Development and Implementation
Continuing with the development and implementation phase, other types of controls that would need to be coded into the system and applications would be related to data validation, logging and monitoring, version control, etc.
3 slides · 1 min read · Domain 8
A large number of other controls may also be required, and may include testing and integrity controls for
- Program and application
- Operating instructions and procedures
- Utilities
- Privileged functions
- Job and system documentation
- Components including hardware, software, files, databases, reports, and also users
- Restart and recovery procedures
- Common program controls such as data validation
- Edits such as syntax, reasonableness, sometimes referred to as sanity check, range checks, and check digits
- Logging of security-relevant information
- Time stamps for certain timesensitive applications
- Before-and-after images of components where integrity is important
- Counts that are useful for process integrity checks; examples may include total transactions, batch totals, hash totals, and balances
- Internal checks such as checks for data integrity within the program while being processed
- Parameter ranges and data types
- Valid and legal address references
- Completion codes
- Peer code review
- Program or data library when developing software applications:
- Automated control system
- Current versions of both programs and documentation
- Record of changes made by whom, when authorized, what changed
- Test data and verification of changes
- Owner and stakeholder signoffs indicating correct testing
- A librarian ensures program or data library is controlled in accordance with policy and procedures:
- Controls all copies of data dictionaries, programs, load modules, and documentation and can provide version controls
- Change control/management that ensures no programs are added or changed unless properly tested and authorized and gone through the proper steps of making those changes
- Invalid transactions detected are written to a report and reviewed by developers and management