+-----+----------------------------------------------------------------+
| **1 | **Objectives**                                                 |
| .** |                                                                |
+-----+----------------------------------------------------------------+
| To  |                                                                |
| p   |                                                                |
| rov |                                                                |
| ide |                                                                |
| a   |                                                                |
| st  |                                                                |
| and |                                                                |
| ard |                                                                |
| a   |                                                                |
| sse |                                                                |
| ssm |                                                                |
| ent |                                                                |
| t   |                                                                |
| ool |                                                                |
| for |                                                                |
| id  |                                                                |
| ent |                                                                |
| ify |                                                                |
| ing |                                                                |
| the |                                                                |
| E   |                                                                |
| RES |                                                                |
| req |                                                                |
| uir |                                                                |
| eme |                                                                |
| nts |                                                                |
| to  |                                                                |
| m   |                                                                |
| eet |                                                                |
| c   |                                                                |
| omp |                                                                |
| lia |                                                                |
| nce |                                                                |
| w   |                                                                |
| ith |                                                                |
| 21  |                                                                |
| CFR |                                                                |
| P   |                                                                |
| art |                                                                |
| 11; |                                                                |
| id  |                                                                |
| ent |                                                                |
| ify |                                                                |
| c   |                                                                |
| omp |                                                                |
| lia |                                                                |
| nce |                                                                |
| gap |                                                                |
| or  |                                                                |
| ar  |                                                                |
| eas |                                                                |
| of  |                                                                |
| no  |                                                                |
| n-c |                                                                |
| omp |                                                                |
| lia |                                                                |
| nce |                                                                |
| w   |                                                                |
| ith |                                                                |
| the |                                                                |
| co  |                                                                |
| mpu |                                                                |
| ter |                                                                |
| sys |                                                                |
| tem |                                                                |
| or  |                                                                |
| app |                                                                |
| lic |                                                                |
| ati |                                                                |
| on; |                                                                |
| id  |                                                                |
| ent |                                                                |
| ify |                                                                |
| tem |                                                                |
| por |                                                                |
| ary |                                                                |
| or  |                                                                |
| per |                                                                |
| man |                                                                |
| ent |                                                                |
| sol |                                                                |
| uti |                                                                |
| ons |                                                                |
| to  |                                                                |
| re  |                                                                |
| med |                                                                |
| iat |                                                                |
| ion |                                                                |
| of  |                                                                |
| the |                                                                |
| ri  |                                                                |
| sk; |                                                                |
| and |                                                                |
| r   |                                                                |
| ank |                                                                |
| the |                                                                |
| r   |                                                                |
| isk |                                                                |
| to  |                                                                |
| the |                                                                |
| o   |                                                                |
| rga |                                                                |
| niz |                                                                |
| ati |                                                                |
| on. |                                                                |
+-----+----------------------------------------------------------------+
| **2 | ## Important notes                                             |
| .** |                                                                |
+-----+----------------------------------------------------------------+
| A.  |                                                                |
|   " |                                                                |
| No" |                                                                |
|     |                                                                |
|     |                                                                |
| res |                                                                |
| pon |                                                                |
| ses |                                                                |
|     |                                                                |
|  on |                                                                |
|     |                                                                |
|   t |                                                                |
| his |                                                                |
|     |                                                                |
|   f |                                                                |
| orm |                                                                |
|     |                                                                |
|     |                                                                |
| may |                                                                |
|     |                                                                |
|  in |                                                                |
| dic |                                                                |
| ate |                                                                |
|     |                                                                |
|   a |                                                                |
|     |                                                                |
|   c |                                                                |
| omp |                                                                |
| lia |                                                                |
| nce |                                                                |
|     |                                                                |
|     |                                                                |
| gap |                                                                |
|     |                                                                |
|     |                                                                |
| and |                                                                |
|     |                                                                |
|     |                                                                |
| sho |                                                                |
| uld |                                                                |
|     |                                                                |
|  be |                                                                |
|     |                                                                |
|     |                                                                |
| eva |                                                                |
| lua |                                                                |
| ted |                                                                |
