IT Governance Controls

1. An Information Security Management System (ISMS) plan and policy exists and has been approved by Executive Management.
2. Control activities: Information Security policies and standards are documented/updated and reviewed/signed-off by Executive Management on a periodic basis.
3. Information Security policies and standards are communicated to the appropriate personnel and training is conducted

1. Covered in Continuous Exploration

The enterprise has processes to monitor compliance with Information Security policies and standards.

Note: Overall security review with involvement of IT Security team before a release.

Control activities:

1. Non-compliance to Information Security policies and standards is monitored, tracked and are reported on

2. Non-compliance to Information Security policies and standards are actioned by the business and/or IT owner(s) based on risk and impact to the organization

1. Covered in Continuous Integration

The organization has a solution development methodology that contains a set of requirements, which includes security and processing integrity controls, that are adhered to throughout the solution development lifecycle.

1. The solution development methodology is documented/updated and reviewed/signed-off by the IT owner(s) on a periodic basis

2. The solution development methodology requires that any changes identified will be authorized and prioritized by business owners and aligned to quarterly objectives and desired business outcomes

3. The solution development methodology requires planning for the ongoing maintenance of the systems/solutions developed

4. The solution development methodology requires defining new and changed IT services and service levels of developed systems/solutions

5. The solution development methodology requires initiative closure and acceptance be performed by the business owner for work having a defined start and end date. For work delivered through agile continuous delivery, the business owner accepts all changes and authorizes them at production release

6. The solution development methodology requires defining new and changed IT services and service levels of developed systems/solutions

7. The solution development methodology requires initiative closure and acceptance be performed by the business owner for work having a defined start and end date. For work delivered through agile continuous delivery, the business owner accepts all changes and authorizes them at production release

1. Activities 1 & 2 are covered in Continuous Integration

2. Activities 3, 4 ,5, 6 & 7 are covered in [new] Continuous Deployment

The solution development methodology through architectural and security practices includes requirements that information systems are designed with to include application controls that support complete, accurate, authorized and valid transaction processing.

Control activities:

1. Requirements for configuration/calculation/exception handling application and system controls are defined and built into solutions that support complete, accurate, authorized and valid transaction processing

2. Interface validation mechanisms are defined and built into solutions to support completeness, accuracy and timeliness of data being transferred between system

3. Access control mechanisms are defined and built into solutions to ensure that access to systems, functionality and data is restricted to authorized personnel only

1. Activity 1 is covered in Continuous Exploration

2. Activity 2 & 3 are covered in Continuous Integration

The enterprise has a solution development methodology that defines and maintains business functional and technical requirements that are endorsed by all stakeholders.

Control activities:

1. Product/business owner(s) review and authorize/approve all work/requirements as part of quarterly planning

2. Product/business owner(s) review and authorize/approve the final choice of solution, acquisition approach and high-level design, aligned to the desired business outcome. This is achieved through the quarterly planning process

3. Product/business owner(s) review and authorize/approve User Acceptance Testing (UAT) results

1. Activity 1 & 2 are covered in Continuous Integration

2. Activity 3 is covered in [new] Continuous Deployment

The organization has a solution development methodology that contains a set of requirements, which includes security and processing integrity controls, that are adhered to throughout the system development lifecycle.

Control activities:

1. In-house IT developments (including infrastructure) and/or procured systems comply with the solution development methodology

1. Covered in Continuous Integration

Requests for program changes and system changes (including maintenance) are standardized, logged, evaluated, prioritized and approved. The enterprise maintains a change management repository to track all requested changes, including the status of approved, in-progress and closed changes. IT Management implements system software that does not jeopardize the security of programs or the integrity of data stored on the system. Post-implementation reviews are conducted to confirm outcomes and results.

Control activities:

1. The Change Management process/procedures are documented/updated and reviewed/signed-off by the IT owner(s) on a periodic basis

2. All change requests are documented/logged in a change management repository which includes the description of change. The implementation plan and a backout plan are required for teams with system limitations and not able to follow risk-based automated deployments as documented in the solution development methodology.

3. All changes are authorized by the business and/or IT owner(s) or designates(s) and medium/high risk changes are reviewed in the weekly Change/Technical Advisory Boards (CAB /TAB)

4. All changes are tested in a non-production environment prior to production implementation. In cases where testing in a non-production environment is not possible, this is documented within the RFC

5. Post-implementation validation is conducted and validation results are reviewed

1. Activity 5 is covered in Release on Demand

2. Rest of the actions are covered in Continuous Integration & Continuous Deployment

Emergency change requests are documented and subject to formal change management procedures. A post-implementation review is conducted to confirm outcomes and results.

