11.09
From Corrective Action Plan AZ
Control Activities
Principle 11 - Design General Control Activities over Information Technology
Attribute 11.09 - General control activities may be applied at the entity, system, and business process levels. General control activities include the following:
- Security management - A separate process, addressing all components of internal control, for responding to risks related to information security.
- Logical and physical access - Control activities that restrict access to information technology to authorized users.
- Configuration management - Control activities to develop and maintain the operating and security features of information technology and control changes to their configuration.
- Segregation of duties - Separating control activity responsibilities related to information technology to prevent individuals from controlling all critical stages of a process or overriding automated processes.
- Contingency planning - Control activities that maintain the continuity of operations and rely on information technology, including contingency plans for recovery after a disruption of service.
