Continuous Integration

ITGC02.Information Security Policies and Standards Compliance Management

The enterprise has processes to monitor compliance with Information Security policies and standards.

Note: Overall security review with involvement of IT Security team before a release.

Control activities:

1. Non-compliance to Information Security policies and standards is monitored, tracked and are reported on

2. Non-compliance to Information Security policies and standards are actioned by the business and/or IT owner(s) based on risk and impact to the organization

1. Highlighted action is covered in Continuous Integration

ITGC03.Development Methodology

The organization has a solution development methodology that contains a set of requirements, which includes security and processing integrity controls, that are adhered to throughout the solution development lifecycle.

1. The solution development methodology is documented/updated and reviewed/signed-off by the IT owner(s) on a periodic basis

2. The solution development methodology requires that any changes identified will be authorized and prioritized by business owners and aligned to quarterly objectives and desired business outcomes

3. The solution development methodology requires planning for the ongoing maintenance of the systems/solutions developed

4. The solution development methodology requires defining new and changed IT services and service levels of developed systems/solutions

5. The solution development methodology requires initiative closure and acceptance be performed by the business owner for work having a defined start and end date. For work delivered through agile continuous delivery, the business owner accepts all changes and authorizes them at production release.

1. Highlighted actions are covered in Continuous Integration

2. Last 3 actions are covered in Continuous Deployment

ITGC05.User Involvement

The enterprise has a solution development methodology that defines and maintains business functional and technical requirements that are endorsed by all stakeholders.

Control activities:

1. Product/business owner(s) review and authorize/approve all work/requirements as part of quarterly planning

2. Product/business owner(s) review and authorize/approve the final choice of solution, acquisition approach and high-level design, aligned to the desired business outcome. This is achieved through the quarterly planning process

3. Product/business owner(s) review and authorize/approve User Acceptance Testing (UAT) results

1. Highlighted action is covered in Continuous Integration

2. First 3rd action is covered in Continuous Deployment

ITGC06.Compliance with Development Methodology

The organization has a solution development methodology that contains a set of requirements, which includes security and processing integrity controls, that are adhered to throughout the system development lifecycle.

Control activities:

1. In-house IT developments (including infrastructure) and/or procured systems comply with the solution development methodology

1. Highlighted actions are covered in Continuous Integration

ITGC07.Change Management

Requests for program changes and system changes (including maintenance) are standardized, logged, evaluated, prioritized and approved. The enterprise maintains a change management repository to track all requested changes, including the status of approved, in-progress and closed changes. IT Management implements system software that does not jeopardize the security of programs or the integrity of data stored on the system. Post-implementation reviews are conducted to confirm outcomes and results.

Control activities:

1. All change requests are documented/logged in a change management repository which includes the description of change. The implementation plan and a backout plan are required for teams with system limitations and not able to follow risk-based automated deployments as documented in the solution development methodology.

2. All changes are authorized by the business and/or IT owner(s) or designates(s) and medium/high risk changes are reviewed in the weekly Change/Technical Advisory Boards (CAB /TAB)

3. All changes are tested in a non-production environment prior to production implementation. In cases where testing in a non-production environment is not possible, this is documented within the RFC

4. Post-implementation validation is conducted and validation results are reviewed

1. Highlighted actions are covered in Continuous Integration

2. Fifth action will be covered in Continuous Deployment

Emergency change requests are documented and subject to formal change management procedures. A post-implementation review is conducted to confirm outcomes and results.

Control activities:

1. All emergency change requests are documented/logged in a change management repository which includes the description of the emergency change

2. Emergency changes are authorized by the business and/or IT owner(s) or designates(s). Authorization is automated for teams following risk-based automated deployments.

3. Post-implementation validation for emergency changes validation results are reviewed

1. Highlighted actions are covered in Continuous Integration

2. Fifth action will be covered in Continuous Deployment

A test strategy must be followed which includes testing scope, goals, approach, tools, roles, environments, test exit criteria and timing of test activities. It takes into consideration testing requirements including security, architectural design, internal controls and privacy.

Control activities:

1. Testing artificats are prepared which include test design, test cases/steps, test coverage, test issues, expected and actual results.

2. Testing is executed in accordance with the test
   strategy, testing artifacts are retained and testing results are reviewed and authorized/approved by the business and IT owners(s) prior to production implemention

1. Highlighted actions are covered in Continuous Integration

A test strategy must be followed which includes systems interface testing and is established to ensure data transmissions are complete, accurate and valid. It takes into consideration environments, security, internal controls and privacy.

Control activities:

1. Systems interface testing artificats are prepared which include test design, test cases/steps, test coverage, test issues, expected and actual results

2. Systems interface testing is conducted in non-production environments (source and destination), testing artifacts are retained and test results are reviewed and authorized/approved by the business and IT owner(s) prior to production implementation

1. Highlighted actions are covered in Continuous Integration

A test strategy must be followed which includes includes system and data conversion/migration testing and is established to ensure data coversion/migration is complete, accurate and valid. It compares original and converted data including audit trails and a recovery plan if conversion/migration fails and takes into consideration security, internal controls and privacy.

Control activities:

1. Data conversion/migration testing artifacts are prepared which include test design, test cases/steps, test coverage, test issues, expected and actual results.

2. Data conversion/migration testing which includes comparing original and converted/migrated data (e.g. record counts, validation of financial integrity, etc.) is conducted, testing artifacts are retained and test results are reviewed and authorized/approved by the business owner(s) prior to production data conversion/migration

1. Highlighted actions are covered in Continuous Integration