Additional guidance: traditionally, a detailed report with findings and recommendations has to be generated for each review/audit, in addition to an executive with key findings and recommendations to be shared with executive management. Has your Agency established an audit and accountability Define an Audit and Accountability Policy and establish policy? associated procedures for the effective implementation of Has your Agency established the associated procedures selected security controls and control enhancements. to support this policy? Does your Agency review and update the policy and associated procedures at least annually? Has your Agency established audit procedures such that Develop Information Systems Audit Controls review/audit activities of operational systems are conducted in a manner that minimizes risks of causing disruptions? Additional guidance: for example, if system reports are required these can be obtained during off-hours, or by the use of specialized tools such as in-house developed scripts that minimize time to gather data. Has your Agency implemented security controls to Establish procedures for the Protection of Information prevent unauthorized access or access abuse of audit System Audit Tools related tools? Additional guidance: for example, setting access controls to only authorized individuals that can use the audit related tools to look at compliance, reporting capabilities or modify user actions Has the Agency established the types of events that need Establish procedures to handle Audit Events to be audited within the information systems? Additional guidance: each system should have a list of controls that are required to be operational, including events to be logged and later be audited during a
Additional guidance: traditionally, a detailed report with findings and recommendations has to be generated for each review/audit, in addition to an executive with key findings and recommendations to be shared with executive management. Define an Audit and Accountability Policy and establish associated procedures for the effective implementation of selected security controls and control enhancements. Has your Agency established an audit and accountability policy? Has your Agency established the associated procedures to support this policy? Does your Agency review and update the policy and associated procedures at least annually? Develop Information Systems Audit Controls Has your Agency established audit procedures such that review/audit activities of operational systems are conducted in a manner that minimizes risks of causing disruptions? Additional guidance: for example, if system reports are required these can be obtained during off-hours, or by the use of specialized tools such as in-house developed scripts that minimize time to gather data. Establish procedures for the Protection of Information System Audit Tools Has your Agency implemented security controls to prevent unauthorized access or access abuse of audit related tools? Additional guidance: for example, setting access controls to only authorized individuals that can use the audit related tools to look at compliance, reporting capabilities or modify user actions Establish procedures to handle Audit Events Has the Agency established the types of events that need to be audited within the information systems? Additional guidance: each system should have a list of controls that are required to be operational, including events to be logged and later be audited during a
Gap%20Analysis%20-%20IT%20Compliance%20Policy%20-%20Final.docx