Policy 7230A - Department of Administration

6. Systems Operation
These Systems Operations Non-Mandatory Baselines support the Enterprise Security Policy
(ITEC 7230 Rev 1), and the IT Security Self Assessment Policy (ITEC 7310).
Mandatory
Non-Mandatory
Procedures Baselines Procedures Baselines
6. Systems Operation
6.1. Assessment Operations
6.1.1. Perform Security Assessment (7 sets) (3 sets)
6.1.2. Perform Security Self Assessment (4 sets) (2 sets)
6.2. Integrity Operations
6.2.1. Monitor System Security Controls (3 sets) (1 sets)
6.3. Maintenance Operations
6.3.1. Plan for, and Provide Notice of, Security Operations (4 sets) (1 sets)
6.3.2. Perform Patch and Vulnerability Management (5 sets) (3 sets)
6.3.3. Securely Maintain Systems (2 sets) (2 sets)
6.4. Maintain Records
6.1. Assessment Operations
The following are the Non-Mandatory Baselines that support the Assessment
Operations section of the Default Security Requirements:
6.1.1. Perform Security Assessments
Security Assessments are thorough and in-depth security analyses designed to
determine all security deficiencies within a system. Agencies should complete
Security Assessments to establish all security concerns that may exist in a
system:
6.1.1.a Security Assessment Recommendations
• Security assessment plans should address the following topics:
o Whether the assessment should be external, internal or
both.
o Whether assessments should assess potential
vulnerabilities or verifiable threats.
o Whether the assessment will be performed by staff of
third party experts.
• System documentation to be reviewed should include:
o System log files.
o System configuration.
o System rule-set.
• Security assessment investigative techniques should include:
o Network foot-printing.
o Port and service scanning.
o Vulnerability assessment.
o System and account review
• Security assessment validating techniques should include:
16