11.14

Control Activities

Principle 11 - Design General Control Activities over Information Technology

Attribute 11.14 - Control activities for maintaining information technology include identifying vulnerabilities to patch and other functional updates to be made. Management continuously monitors the entity's information technology to establish a baseline for evaluating performance, detecting underlying deficiencies before they negatively impact users, collecting data when risks occur, and enabling continuous improvement. Vulnerability management is the process of identifying system vulnerabilities where change may be necessary for remediation. Management may identify vulnerabilities through continuous monitoring of characteristics such as the type of technology used, physical entry points, and trends in user activity. Management may use monitoring software that automatically notifies appropriate personnel when a breach or irregularity is identified. Management may also perform penetration testing of the system to identify vulnerabilities that a hacker might exploit. Patch management is the process of applying platform and software updates to close security vulnerabilities and improve functionality. Management implements control activities to periodically or automatically update antivirus software, apply patches to correct security issues, and scan for and remove unauthorized access points.

>>>Navigational Buttons<<<

• Index of Attributes
• Previous Attribute - 11.13
• Next Attribute - 11.15

Jamie's Story

No examples are available to illustrate governance gaps for this attribute.

Election Anomalies

No examples are available to illustrate governance gaps for this attribute.