control procedures definition
control procedures. The implementation of changes shall be controlled by the use of formal change control procedures. Comment: The network upon which Scottish Public Services Information will be processed is configured in such a way as to ensure easy management and oversight. The relevant controls from ISO27001 are shown above, and these are included in the Information Security Management System which mandates routine checks of use of the network and boundary configuration. A Network Manager is employed within the IT department to ensure these controls are enforced. Furthermore, changes to the network are scheduled through the Change Advisory Board which has a security representative as a standing member. 3. Access control: The relevant ISO27001 controls are as follows: Segregation of duties: Duties and areas of responsibility shall be segregated to reduce opportunities for unauthorized or unintentional modification or misuse of the organisation’s assets. User access management: To ensure authorised user access and to prevent unauthorised access to information systems. User registration: There shall be a formal user registration and deregistration procedure in place for granting and revoking access to all information systems and services. Privilege management: The allocation and use of privileges shall be restricted and controlled. Review of user access rights: Management shall review users’ access rights at regular intervals using a formal process. Network access control: Objective: To prevent unauthorized access to networked services. Policy on use of network services: Users shall only be provided with access to the services that they have been specifically authorized to use. Monitoring: Objective: To detect unauthorised information processing activities. Audit logging: Audit logs recording user activities, exceptions, and information security events shall be produced and kept for an agreed period to assist in future investigations and access control monitoring. Monitoring system use: Procedures for monitoring use of information processing facilities shall be established and the results of the monitoring activities reviewed regularly. Comment: The network upon which Scottish Public Services Information will be processed is configured in such a way as to ensure appropriate access permissions. The relevant controls from ISO27001 are shown above, and these are included in the Information Security Management System. The HR team also informs IT Admin of new joiners, those who ha...
control procedures which means those policies and procedures in addition to the control environment which management has established to achieve the entity’s specific objectives. Specific control procedures include:
control procedures has the meaning set forth in Section 2.14.