Policy 7230A - Department of Administration

5. Systems Configuration
These Systems Configuration Mandatory Procedures support the Enterprise Security Policy
(ITEC 7230 Rev 1), the Network Security Architecture Policy (ITEC 4210), and the Enterprise
Media Sanitization Policy (ITEC 7900).
Mandatory
Non-Mandatory
Procedures Baselines Procedures Baselines
5. Systems Configuration
5.1. Configuration Management
5.1.1. Build and Maintain a Systems Inventory (3 sets) (4 sets)
5.1.2. Perform Systems and Data Classification (5 sets) (2 sets)
5.1.3. Follow Process by Change Control (6 sets) (2 sets)
5.2. Systems Protection
5.2.1. Create and Maintain Security Infrastructure (3 sets) (2 sets)
5.3. Data/Media Protection
5.3.1. Securely Handle Data and Media (2 sets) (3 sets) (5 sets) (2 sets)
5.4. Application Protection
5.4.1. Apply Security Principles to Code Development (4 sets) (4 sets)
5.5. Maintain Records
5.1. Configuration Management
No applicable Mandatory Procedures.
5.2. Systems Protection
The following are the Mandatory Procedures that support the Systems Protection
section of the Default Security Requirements:
5.2.1. Create and Maintain Security Infrastructure
Securely deploying systems and systems components, while beneficial, is
insufficient to implementing strong security and must be supplemented with
dedicated security infrastructure:
5.2.1.1 Implement Network Boundary Protection
The network boundary forms the touch-point between the
organization’s IT infrastructure and the outside world and so
protection mechanisms must be put in place to limit access and
secure communications:
• Determine the specific protection required.
• Select and implement solutions according to requirements.
• Establish standard configuration for implemented solutions.
• Make changes as per change control processes (see section
5.1.3 of the Non-Mandatory Procedures).
• Maintain as per maintenance processes (see section 6.3.3 of
the Non-Mandatory Procedures).
12