Continuous Exploration

ITGC01.Information Security Policies and Standards

An Information Security Management System (ISMS) plan and policy exists and has been approved by Executive Management.

Control activities:

1. Information Security policies and standards are documented/updated and reviewed/signed-off by Executive Management on a periodic basis

2. Information Security policies and standards are communicated to the appropriate personnel and training is conducted

1. Highlighted actions are covered in Continuous Exploration

The solution development methodology through architectural and security practices includes requirements that information systems are designed with to include application controls that support complete, accurate, authorized and valid transaction processing.

Control activities:

1. Requirements for configuration/calculation/exception handling application and system controls are defined and built into solutions that support complete, accurate, authorized and valid transaction processing

1. Highlighted action is covered in Continuous Exploration

The organization has a solution development methodology that contains a set of requirements, which includes security and processing integrity controls, that are adhered to throughout the system development lifecycle.

Control activities:

1. In-house IT developments (including infrastructure) and/or procured systems comply with the solution development methodology

1. Highlighted action is covered in Continuous Exploration

The enterprise has a solution development methodology that defines and maintains business functional and technical requirements that are endorsed by all stakeholders.

Control activities:

1. Product/business owner(s) review and authorize/approve all work/requirements as part of quarterly planning.

2. Product/business owner(s) review and authorize/approve the final choice of solution, acquisition approach and high-level design, aligned to the desired business outcome. This is achieved through the quarterly planning process.

3. Product/business owner(s) review and authorize/approve User Acceptance Testing (UAT) results.

1. Highlighted actions are covered in Continuous Exploration

2. Third action will be covered in Continuous Deployment

A process is established to restrict access to authorized individuals functions only for the migration of accepted solutions/software releases into production.
Control activities:

1. Promotion to production process/procedures are documented/updated and reviewed/signed-off by the IT owner(s) on a periodic basis, for each system with a procedural SOD in place

2. Proper segregation of duties is established between staff functions responsible for program development, promoting changes to production, and IT operational support

1. Highlighted actions are covered in Continuous Exploration

2. Second action will be covered in Continuous Deployment & Release on Demand

A test strategy must be followed which includes testing scope, goals, approach, tools, roles, environments, test exit criteria and timing of test activities. It takes into consideration testing requirements including security, architectural design, internal controls and privacy.

Control activities:

1. Testing artificats are prepared which include test design, test cases/steps, test coverage, test issues, expected and actual results.

1. Highlighted actions are covered in Continuous Exploration

A test strategy must be followed which includes systems interface testing and is established to ensure data transmissions are complete, accurate and valid. It takes into consideration environments, security, internal controls and privacy.

Control activities:

1. Systems interface testing artificats are prepared which include test design, test cases/steps, test coverage, test issues, expected and actual results

2. Systems interface testing is conducted in non-production environments (source and destination), testing artifacts are retained and test results are reviewed and authorized/approved by the business and IT owner(s) prior to production implementation

1. Highlighted actions are covered in Continuous Exploration

2. Action 2 is covered in CI

Control activities:

1. Data conversion/migration testing artifacts are prepared which include test design, test cases/steps, test coverage, test issues, expected and actual results.

2. Data conversion/migration testing which includes comparing original and converted/migrated data (e.g. record counts, validation of financial integrity, etc.) is conducted, testing artifacts are retained and test results are reviewed and authorized/approved by the business owner(s) prior to production data conversion/migration

1. Highlighted actions are covered in Continuous Exploration

2. Action 2 is covered in CI