Risk and its Impact to(insert company name here) Risk AFTER Mitigation. Objective (A-D)

Transcription

1 Contributed 11/29/99 by Virginia Sutton Corporate Audit Department Date: Audit Project: Mission: Process: Objective A: Objective B: Objective C: Objective D: Physical Security and Environmental Controls Safeguarding Of Assets Integrity Of Data Monitoring/Communication Management Awareness/Control Environment Objective (A-D) Risk and its Impact to(insert company name here) A SAFEGUARDING OF ASSETS 1 Physical Protection Of The Data Center Failure to effectively manage facilities to accommodate the technology used to deliver? business solutions could result in theft, destruction, disruptions and decline in service. a. Physical access procedures have not been established b. Physical access into the premises, and facility is not limited to those individuals whose primary business functions require them to be there. c. Electronic access control system does not exist and are not installed by every entrance to the Data Center. d. Guards are not on duty for all hours of operation. e. Floor-to-ceiling turnstiles, man-traps and antipass back mechanisms do not exist throughout the Data Center Facility. f. The Data Center Facility is readily identifiable and there are too many indications that reveals its existence. g. Closed Circuit Televisions (CCTVs) do not exist and are not monitored by local security personnel. h. Access lists are not maintained by security, documenting individuals (including vendors) who are authorized to access the facility (including the Risk Rating Key Controls (Business Processes) Do they have a process or a compensating control that mitigates the risk? Risk AFTER Mitigation Concerns/Issues W/P Reference 1

2 data center, command center, the print room, output distribution areas, and each floor). i. Procedures do not exist detailing staff instructions for the admittance and control over visitors. j. Unauthorized individuals are not escorted by an authorized individual when they must enter the computer-room facility. k. Visitor logs do not exist or they exist but are not consistently used.. 2 Environmental Support Systems a. An approved emergency plan does not exist for the Data Center facility. b. Emergency evacuation procedures are not posted in conspicuous areas. c. Procedures have not been established for personnel and equipment safety in the event of a power outage. d. Procedures do not include floor plans with evacuation routes. e. Procedures do not exist for giving the immediate alarm of a fire and reporting the fire, shutdown of the computer equipment and air conditioning. f. A method of evacuating handicapped personnel with personnel assignment for assuring assistance does not exist. g. The procedures note above are not periodically tested. h. First aid kits and other emergency medical equipment are not available throughout the facility. i. Fail-safe and override provisions have not been made for alarms, man-traps, double-door entries, badge operated locks, and other electricalmechanical security devices in the event of an emergency. j. Emergency procedures have not been distributed to all personnel. k. An automated fire detection/suppression system does not exist or exists and is not tested yearly. l. Fire extinguishers and other fire related X-Ref

3 equipment are not properly located (placed over 75 feet from each other) and unobstructed. m. Fire extinguishers are not in good operating condition, not tagged nor inspected on a yearly basis. n. The location of the fire extinguishers are not clearly marked in red with contrasting o. Air conditioning, including support for a unit failure does not exist. p. An Uninterrupted Power Supply (UPS) system does not exist. q. Back up generators do not exist. r. Transformers do not exist. s. Chillers do not exist. t. Control boxes are not clearly labeled and drawings of the equipment and the flow of current, water, etc. are not marked. Finding A5-3 #15 3 Environmental Systems and Computer Hardware Inspection a. Procedures/contracts do not exist for the periodic preventive maintenance. b. Periodic tests of equipment are not performed and corrective action is not taken when tests indicate a problem. c. Critical Operating Systems hardware maintenance reviews are not performed. d. The UPS systems, fans, boilers, generators, electrical equipment, air-compressors/dryers, and pumps (circulators, spray, chemicals) are not maintained daily, and quarterly reviews are also not performed. e. Temperature and humidity settings, humidifier operations, filters, belts, door, and panels are not maintained. 4 Hazardous Conditions a. The data center shows signs of eating, drinking and/or smoking. b. Forms and other supplies are not kept to a minimum and the manner which they are presently kept represents a safety hazard. Storage

4 rooms and aisles are not clear, neat and orderly (cluttered).

5 c. Flammable liquids are not safely stored. d. Trash is not contained in flame-retardant containers, nor is it removed daily. e. Electrical and telecommunication wires are out in the open rather than stored neatly in cabinets. g. Extension cords are used regularly. h. The raised floors in the data center are not cleaned semi-annually. i. Water is present under the floors j. Electrical wires that exist under the raised floor are cracked, broken and/or frayed k. Large accumulations of dust/dirt exists under the raised floors.