|     |                                                                |
|  by |                                                                |
|     |                                                                |
|  ap |                                                                |
| pro |                                                                |
| pri |                                                                |
| ate |                                                                |
|     |                                                                |
|   Q |                                                                |
| A/R |                                                                |
| egu |                                                                |
| lat |                                                                |
| ory |                                                                |
|     |                                                                |
|   o |                                                                |
| rga |                                                                |
| niz |                                                                |
| ati |                                                                |
| ons |                                                                |
|     |                                                                |
|     |                                                                |
| and |                                                                |
|     |                                                                |
|     |                                                                |
| the |                                                                |
|     |                                                                |
|     |                                                                |
| Sys |                                                                |
| tem |                                                                |
|     |                                                                |
|  Bu |                                                                |
| sin |                                                                |
| ess |                                                                |
|     |                                                                |
|     |                                                                |
| Own |                                                                |
| er. |                                                                |
|     |                                                                |
|  Wh |                                                                |
| ere |                                                                |
|     |                                                                |
|   c |                                                                |
| omp |                                                                |
| lia |                                                                |
| nce |                                                                |
|     |                                                                |
|   g |                                                                |
| aps |                                                                |
|     |                                                                |
|     |                                                                |
| are |                                                                |
|     |                                                                |
|   c |                                                                |
| onf |                                                                |
| irm |                                                                |
| ed, |                                                                |
|     |                                                                |
|   t |                                                                |
| his |                                                                |
|     |                                                                |
|   f |                                                                |
| orm |                                                                |
|     |                                                                |
|     |                                                                |
| sho |                                                                |
| uld |                                                                |
|     |                                                                |
|  be |                                                                |
|     |                                                                |
|  re |                                                                |
| tai |                                                                |
| ned |                                                                |
|     |                                                                |
|  in |                                                                |
|     |                                                                |
|     |                                                                |
| the |                                                                |
|     |                                                                |
|     |                                                                |
| per |                                                                |
| man |                                                                |
| ent |                                                                |
|     |                                                                |
|     |                                                                |
| sys |                                                                |
| tem |                                                                |
|     |                                                                |
|   v |                                                                |
| ali |                                                                |
| dat |                                                                |
| ion |                                                                |
|     |                                                                |
|  or |                                                                |
|     |                                                                |
|   t |                                                                |
| est |                                                                |
| ing |                                                                |
|     |                                                                |
|   d |                                                                |
| ocu |                                                                |
| men |                                                                |
| tat |                                                                |
| ion |                                                                |
|     |                                                                |
|  al |                                                                |
| ong |                                                                |
|     |                                                                |
|   w |                                                                |
| ith |                                                                |
|     |                                                                |
|     |                                                                |
| all |                                                                |
|     |                                                                |
|   d |                                                                |
| ata |                                                                |
|     |                                                                |
|  re |                                                                |
| lat |                                                                |
| ing |                                                                |
|     |                                                                |
|  to |                                                                |
|     |                                                                |
|     |                                                                |
| fol |                                                                |
| low |                                                                |
| -up |                                                                |
|     |                                                                |
|   a |                                                                |
| cti |                                                                |
| ons |                                                                |
|     |                                                                |
|  to |                                                                |
|     |                                                                |
|   c |                                                                |
| orr |                                                                |
| ect |                                                                |
|     |                                                                |
|     |                                                                |
| def |                                                                |
| ici |                                                                |
| enc |                                                                |
| ies |                                                                |
|     |                                                                |
|  fo |                                                                |
| und |                                                                |
|     |                                                                |
|  (e |                                                                |
| .g. |                                                                |
|     |                                                                |
|   i |                                                                |
| nte |                                                                |
| rim |                                                                |
|     |                                                                |
|     |                                                                |
| con |                                                                |
| tro |                                                                |
| ls, |                                                                |
|     |                                                                |
|   a |                                                                |
| ddi |                                                                |
