 Key Terms & Definitions... 6 Change Management
Payment Card Industry (PCI) Data Security Standard Self-Assessment Questionnaire C and Attestation of Compliance
Payment Card Industry (PCI) Data Security Standard Self-Assessment Questionnaire C and Attestation of Compliance Payment Application Connected to Internet, No Electronic Cardholder Data Storage Version
Server Management-Scans & Patches
THE UNIVERSITY OF TEXAS-PAN AMERICAN OFFICE OF AUDITS & CONSULTING SERVICES Server Management-Scans & Patches Report No. 14-11 OFFICE OF INTERNAL AUDITS THE UNIVERSITY OF TEXAS - PAN AMERICAN 1201 West
Identifying & Implementing Quick Wins
Identifying & Implementing Quick Wins 1 Executive Summary........3 2 Introduction....... 5 3 Key Steps to Quick Wins....... 7 4 Sample Quick Wins...8 4.1 People Quick Wins... 8 4.2 Process Quick Wins......9
UMHLABUYALINGANA MUNICIPALITY IT CHANGE MANAGEMENT POLICY
UMHLABUYALINGANA MUNICIPALITY IT CHANGE MANAGEMENT POLICY Originator IT Change Management Policy Approval and Version Control Approval Process: Position or Meeting Number: Date: Recommended by Director
CITY UNIVERSITY OF HONG KONG. Information System Acquisition, PUBLIC Development and Maintenance Standard
CITY UNIVERSITY OF HONG KONG Development and Maintenance Standard (Approved by the Information Strategy and Governance Committee in December 2013; revision 1.1 approved by Chief Information Officer in
Platform as a Service (PaaS) Policies and Procedures
Platform as a Service (PaaS) Policies and Procedures PaaS Policies and Procedures Purpose of this document is to define what a Platform as a Service (PaaS) customer will need to do in order to use the
Office of Information Technology Hosted Services Service Level Agreement FY2009
Application Name: Application Agreement Start Date: 07/01/08 Customer Name: Customer Agreement Renewal Date: 06/30/09 SLA Number: HSxxxFY09A Service Description: This document describes the technical support
U.S. Department of Energy Office of Inspector General Office of Audits and Inspections
U.S. Department of Energy Office of Inspector General Office of Audits and Inspections Audit Report Management of Bonneville Power Administration's Information Technology Program DOE/IG-0861 March 2012
Following is a discussion of the Hub s role within the health insurance exchanges, the results of our review, and concluding observations.
Testimony of: Kay Daly Assistant Inspector General for Audit Services Office of Inspector General, U.S. Department of Health and Human Services Hearing Title: The Threat to Americans Personal Information:
TO CREDIT UNIONS DATE: June 10, 1998
NATIONAL CREDIT UNION ADMINISTRATION NATIONAL CREDIT UNION SHARE INSURANCE FUND LETTER LETTER NO.: 98-CU-12 TO CREDIT UNIONS DATE: June 10, 1998 SUBJECT: Business Resumption Contingency Planning Letter
Can SaaS be your strategic advantage in building software? Presented by: Paul Gatty, Director of World Wide Operations
Can SaaS be your strategic advantage in building software? Presented by: Paul Gatty, Director of World Wide Operations Topics What is SaaS? How does SaaS differ from managed hosting? Advantages of SaaS
Implementing Practical Information Security Programs
Implementing Practical Information Security Programs CISO Summit March 17-19, 2013 Presented by: David Cass, SVP & Chief Information Security Officer, Elsevier Information Security & Data Protection Office
AUDIT REPORT. Cybersecurity Controls Over a Major National Nuclear Security Administration Information System
U.S. Department of Energy Office of Inspector General Office of Audits and Inspections AUDIT REPORT Cybersecurity Controls Over a Major National Nuclear Security Administration Information System DOE/IG-0938
VMware vcloud Air HIPAA Matrix
goes to great lengths to ensure the security and availability of vcloud Air services. In this effort VMware has completed an independent third party examination of vcloud Air against applicable regulatory