Information Security and Safe Management Practices

• Develop and implement a risk-based IS audit strategy for your company in compliance with IS audit standards, guidelines and best practices.
• Plan specific audits to ensure that your IT and business systems are protected and controlled.
• Conduct audits in accordance with IS audit standards, guidelines and best practices to meet your planned audit objectives.
• Communicate emerging issues, potential risks, and audit results to your key stakeholders.
• Advise on the implementation of risk management and control practices within your company.

• Assess the effectiveness of your IT governance structure to ensure adequate board control over the decisions, directions, and performance of IT so that it supports your company’s strategies and objectives.
• Review your IT organizational structure and employee management to ensure that they support your company’s strategies and objectives.
• Evaluate your IT strategy and the process for its development, approval, implementation, and maintenance to ensure that it supports your company’s strategies and objectives.
• Examine your company’s IT policies, standards, and procedures as well as the processes for their development, approval, implementation, and maintenance to ensure that they support your IT strategy and comply with regulatory and legal requirements.
• Analyze management practices to ensure compliance with your company’s IT strategy, policies, standards, and procedures.
• Evaluate IT resource investment, use, and allocation practices to ensure their alignment with your company’s strategies and objectives.
• Analyze IT contracting strategies and policies and contract management practices to ensure that they support your business strategies and objectives.
• Evaluate your risk management practices to ensure that your company’s IT related risks are properly managed.
• Assess monitoring and assurance practices to ensure your executive management team receives sufficient and timely information about IT performance.

• Evaluate the business case for proposed system developments/acquisitions to ensure that they meet your company’s business goals.
• Analyze your project management framework and project governance practices to ensure that your business objectives are achieved in a cost-effective manner while managing risks to your company.
• Perform reviews to ensure that a project is progressing in accordance with your project plans, is adequately supported by documentation, and is accurately reported in status updates.
• Review proposed control mechanisms for systems and/or infrastructure during specification, development/acquisition, and testing to ensure that they will provide safeguards and comply with your company’s policies and other requirements.
• Assess the processes by which your systems and/or infrastructure are developed/acquired and tested to ensure that the deliverables meet your company’s objectives.
• Evaluate the readiness of your system and/or infrastructure for implementation and migration into production.
• Perform post-implementation review of systems and/or infrastructure to ensure that they meet your company’s objectives and are subject to effective internal control.
• Perform periodic reviews of systems and/or infrastructure to ensure that they continue to meet your company’s objectives and are subject to effective internal control.
• Analyze the process by which your systems and/or infrastructure are maintained to ensure the continued support of your company’s objectives and are subject to effective internal control.
• Evaluate the process by which your systems and/or infrastructure are disposed of to ensure that they comply with your company’s policies and procedures.

• Review your service level management practices to ensure that the level of service from internal and external service providers is defined and managed.
• Assess your operations management to ensure that IT support functions effectively meet your business needs.
• Evaluate your data administration practices to ensure the integrity and optimization of databases.
• Analyze your use of capacity and performance monitoring tools and techniques to ensure that IT services meet your company’s objectives.
• Evaluate your change, configuration, and release management practices to ensure that changes made to your company’s production environment are adequately controlled and documented.
• Examine your problem and incident management practices to ensure that incidents, problems, or errors are recorded, analyzed, and resolved in a timely manner.
• Evaluate the functionality of your IT infrastructure (e.g., network components, hardware, system software) to ensure that it supports your company’s objectives.

• Analyze the design, implementation, and monitoring of logical access controls to ensure the confidentiality, integrity, availability and authorized use of your information assets.
• Evaluate your network infrastructure security to ensure confidentiality, integrity, availability and authorized use of your network and the information transmitted.
• Assess the design, implementation, and monitoring of your environmental controls to prevent or minimize loss.
• Review the design, implementation, and monitoring of your physical access controls to ensure that your information assets are adequately safeguarded.
• Evaluate the processes and procedures your company uses to store, retrieve, transport, and dispose of confidential information assets.

• Evaluate the adequacy of your backup and restore provisions to ensure the availability of information required to resume processing.
• Examine your company’s disaster recovery plan to ensure that it enables the recovery of your IT processing capabilities in the event of a disaster.
• Assess your company’s business continuity plan to ensure your ability to continue essential business operations during the period of an IT disruption.

For more information about Progent's network security engineering help, telephone Progent at 800-993-9400 or send email to security-help@progent.com.