Control activities:

1. All emergency change requests are documented/logged in a change management repository which includes the description of the emergency change

2. The Emergency Change Management process/procedures are documented/updated and reviewed/signed-off by the IT owner(s) on a periodic basis

3. Emergency changes are authorized by the business and/or IT owner(s) or designates(s). Authorization is automated for teams following risk-based automated deployments.

4. Post-implementation validation for emergency changes validation results are reviewed

1. Activities 1,2 & 3 are covered in Continuous Integration

2. Activity 4 is covered in Continuous Deployment

A process is established to restrict access to authorized individuals functions only for the migration of accepted solutions/software releases into production.
Control activities:

1. Promotion to production process/procedures are documented/updated and reviewed/signed-off by the IT owner(s) on a periodic basis, for each system with a procedural SOD in place

2. Proper segregation of duties is established between staff functions responsible for program development, promoting changes to production, and IT operational support

1. Highlighted action is covered in Continuous Deployment & Release on Demand

2. First action is covered in Continuous Exploration

A test strategy must be followed which includes testing scope, goals, approach, tools, roles, environments, test exit criteria and timing of test activities. It takes into consideration testing requirements including security, architectural design, internal controls and privacy.

Control activities:

1. Testing artificats are prepared which include test design, test cases/steps, test coverage, test issues, expected and actual results.

2. Testing is executed in accordance with the test
   strategy, testing artifacts are retained and testing results are reviewed and authorized/approved by the business and IT owners(s) prior to production implemention

1. Covered in Continuous Integration

A test strategy must be followed which includes systems interface testing and is established to ensure data transmissions are complete, accurate and valid. It takes into consideration environments, security, internal controls and privacy.

Control activities:

1. Systems interface testing artificats are prepared which include test design, test cases/steps, test coverage, test issues, expected and actual results

2. Systems interface testing is conducted in non-production environments (source and destination), testing artifacts are retained and test results are reviewed and authorized/approved by the business and IT owner(s) prior to production implementation

1. Covered in Continuous Exploration and Continuous Integration

A test strategy must be followed which includes includes system and data conversion/migration testing and is established to ensure data coversion/migration is complete, accurate and valid. It compares original and converted data including audit trails and a recovery plan if conversion/migration fails and takes into consideration security, internal controls and privacy.

Control activities:

1. Data conversion/migration testing artifacts are prepared which include test design, test cases/steps, test coverage, test issues, expected and actual results.

2. Data conversion/migration testing which includes comparing original and converted/migrated data (e.g. record counts, validation of financial integrity, etc.) is conducted, testing artifacts are retained and test results are reviewed and authorized/approved by the business owner(s) prior to production data conversion/migration

1. Covered in Continuous Exploration & Continuous Integration

A process is established for implementing and maintaining security configurations, and for monitoring security configuration changes.

Control activities:

1. Security configuration management process/procedures are documented/updated and reviewed/signed-off by the IT owner(s) on a periodic basis

2. Systems are configured in accordance with security configuration baselines/standards

3. Changes to security configurations are monitored, and deviations are followed-up on and resolved

1. Highlighted action is covered in Release on Demand

IT Management has documented and established IT operational procedures, including job scheduling changes/events and incident management processes, to ensure the integrity of batch processing.

Control activities:

1. IT operational procedures are documented/updated and reviewed/signed-off by the IT owner(s) on a periodic basis

2. Job schedules are maintained and batch/backup jobs are monitored

3. Job failures are documented, followed-up on and resolved

1. Highlighted action is covered in Release on Demand

IT Management has defined and implemented an incident management system such that operational issues, data integrity issues and security-related issues are recorded, analyzed, resolved in a timely manner and reported to Management.

Control activities:

1. The incident management process is documented/updated and reviewed/signed-off by the IT owner(s) on a periodic basis

2. Incidents are documented/logged within an incident management repository which include the description of the incident, incident analysis/diagnostics, resolution steps, historical activity and response time

3. Incidents are assigned a priority level based on risk and impact to the organization

4. Incidents are escalated in accordance with the incident management process

5. Incidents are resolved on a timely basis (based on incident management process documentation) and incident tickets are closed upon verification from or with notification to the affected user(s)

6. Service Management reports are reviewed and signed-off by the IT owner(s) on a monthly basis

1. All actions are covered in Release on Demand

IT Management has defined and implemented a problem management system such that operational issues, data integrity issues and security-related issues are recorded, analyzed, resolved in a timely manner and reported to Management.

