Policy 7230A - Department of Administration

• Correlate all factors to create a master prioritization schedule.
Revise this schedule each time a new threat or vulnerability is
discovered.
6.3.3. Securely Maintain Systems
Agencies should perform system maintenance work in as secure a manner as
possible:
6.3.3.a Remote Maintenance
• All active connections as well as the system being maintained
should be actively monitored.
• Remote maintenance should be performed over encrypted
tunnels.
• Tunnels should be positively terminated upon completion of
all work.
6.3.3.b Maintenance Logs
• Maintenance logs, at a minimum, should capture the following
information:
o Affected system.
o Date and time of scheduled maintenance.
o Description of the work performed.
o Listing of any equipment removed or replaced.
o Name and organization of person performing the
maintenance.
o Identity verification mechanism used.
o Name of escort.
6.4. Maintain Records
Agencies should capture documentation appropriate to all systems operations
processes:
• Document and retain copies of all system security operations notifications and
implementation plans.
• Document and retain copies of all security assessments.
• Create and maintain systems security monitoring logs.
• Create and maintain patch and remediation logs.
20