Delinea

Change management policies are established that include procedures for tracking, testing, approving, and communicating changes. Policies are reviewed annually.

There is a segregation of duties over making source code changes and migrating changes to the production environment. Access to promote changes is limited based on job responsibilities.

System change requests are reviewed and approved by management to ensure alignment with business objectives and security requirements.

All system changes, including their review, approval, and evidence of adherence to the Change Management Policy, are documented in Jira to maintain a centralized and auditable record.

DE.CM-03: Personnel activity and technology usage are monitored to find potentially adverse events

DE.CM-06: External service provider activities and services are monitored to find potentially adverse events

RC.RP-01: The recovery portion of the incident response plan is executed once initiated from the incident response process

RC.RP-02: Recovery actions are selected, scoped, prioritized, and performed

RC.RP-05: The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed

Employment Screening - Does the organization screen potential employees during the hiring process, to determine trustworthiness?

Responsibilities - Perms - Is/are there personnel responsible for determining and implementing the appropriate access and permissions levels for users?

Roles - Authority - If there is not a job role identified for development and implementation of security policies, is there a recognized personnel that staff contact in the case of security events?