Control activities:

1. The problem management process is documented/updated and reviewed/signed-off by the IT owner(s) on a periodic basis

2. Problems are documented/logged within a problem management repository which include the problem description, historical activity, root cause analysis and resolution steps

Note: Problems identified through incidents, have corresponding incident tickets referenced

1. Problems are assigned a priority level based on risk and impact to the organization

2. Problems are resolved and problem tickets are closed

3. Service Management reports are reviewed and signed-off by the IT owner(s) on a monthly basis

1. All actions are covered in Release on Demand

IT Management has implemented a strategy for cyclical backup of data and programs.

Control activities

1. Backup and Recovery procedures are documented/updated and reviewed/signed-off by the IT owner(s) on a periodic basis

2. Application, platform/server and database backups are performed on a scheduled basis based on backup and recovery requirements

3. Backup jobs are monitored to ensure that the jobs run to completion without errors

4. Backup job failures are documented, followed-up on and rectified based on business requirements

5. Backup media are stored at an off-site location

1. All actions are covered in Release on Demand

The restoration of information is periodically tested.

Control activities:

1. The backup media testing process is documented/updated and reviewed/signed-off by the IT owner(s) on a periodic basis

2. Testing of the restoration from backup media is conducted periodically and test results are reviewed and signed-off by the IT owner(s)

1. All actions are covered in Release on Demand

IT Security monitors and logs security activity at the network, platform/server, and database levels and identified security violations are reported to Management.

Control activities:

1. Security Information and Event Management (SIEM) process/procedures are documented/updated and reviewed/signed-off by the IT owner(s) on a periodic basis

2. Security logging is enabled at the network, platform/server and database levels and complies with Information Security standards

3. Security logs are sent to the SIEM tool for monitoring, and security events are assessed to determine if they are security violations

4. Security violations are documented/logged which include the description of the security violation, analysis/diagnostics, resolution steps, historical activity and response time

5. Security violations are followed-up on, resolved by IT Security and reported to Management

1. All actions are covered in Release on Demand

Procedures exist and are followed relating to timely action for requesting, granting, suspending and closing user accounts. Controls relating to appropriate segregation of duties (SoD) over requesting and granting access to systems and data exist and are followed.

Control activities:

1. Identity and Access Management process/procedures are documented/updated and reviewed/signed-off by the IT owner(s) on a periodic basis

2. User access to networks, applications, platforms/servers and databases are requested, documented and approved by the business and/or IT owner(s)

3. User access is provisioned in accordance with roles and responsibilities, and proper segregation of duties exists for requesting and granting access to systems and data

4. User account terminations are processed on a timely basis

1. All actions are covered in Release on Demand

Appropriate controls, including firewalls, intrusion prevention/detection systems and vulnerability assessments, exist and are used to prevent and detect unauthorized access to information assets.

Control activities:

1. Networks are protected utilizing firewalls and intrusion prevention/detection systems

2. Anti-malware software is deployed, virus definitions are up-to-date, and scans are performed to detect malware on the networks, platforms/servers and workstations

3. Vulnerability scans and assessments are performed on a periodic basis

4. Network penetration testing is performed on a periodic basis

5. Vulnerability assessment and penetration testing results are documented, reviewed and signed-off by the IT owner(s)

6. Vulnerability assessment and penetration testing issues are followed-up on, investigated and resolved based on risk and impact to the organization

7. System security software/patches are applied in a timely manner

1. All actions are covered in Release on Demand

REC01-Version Management

1. For version management, attach a PBI report during the code check-in

2. Should be configured in version control tools like GitHub and ADO

3. It is vital for auditing and traceability

Continuous Integration

REC02-Code review

1. Follow standardised code review process for code comments

2. Code comments should be logical and adhere to architecture

REC03-Disaster Recovery

1. Should be embeded within CI/CD pipeline along with business requirements

2. Responsibility of Cloud infrastructure group

Release on Demand

REC04-Github Co-pilot

1. AI based coding tool used for writing code efficiently and fast

Continuous Integration

Rec05-Unit Test Code Coverage report

1. This ensures that a report is generated for each test case to know how much code it has covered for unit testing

2. A minimum threshold of 80%-90% code coverage should be maintained

3. Attach the test coverage report before each features release code merge

Rec06-Shift left testing

1. Before deploying code to UAT/Stage environments, it can also be deployed to Developer's Smoke Test environment for Sanity Check before build is stable enough to hand over to Testing Team to avoid any showstopper bugs

Continuous Deployment