8: Operational Security

This category focuses on ensuring the secure and reliable operation of information processing facilities. It includes managing and monitoring operational procedures, handling changes, protecting against malware, backup strategies, logging and monitoring, and controlling technical vulnerabilities.

Controls (A.12):

• A.12.1.1: Documented Operating Procedures

• A.12.1.2: Change Management

• A.12.1.3: Capacity Management

• A.12.1.4: Separation of Development, Testing, and Operational Environments

• A.12.2.1: Malware Controls

• A.12.3.1: Backup

• A.12.4.1: Event Logging

• A.12.4.2: Protection of Log Information

• A.12.4.3: Administrator and Operator Logs

• A.12.4.4: Clock Synchronization

• A.12.5.1: Installation of Software on Operational Systems

• A.12.6.1: Management of Technical Vulnerabilities

• A.12.6.2: Restrictions on Software Installation

• A.12.7.1: Information Systems Audit Considerations

Control A.12.1.1: Documented Operating Procedures

Audit Questions:

• Are there documented operating procedures for information processing facilities?

• How are these procedures communicated and maintained?

Common Non-Conformities (NC):

• Lack of documented operating procedures.

• Procedures not communicated effectively.

• Outdated or insufficiently maintained procedures.

Control A.12.1.2: Change Management

Audit Questions:

• Is there a formal change management process in place?

• How are changes documented, approved, and communicated?

Common Non-Conformities (NC):

• No formal change management process.

• Changes not documented, approved, or communicated properly.

• Unauthorized changes made to systems.

Control A.12.1.3: Capacity Management

Audit Questions:

• How is capacity managed to ensure system availability?

• Are there plans and metrics in place to monitor and manage capacity?

Common Non-Conformities (NC):

• Lack of capacity management plans.

• Insufficient monitoring of capacity.

• System performance issues due to inadequate capacity management.

Control A.12.1.4: Separation of Development, Testing, and Operational Environments

Audit Questions:

• Are development, testing, and operational environments separated?

• How is access to these environments controlled?

Common Non-Conformities (NC):

• No separation of development, testing, and operational environments.

• Inadequate access controls for different environments.

Control A.12.2.1: Malware Controls

Audit Questions:

• What controls are in place to protect against malware?

• How are these controls monitored and updated?

Common Non-Conformities (NC):

• Insufficient malware protection measures.

• Outdated or unmonitored malware controls.

Control A.12.3.1: Backup

Audit Questions:

• Are there documented backup procedures?

• How frequently are backups performed and tested?

• Are backup copies stored securely?

Common Non-Conformities (NC):

• No documented backup procedures.

• Infrequent or untested backups.

• Insecure storage of backup copies.

Control A.12.4.1: Event Logging

Audit Questions:

• Are events logged and monitored?

• How are logs reviewed and retained?

Common Non-Conformities (NC):

• No event logging.

• Logs not reviewed or retained as required.

Control A.12.4.2: Protection of Log Information

Audit Questions:

• How is log information protected from unauthorized access and tampering?

• Are there controls to ensure log integrity?

Common Non-Conformities (NC):

• Inadequate protection of log information.

• Log data not protected from unauthorized access or tampering.

Control A.12.4.3: Administrator and Operator Logs

Audit Questions:

• Are administrator and operator activities logged?

• How are these logs monitored and reviewed?

Common Non-Conformities (NC):

• No logging of administrator and operator activities.

• Logs not monitored or reviewed.

Control A.12.4.4: Clock Synchronization

Audit Questions:

• Are clocks synchronized across information systems?

• How is clock synchronization maintained?

Common Non-Conformities (NC):

• Lack of clock synchronization.

• Inconsistent time settings across systems.

Control A.12.5.1: Installation of Software on Operational Systems

Audit Questions:

• Are there procedures for the installation of software on operational systems?

• How is unauthorized software installation prevented?

Common Non-Conformities (NC):

• No procedures for software installation.

• Unauthorized software installations on systems.

Control A.12.6.1: Management of Technical Vulnerabilities

Audit Questions:

• How are technical vulnerabilities identified, assessed, and managed?

• Are there procedures for applying patches and updates?

Common Non-Conformities (NC):

• Inadequate vulnerability management processes.

• Delayed or missing application of patches and updates.

Control A.12.6.2: Restrictions on Software Installation

Audit Questions:

• Are there restrictions on software installation?

• How are these restrictions enforced?

Common Non-Conformities (NC):

• No restrictions on software installation.

• Poor enforcement of software installation policies.

Control A.12.7.1: Information Systems Audit Considerations

Audit Questions:

• How are information systems audits conducted?

• Are there procedures to minimize disruptions during audits?

Common Non-Conformities (NC):

• No procedures for conducting information systems audits.

• Significant disruptions caused by audit activities.