| tio |                                                                |
| nal |                                                                |
|     |                                                                |
|  ar |                                                                |
| eas |                                                                |
|     |                                                                |
|  of |                                                                |
|     |                                                                |
|     |                                                                |
| tes |                                                                |
| tin |                                                                |
| g). |                                                                |
|     |                                                                |
| B.  |                                                                |
|   B |                                                                |
| eca |                                                                |
| use |                                                                |
|     |                                                                |
|  of |                                                                |
|     |                                                                |
|     |                                                                |
| the |                                                                |
|     |                                                                |
|   r |                                                                |
| egu |                                                                |
| lat |                                                                |
| ory |                                                                |
|     |                                                                |
|   c |                                                                |
| omp |                                                                |
| lia |                                                                |
| nce |                                                                |
|     |                                                                |
|     |                                                                |
| iss |                                                                |
| ues |                                                                |
|     |                                                                |
|     |                                                                |
| inv |                                                                |
| olv |                                                                |
| ed, |                                                                |
|     |                                                                |
|     |                                                                |
| all |                                                                |
|     |                                                                |
|     |                                                                |
| nec |                                                                |
| ess |                                                                |
| ary |                                                                |
|     |                                                                |
|   f |                                                                |
| act |                                                                |
| ors |                                                                |
|     |                                                                |
|  of |                                                                |
|     |                                                                |
|     |                                                                |
| sys |                                                                |
| tem |                                                                |
|     |                                                                |
|   u |                                                                |
| se, |                                                                |
|     |                                                                |
|   r |                                                                |
| egu |                                                                |
| lat |                                                                |
| ory |                                                                |
|     |                                                                |
|     |                                                                |
| req |                                                                |
| uir |                                                                |
| eme |                                                                |
| nts |                                                                |
|     |                                                                |
|     |                                                                |
| and |                                                                |
|     |                                                                |
|     |                                                                |
| tec |                                                                |
| hni |                                                                |
| cal |                                                                |
|     |                                                                |
|     |                                                                |
| cap |                                                                |
| abi |                                                                |
| lit |                                                                |
| ies |                                                                |
|     |                                                                |
|   m |                                                                |
| ust |                                                                |
|     |                                                                |
|  be |                                                                |
|     |                                                                |
|   u |                                                                |
| nde |                                                                |
| rst |                                                                |
| ood |                                                                |
|     |                                                                |
|     |                                                                |
| bef |                                                                |
| ore |                                                                |
|     |                                                                |
|   a |                                                                |
| nsw |                                                                |
| eri |                                                                |
| ng. |                                                                |
|     |                                                                |
|  Wh |                                                                |
| ere |                                                                |
| ver |                                                                |
|     |                                                                |
|     |                                                                |
| pos |                                                                |
| sib |                                                                |
| le, |                                                                |
|     |                                                                |
|   t |                                                                |
| his |                                                                |
|     |                                                                |
|   a |                                                                |
| sse |                                                                |
| ssm |                                                                |
| ent |                                                                |
|     |                                                                |
|     |                                                                |
| sho |                                                                |
| uld |                                                                |
|     |                                                                |
|  be |                                                                |
|     |                                                                |
|     |                                                                |
| con |                                                                |
| duc |                                                                |
| ted |                                                                |
|     |                                                                |
|  by |                                                                |
|     |                                                                |
|  te |                                                                |
| ams |                                                                |
|     |                                                                |
|   c |                                                                |
| ons |                                                                |
| ist |                                                                |
| ing |                                                                |
|     |                                                                |
|  of |                                                                |
|     |                                                                |
|  bu |                                                                |
| sin |                                                                |
| ess |                                                                |
|     |                                                                |
|   o |                                                                |
| wne |                                                                |
| rs/ |                                                                |
| use |                                                                |
| rs, |                                                                |
|     |                                                                |
|     |                                                                |
| sys |                                                                |
| tem |                                                                |
|     |                                                                |
