A.10 Communications and operations

A.10 Communications and operations management
A.10.1 Operational procedures and responsibilities
Objective: To ensure the correct and secure operation of information processing facilities.
A.10.1.1 Documented operating procedures
Control
Operating procedures shall be documented, maintained, and made available to all users
who need them.
A.10.1.2
Change management
Control
Changes to information processing facilities and systems shall be controlled.
A.10.1.3
Segregation of duties
Control
Duties and areas of responsibility shall be segregated to reduce opportunities for
unauthorized or unintentional modification or misuse of the organization’s assets.
A.10.1.4 Separation of development, test and operational facilities
Control
Development, test and operational facilities shall be separated to reduce the risks of
unauthorised access or changes to the operational system. 8
A.10.2 Third party service delivery management
Objective: To implement and maintain the appropriate level of information security and
service delivery in line with third party service delivery agreements.
A.10.2.1
Service delivery
Control
It shall be ensured that the security controls, service definitions and delivery levels
included in the third party service delivery agreement are implemented, operated, and
maintained by the third party.
A.10.2.2 Monitoring and review of third party services
Control
The services, reports and records provided by the third party shall be regularly monitored
and reviewed, and audits shall be carried out regularly.
A.10.2.3 Managing changes to third party services
Control
Changes to the provision of services, including maintaining and improving existing
information security policies, procedures and controls, shall be managed, taking account
of the criticality of business systems and processes involved and re-assessment of risks.
A.10.3 System planning and acceptance
Objective: To minimize the risk of systems failures.
A.10.3.1
Capacity management
Control
The use of resources shall be monitored, tuned, and projections made of future capacity
requirements to ensure the required system performance.
A.10.3.2
System acceptance
Control
Acceptance criteria for new information systems, upgrades, and new versions shall be
established and suitable tests of the system(s) carried out during development and prior to
acceptance.
A.10.4 Protection against malicious and mobile code
Objective: To protect the integrity of software and information.
A.10.4.1 Controls against malicious code
Control
Detection, prevention, and recovery controls to protect against malicious code and
appropriate user awareness procedures shall be implemented. 9
A.10.4.2 Controls against mobile code
Control
Where the use of mobile code is authorized, the configuration shall ensure that the
authorized mobile code operates according to a clearly defined security policy, and
unauthorized mobile code shall be prevented from executing.
A.10.5 Back-up
Objective: To maintain the integrity and availability of information and information
processing facilities.
A.10.5.1
Information back-up
Control
Back-up copies of information and software shall be taken and tested regularly in
accordance with the agreed backup policy.
A.10.6 Network security management
Objective: To ensure the protection of information in networks and the protection of the
supporting infrastructure.
A.10.6.1
Network controls
Control
Networks shall be adequately managed and controlled, in order to be protected from
threats, and to maintain security for the systems and applications using the network,
including information in transit.
A.10.6.2
Security of network services
Control
Security features, service levels, and management requirements of all network services
shall be identified and included in any network services agreement, whether these
services are provided in-house or outsourced.
A.10.7 Media handling
Objective: To prevent unauthorized disclosure, modification, removal or destruction of
assets, and interruption to business activities.
A.10.7.1 Management of removable media
Control
There shall be procedures in place for the management of removable media. 10
A.10.7.2
Disposal of media
Control
Media shall be disposed of securely and safely when no longer required, using formal
procedures.
A.10.7.3 Information handling procedures
Control
Procedures for the handling and storage of information shall be established to protect this
information from unauthorized disclosure or misuse.
A.10.7.4 Security of system documentation
Control
System documentation shall be protected against unauthorized access.
A.10.8 Exchange of information
Objective: To maintain the security of information and software exchanged within an
organization and with any external entity.
A.10.8.1 Information exchange policies and procedures
Control
Formal exchange policies, procedures, and controls shall be in place to protect the
exchange of information through the use of all types of communication facilities.
A.10.8.2
Exchange agreements
Control
Agreements shall be established for the exchange of information and software between
the organization and external parties.
A.10.8.3
Physical media in transit
Control
Media containing information shall be protected against unauthorized access, misuse or
corruption during transportation beyond an organization’s physical boundaries.
A.10.8.4
Electronic messaging
Control
Information involved in electronic messaging shall be appropriately protected.
A.10.8.5 Business information systems
Control
Policies and procedures shall be developed and implemented to protect information
associated with the interconnection of business information systems. 11
A.10.9 Electronic commerce services
Objective: To ensure the security of electronic commerce services, and their secure use.
A.10.9.1
Electronic commerce
Control
Information involved in electronic commerce passing over public networks shall be
protected from fraudulent activity, contract dispute, and unauthorized disclosure and
modification.
A.10.9.2
On-line transactions
Control
Information involved in on-line transactions shall be protected to prevent incomplete
transmission, mis-routing, unauthorized message alteration, unauthorized disclosure,
unauthorized message duplication or replay.
A.10.9.3 Publicly available information
Control
The integrity of information being made available on a publicly available system shall be
protected to prevent unauthorized modification.
A.10.10 Monitoring
Objective: To detect unauthorized information processing activities.
A.10.10.1
Audit logging
Control
Audit logs recording user activities, exceptions, and information security events shall be
produced and kept for an agreed period to assist in future investigations and access
control monitoring.
A.10.10.2
Monitoring system use
Control
Procedures for monitoring use of information processing facilities shall be established
and the results of the monitoring activities reviewed regularly.
A.10.10.3
Protection of log information
Control
Logging facilities and log information shall be protected against tampering and
unauthorized access. 12
A.10.10.4 Administrator and operator logs
Control
System administrator and system operator activities shall be logged.
A.10.10.5
Fault logging
Control
Faults shall be logged, analyzed, and appropriate action taken.
A.10.10.6
Clock synchronization
Control
The clocks of all relevant information processing systems within an organization or
security domain shall be synchronized with an agreed accurate time source.
A.11 Access control
A.11.1 Business requirement for access control
Objective: To control access to information.
A.11.1.1
Access control policy
Control
An access control policy shall be established, documented, and reviewed based on
business and security requirements for access.
A.11.2 User access management
Objective: To ensure authorized user access and to prevent unauthorized access to
information systems.
A.11.2.1
User registration
Control
There shall be a formal user registration and de-registration procedure in place for
granting and revoking access to all information systems and services.
A.11.2.2
Privilege management
Control
The allocation and use of privileges shall be restricted and controlled.
A.11.2.3
User password management
Control
The allocation of passwords shall be controlled through a formal management process. 13
A.11.2.4
Review of user access rights
Control
Management shall review users’ access rights at regular intervals using a formal process.
A.11.3 User responsibilities
Objective: To prevent unauthorized user access, and compromise or theft of information
and information processing facilities.
A.11.3.1
Password use
Control
Users shall be required to follow good security practices in the selection and use of
passwords.
A.11.3.2
Unattended user equipment
Control
Users shall ensure that unattended equipment has appropriate protection.
A.11.3.3 Clear desk and clear screen policy
Control
A clear desk policy for papers and removable storage media and a clear screen policy for
information processing facilities shall be adopted.
A.11.4 Network access control
Objective: To prevent unauthorized access to networked services.
A.11.4.1 Policy on use of network services
Control
Users shall only be provided with access to the services that they have been specifically
authorized to use.
A.11.4.2 User authentication for external connections
Control
Appropriate authentication methods shall be used to control access by remote users.
A.11.4.3 Equipment identification in networks
Control
Automatic equipment identification shall be considered as a means to authenticate
connections from specific locations and equipment.
A.11.4.4 Remote diagnostic and configuration port protection
Control
Physical and l