6.4.2 The procedures referred to in point 6.4.1. shall be applied for releases, modifications and …

Requirement

The procedures referred to in point 6.4.1. shall be applied for releases, modifications and emergency changes of any software and hardware in operation and changes to the configuration. The procedures shall ensure that those changes are documented and, based on the risk assessment carried out pursuant to point 2.1, tested and assessed in view of the potential impact before being implemented.

Guidance

• Consider a mandatory integrity check before installing and deploying new software.
• Ensure, where appropriate, that changes are done in an authenticated, authorised and non-repudiating manner.
• Test and validate changes before they are implemented in operational systems, where applicable. Where appropriate, a security impact analysis may be performed in a separate test environment before implementation in an operational environment.
• Take all necessary precautions before making changes (back up images, for instance).
• Schedule, perform, document and review records of maintenance and repairs on system components in accordance with the supplier’s specifications and/or the entity’s requirements.
• Ensure that changes are only allowed with approved tools and that their execution is documented.
• Restrict the use of maintenance tools to authorised personnel only.

Examples of evidence

• Logs and records of past (new) software installations.
• Evidence that MFA is in place for activating change, repair and maintenance procedures, where applicable.
• Test plans and results that demonstrate the implementation and effectiveness of the change, repair and maintenance procedures.
• If the entity utilises change management tools, evidence that these tools enforce the use of approved resources only and mandate documentation for each change.
• Access control lists (ACLs) to verify that access to the tools is in line with the access control policy.

1. Přehled

1.1 Odkazy

1.2 Identifikované požadavky

1.3 Související regulace

2. Identifikované požadavky

3. Související regulace

Propojené úkoly

• ENISA -