|     |                                                                |
| tec |                                                                |
| hni |                                                                |
| cal |                                                                |
|     |                                                                |
|   e |                                                                |
| xpe |                                                                |
| rts |                                                                |
|     |                                                                |
|     |                                                                |
| and |                                                                |
|     |                                                                |
|  ap |                                                                |
| pro |                                                                |
| pri |                                                                |
| ate |                                                                |
|     |                                                                |
|   r |                                                                |
| egu |                                                                |
| lat |                                                                |
| ory |                                                                |
| /QA |                                                                |
|     |                                                                |
|     |                                                                |
| res |                                                                |
| our |                                                                |
| ces |                                                                |
|     |                                                                |
|  to |                                                                |
|     |                                                                |
|     |                                                                |
| ass |                                                                |
| ure |                                                                |
|     |                                                                |
|     |                                                                |
| its |                                                                |
|     |                                                                |
|     |                                                                |
| acc |                                                                |
| ura |                                                                |
| cy. |                                                                |
|     |                                                                |
|  In |                                                                |
|     |                                                                |
|     |                                                                |
| all |                                                                |
|     |                                                                |
|     |                                                                |
| cas |                                                                |
| es, |                                                                |
|     |                                                                |
|  in |                                                                |
| div |                                                                |
| idu |                                                                |
| als |                                                                |
|     |                                                                |
|     |                                                                |
| and |                                                                |
|     |                                                                |
|  te |                                                                |
| ams |                                                                |
|     |                                                                |
|     |                                                                |
| mak |                                                                |
| ing |                                                                |
|     |                                                                |
|  th |                                                                |
| ese |                                                                |
|     |                                                                |
|  as |                                                                |
| ses |                                                                |
| sme |                                                                |
| nts |                                                                |
|     |                                                                |
|   m |                                                                |
| ust |                                                                |
|     |                                                                |
|  be |                                                                |
|     |                                                                |
|  pr |                                                                |
| epa |                                                                |
| red |                                                                |
|     |                                                                |
|  to |                                                                |
|     |                                                                |
|   s |                                                                |
| upp |                                                                |
| ort |                                                                |
|     |                                                                |
|     |                                                                |
| the |                                                                |
|     |                                                                |
|  va |                                                                |
| lid |                                                                |
| ity |                                                                |
|     |                                                                |
|  of |                                                                |
|     |                                                                |
|  th |                                                                |
| eir |                                                                |
|     |                                                                |
|   r |                                                                |
| esp |                                                                |
| ons |                                                                |
| es. |                                                                |
|     |                                                                |
| C   |                                                                |
| .   |                                                                |
| Use |                                                                |
|     |                                                                |
|     |                                                                |
| the |                                                                |
|     |                                                                |
|     |                                                                |
| fol |                                                                |
| low |                                                                |
| ing |                                                                |
|     |                                                                |
|  cr |                                                                |
| ite |                                                                |
| ria |                                                                |
|     |                                                                |
|     |                                                                |
| for |                                                                |
|     |                                                                |
|     |                                                                |
| rat |                                                                |
| ing |                                                                |
|     |                                                                |
|   a |                                                                |
|     |                                                                |
|   c |                                                                |
| omp |                                                                |
| lia |                                                                |
| nce |                                                                |
|     |                                                                |
|   g |                                                                |
| ap. |                                                                |
|     |                                                                |
| >   |                                                                |
| 1\. |                                                                |
| > A |                                                                |
| ppl |                                                                |
| ica |                                                                |
| bil |                                                                |
| ity |                                                                |
| >   |                                                                |
|  of |                                                                |
| > R |                                                                |
| eco |                                                                |
| rds |                                                                |
| >   |                                                                |
|  to |                                                                |
| >   |                                                                |
| the |                                                                |
| > S |                                                                |
| yst |                                                                |
| em: |                                                                |
| > T |                                                                |
| his |                                                                |
