Supporting Material: Verifying compliance and integrity

Context

Rob is the Chief Security Officer of his company and needs to certify the integrity of the systems generating financial reports. Part of maintaining integrity is controlling what people have access to certain information assets, and ensuring that the implemented changes were approved and meet compliance requirements.

Description

Steps	Process and Activity	Roles	Work products	Tools
Establish access policies for all information assets.	Security Management Plan and Implement Security Practices	Security Manager	Security Plan	None
Implement security policies.	Security Management Plan and Implement Security Practices	Security Specialist	Security Risk Analysis	TAM – Apply Security Protection Mechanisms ITIM – Apply Security Protection Mechanisms
Administer people and their accounts.	Security Management Operate Security Protection Mechanisms	Security Specialist	Security Response	TAM – Operate Security Protection Mechanisms ITIM – Operate Security Protection Mechanisms ITDS – Operate Security Protection Mechanisms
Administer the policies and approval claims for all accounts.	Security Management Operate Security Protection Mechanisms	Security Specialist	Security Response	TAM – Operate Security Protection Mechanisms ITIM – Operate Security Protection Mechanisms ITDS – Operate Security Protection Mechanisms
Determine if access policies are enforced by comparing local privileges to policies.	Compliance Management Implement Compliance Controls	Compliance Manager	Compliance Operational Capabilities	TAM – Implement Compliance Controls
Produce security reports to show access policies are enforced by comparing local privileges to policies.	Security Management Monitor, Assess, and Report Security	Security Analyst	Security Reports	TAM – Monitor, Assess, and Report Security ITIM – Monitor, Assess, and Report Security
Implement audit findings by eliminating any orphan accounts. This is done by matching user accounts with known identities.	Security Management Operate Security Protection Mechanisms	Security Specialist	Security Response	TAM – Operate Security Protection Mechanisms TAM – Apply Security Protection Mechanisms ITIM – Operate Security Protection Mechanisms

Obtaining more information

To get more information, talk to a representative, purchase IBM® Service Management tools, or visit the IBM Service Management page.