IT Security Plan Template

Download Free IT Security Plan Template

A. APPLICATION/SYSTEM IDENTIFICATION

A.1 Application/System Category
- Indicate whether the application/system is a Major Application or a General Support System.
- A Major Application is "an application that requires special attention to security due to the risk and magnitude of the harm resulting from the loss, misuse, or unauthorized access to or modification of the information in the application."
- A General Support System is an "interconnected set of information resources under the same direct management control which shares common functionality. A system normally includes hardware, software, information, data, applications, communications, and people."

Download Free Business Impact Analysis Questionnaire Template

Business Impact Analysis
A Business Impact Analysis (BIA) is the foundation for all business continuity planning programs. It identifies the financial and operational impacts that may result from a disruption of business operations. Disruptions can take many forms,

Download Free Sarbanes Oxley (SOX) 404 IT General Control Test Plan

- Obtain a copy of the organization’s SDLC methodology.

- Review the methodology to determine that it addresses security, availability and processing integrity requirements.

- Review the organization’s SDLC methodology to determine if it considers both the development and acquisition of new systems and major changes to existing systems.

- Review the methodology to determine if it addresses application controls.

All user accounts in use within organization should be domain accounts and not local accounts held on each workstation's local user account database. The benefit of implementing standard user naming convention are:

1. Enable administrator of the domain to better manage, support and secure the user accounts.
2. Facilitate ease of management and support

Project Management Evolutionary Delivery Checklist

- Have you planned for several releases of the software before the full, final capabilities are present?

- Does the first release contain the germ of the program, the seed from which the rest of the program will be developed?

- Will the first release be made as early as possible to get the ball rolling?

- Is the first release usable, at least at some minimal level?

- Have you defined what each evolutionary stage will deliver as best as you can in the hazy dawn of the project?

- Does each release add significant capabilities?