| > s |                                                                |
| ect |                                                                |
| ion |                                                                |
| >   |                                                                |
|  is |                                                                |
| >   |                                                                |
|  de |                                                                |
| sig |                                                                |
| ned |                                                                |
| >   |                                                                |
|  to |                                                                |
| > p |                                                                |
| rov |                                                                |
| ide |                                                                |
| >   |                                                                |
|  an |                                                                |
| > i |                                                                |
| ndi |                                                                |
| cat |                                                                |
| ion |                                                                |
| >   |                                                                |
|  of |                                                                |
| >   |                                                                |
| the |                                                                |
| >   |                                                                |
|  sc |                                                                |
| ope |                                                                |
| /re |                                                                |
| ach |                                                                |
| >   |                                                                |
|  of |                                                                |
| >   |                                                                |
| the |                                                                |
| >   |                                                                |
|  co |                                                                |
| mpu |                                                                |
| ter |                                                                |
| >   |                                                                |
| sys |                                                                |
| tem |                                                                |
| >   |                                                                |
|  in |                                                                |
| >   |                                                                |
| the |                                                                |
| >   |                                                                |
| caB |                                                                |
| IG™ |                                                                |
| >   |                                                                |
| env |                                                                |
| iro |                                                                |
| nme |                                                                |
| nt. |                                                                |
| > A |                                                                |
| >   |                                                                |
| sys |                                                                |
| tem |                                                                |
| > t |                                                                |
| hat |                                                                |
| >   |                                                                |
|  co |                                                                |
| nta |                                                                |
| ins |                                                                |
| > e |                                                                |
| lec |                                                                |
| tro |                                                                |
| nic |                                                                |
| > r |                                                                |
| eco |                                                                |
| rds |                                                                |
| >   |                                                                |
| and |                                                                |
| > e |                                                                |
| lec |                                                                |
| tro |                                                                |
| nic |                                                                |
| > s |                                                                |
| ign |                                                                |
| atu |                                                                |
| res |                                                                |
| >   |                                                                |
|  un |                                                                |
| der |                                                                |
| >   |                                                                |
| all |                                                                |
| >   |                                                                |
| pre |                                                                |
| dic |                                                                |
| ate |                                                                |
| >   |                                                                |
|  ru |                                                                |
| les |                                                                |
| >   |                                                                |
| are |                                                                |
| >   |                                                                |
|  of |                                                                |
| > a |                                                                |
| > m |                                                                |
| ore |                                                                |
| >   |                                                                |
|  si |                                                                |
| gni |                                                                |
| fic |                                                                |
| ant |                                                                |
| > c |                                                                |
| onc |                                                                |
| ern |                                                                |
| > t |                                                                |
| han |                                                                |
| > a |                                                                |
| >   |                                                                |
| sys |                                                                |
| tem |                                                                |
| > t |                                                                |
| hat |                                                                |
| >   |                                                                |
| may |                                                                |
| > c |                                                                |
| ont |                                                                |
| ain |                                                                |
| > o |                                                                |
| nly |                                                                |
| >   |                                                                |
| one |                                                                |
| > t |                                                                |
| ype |                                                                |
| >   |                                                                |
|  of |                                                                |
| > e |                                                                |
| lec |                                                                |
| tro |                                                                |
| nic |                                                                |
| > r |                                                                |
| eco |                                                                |
| rd. |                                                                |
| >   |                                                                |
| >   |                                                                |
| 2\. |                                                                |
| > P |                                                                |
| ati |                                                                |
| ent |                                                                |
| > I |                                                                |
| mpa |                                                                |
| ct: |                                                                |
| > T |                                                                |
| his |                                                                |
| > s |                                                                |
| ect |                                                                |
| ion |                                                                |
| >   |                                                                |
|  is |                                                                |
| >   |                                                                |
|  de |                                                                |
| sig |                                                                |
| ned |                                                                |
| >   |                                                                |
|  to |                                                                |
| > p |                                                                |
| rov |                                                                |
| ide |                                                                |
| >   |                                                                |
