Impact analysis of all proposed changes 2.6.4, 2.10.5 to the DM system Authorization and documentation of 2.6.3, 2.10.5, 2.10.6, changes, maintenance, and repair to the 2.10.8 DM system - The organization shall document each scheduled change to the DM system or its components. At a minimum, this documentation shall include; 1) date and time of proposed change, 2) individual or organization requesting change, 3) detailed description of the change, and 4) approval of the change. Unscheduled changes or repairs to the DM system shall be reviewed on a daily basis for possible impact to other DM system functions and scheduled changes. Furthermore, the organization shall be capable of determining the status of all changes (e.g. planned, in progress, complete) at all times. Policy.8 Policy Information, The organization develops and documents a DM – Media, and system security policy, supporting plans, Document processes, and procedures that address Management information, media, and document management aspects of the DM system security program including the following areas: Managing control system-related data 2.9.2, 2.9.3, 2.9.5, for both electronic and paper data and 2.9.6, 2.9.7, 2.13.2, access to the data based on formally 2.14.12, 2.18.8 assigned roles and responsibilities or contractual and confidentiality agreements with external parties Classification of information and 2.9.4, 2.9.6, 2.9.10, documentation to indicate the protection 2.9.11, 2.13.3, 2.13.4 required commensurate with its sensitivity and consequence Destruction of written and electronic 2.9.8 data storage, handling, sanitation, and 2.13.5, 2.13.6, 2.13.7 disposal Policy.9 Policy Auditing The organization develops and documents a DM – and Reporting system security policy, supporting plans, processes, and procedures that address auditing and reporting aspects of the DM system security program including the following areas:
Impact analysis of all proposed changes to the DM system 2.6.4, 2.10.5 Authorization and documentation of changes, maintenance, and repair to the DM system - The organization shall document each scheduled change to the DM system or its components. At a minimum, this documentation shall include; 1) date and time of proposed change, 2) individual or organization requesting change, 3) detailed description of the change, and 4) approval of the change. Unscheduled changes or repairs to the DM system shall be reviewed on a daily basis for possible impact to other DM system functions and scheduled changes. Furthermore, the organization shall be capable of determining the status of all changes (e.g. planned, in progress, complete) at all times. 2.6.3, 2.10.5, 2.10.6, 2.10.8 Policy.8 Policy – Information, Media, and Document Management The organization develops and documents a DM system security policy, supporting plans, processes, and procedures that address information, media, and document management aspects of the DM system security program including the following areas: Managing control system-related data for both electronic and paper data and access to the data based on formally assigned roles and responsibilities or contractual and confidentiality agreements with external parties 2.9.2, 2.9.3, 2.9.5, 2.9.6, 2.9.7, 2.13.2, 2.14.12, 2.18.8 Classification of information and documentation to indicate the protection required commensurate with its sensitivity and consequence 2.9.4, 2.9.6, 2.9.10, 2.9.11, 2.13.3, 2.13.4 Destruction of written and electronic data 2.9.8 storage, handling, sanitation, and disposal 2.13.5, 2.13.6, 2.13.7 Policy.9 Policy – Auditing and Reporting The organization develops and documents a DM system security policy, supporting plans, processes, and procedures that address auditing and reporting aspects of the DM system security program including the following areas:
DM%20Security%20Profile%20-%20v1_0%20-%2020120220.docx