Policy 7230A - Department of Administration

6. Systems Operation
These Systems Operation Non-Mandatory Procedures support the Enterprise Security Policy
(ITEC 7230 Rev 1), and the IT Security Self Assessment Policy (ITEC 7310).
Mandatory
Non-Mandatory
Procedures Baselines Procedures Baselines
6. Systems Operation
6.1. Assessment Operations
6.1.1. Perform Security Assessment (7 sets) (3 sets)
6.1.2. Perform Security Self Assessment (4 sets) (2 sets)
6.2. Integrity Operations
6.2.1. Monitor System Security Controls (3 sets) (1 sets)
6.3. Maintenance Operations
6.3.1. Plan for, and Provide Notice of, Security Operations (4 sets) (1 sets)
6.3.2. Perform Patch and Vulnerability Management (5 sets) (3 sets)
6.3.3. Securely Maintain Systems (2 sets) (2 sets)
6.4. Maintain Records
6.1. Assessment Operations
The following are the Non-Mandatory Procedures that support the Assessment
Operations section of the Default Security Requirements:
6.1.1. Perform Security Assessments
Security Assessments are thorough and in-depth security analyses designed to
determine the security deficiencies of a system. Agencies should perform
Security Assessments to ascertain security concerns that may exist in a system:
6.1.1.1 Identify the Target System
Collect and document the information that defines the system:
6.1.1.2 Develop an Assessment Plan
Create a formal plan that clearly outlines the work that will be
performed:
• Determine the scope of assessments to be performed.
• Establish a prioritized assessment schedule.
• Identify and gather required skills and tools.
• Creation an assessment implementation plan.
6.1.1.3 Execute the Plan
Apply the developed plan to the targeted system to determine and
validate the existence of security compromises:
• Review the system and system documentation to determine
expected security configuration and capabilities of the system:
• Identify and analyze the target system through investigative
techniques:
• Validate vulnerabilities that may be discovered:
19