Process that acquire and assess evidences to judge whether information system protects organization asset, utilizes organization resource, guarantee data security and conformity, and achieve the business goal of organization effectively.
Process that acquire and assess evidences to judge whether information system protects organization asset, utilizes organization resource, guarantee data security and conformity, and achieve the business goal of organization effectively.
Security of information system project development, infrastructure, data management, operation and maintenance
Reliability of information system hardware, system software, application software, network environment and data
Refers to the economy, efficiency, effect of information system development, application, operation and maintenance
Legality of information system life cycle, business process and internal control
Protect controls that guarantee normal operation of information system stability, effectiveness, security and other aspects.
· IT governance
· IT organization pattern, architecture, responsibilities
· IT supplier management, copyright and intellectual property
· Guarantee of non-core business service level
· Computer room environment and disaster prevention
· Host, communication network, storage, access contro
· Assets, risks, threats, strategies and safeguards
· Business continuity requirements for IT continuity, backup and recovery
· Quality and security of development and acquisition process
· Change management
· Network configuration, log checking
· Vulnerability scanning and penetration testing
protect controls of authenticity, integrity and reliability of the data produced by the information system.
· User Problem Tracking
· Functional testing, code analysis, scene simulation or tracking
· Input control
· Output control
· Availability
· Reliability
· Business data, log
· Authenticity,1 causality, accuracy
· Security, normative
· Process logic, back door
· Business processes and offline activities
· Interface and data
· Department
Communications
Enter into a contract
Determine the range
Specify the basis
Form a team
On-site audit
Problem confirmation
Prepare a report
Tracking service
INSTITUTE OF SAFETY
返回
顶部
