+OPS.1.1.7.A7 Definition of a Security Policy for System Management (S)

OPS.1.1.7.A7 Definition of a Security Policy for System Management (S)

For system management, a security policy SHOULD be drawn up and continuously maintained. All persons involved in system management SHOULD be familiar with the policy. The security policy SHOULD be integral to their work. Regular and transparent reviews SHOULD be conducted to ensure that the policy requirements are being implemented. The results SHOULD be documented.

At minimum, the security policy SHOULD specify the following:

  • The areas of system management that are to be realised via central management tools and services
  • The system management tasks that are to be realised in an automated manner
  • Configuration management for the data managed by the system management solution, e.g. versioning of configurations
  • Specifications for network separation
  • Specifications for access control
  • Logging specifications
  • Quality assurance specifications for the use of automation functions, e.g. scripts
  • Specifications for protecting communication
  • The basic operational rules for system management
  • Specifications for coordination with network management, e.g. assignment of IP addresses or DNS names

1. Übersicht

1.1 Referenzen

1.2 Identifizierte Anforderungen

1.3 Zugehörige Regulierungen

2. Identifizierte Anforderungen

Anforderungen

3. Zugehörige Regulierungen

Regulierungen

Verknüpfte Vorgänge

Verknüpfungen
blocks G 0.15 Eavesdropping
blocks G 0.19 Disclosure of Sensitive Information
blocks G 0.21 Manipulation with Hardware or Software
blocks G 0.22 Manipulation of Information
blocks G 0.23 Unauthorised Access to IT Systems
blocks G 0.30 Unauthorised Use or Administration of Devices and Systems
blocks G 0.31 Incorrect Use or Administration of Devices and Systems
blocks G 0.32 Misuse of Authorisation