|  an |                                                                |
| > i |                                                                |
| ndi |                                                                |
| cat |                                                                |
| ion |                                                                |
| >   |                                                                |
|  of |                                                                |
| >   |                                                                |
|  le |                                                                |
| vel |                                                                |
| >   |                                                                |
|  of |                                                                |
| > p |                                                                |
| ati |                                                                |
| ent |                                                                |
| >   |                                                                |
| imp |                                                                |
| act |                                                                |
| >   |                                                                |
|  in |                                                                |
| >   |                                                                |
| the |                                                                |
| >   |                                                                |
|  ev |                                                                |
| ent |                                                                |
| >   |                                                                |
|  of |                                                                |
| > a |                                                                |
| >   |                                                                |
| sys |                                                                |
| tem |                                                                |
| > f |                                                                |
| ail |                                                                |
| ure |                                                                |
| >   |                                                                |
|  or |                                                                |
| > b |                                                                |
| rea |                                                                |
| ch. |                                                                |
| >   |                                                                |
| >   |                                                                |
| *Sc |                                                                |
| ore |                                                                |
| >   |                                                                |
|  of |                                                                |
| >   |                                                                |
|  3* |                                                                |
| > = |                                                                |
| >   |                                                                |
| Dir |                                                                |
| ect |                                                                |
| > P |                                                                |
| ati |                                                                |
| ent |                                                                |
| >   |                                                                |
| Imp |                                                                |
| act |                                                                |
| >   |                                                                |
| and |                                                                |
| >   |                                                                |
|  is |                                                                |
| > d |                                                                |
| efi |                                                                |
| ned |                                                                |
| >   |                                                                |
|  as |                                                                |
| >   |                                                                |
| any |                                                                |
| >   |                                                                |
| sys |                                                                |
| tem |                                                                |
| > f |                                                                |
| ail |                                                                |
| ure |                                                                |
| >   |                                                                |
|  or |                                                                |
| >   |                                                                |
| bre |                                                                |
| ach |                                                                |
| > l |                                                                |
| ead |                                                                |
| ing |                                                                |
| >   |                                                                |
|  to |                                                                |
| >   |                                                                |
|  ad |                                                                |
| ult |                                                                |
| era |                                                                |
| ted |                                                                |
| > d |                                                                |
| ata |                                                                |
| >   |                                                                |
| and |                                                                |
| /or |                                                                |
| >   |                                                                |
|  wo |                                                                |
| uld |                                                                |
| > c |                                                                |
| omp |                                                                |
| rom |                                                                |
| ise |                                                                |
| >   |                                                                |
| the |                                                                |
| > a |                                                                |
| bil |                                                                |
| ity |                                                                |
| >   |                                                                |
|  to |                                                                |
| > m |                                                                |
| oni |                                                                |
| tor |                                                                |
| > p |                                                                |
| ati |                                                                |
| ent |                                                                |
| >   |                                                                |
| saf |                                                                |
| ety |                                                                |
| > d |                                                                |
| ata |                                                                |
| >   |                                                                |
|  in |                                                                |
| > s |                                                                |
| upp |                                                                |
| ort |                                                                |
| >   |                                                                |
|  of |                                                                |
| >   |                                                                |
|  cl |                                                                |
| ini |                                                                |
| cal |                                                                |
| > t |                                                                |
| ria |                                                                |
| ls. |                                                                |
| >   |                                                                |
| >   |                                                                |
| *Sc |                                                                |
| ore |                                                                |
| >   |                                                                |
|  of |                                                                |
| >   |                                                                |
|  2* |                                                                |
| > = |                                                                |
| >   |                                                                |
|  In |                                                                |
| dir |                                                                |
| ect |                                                                |
| > P |                                                                |
| ati |                                                                |
| ent |                                                                |
| >   |                                                                |
| Imp |                                                                |
| act |                                                                |
| >   |                                                                |
| and |                                                                |
| >   |                                                                |
|  is |                                                                |
| > d |                                                                |
| efi |                                                                |
| ned |                                                                |
| >   |                                                                |
|  as |                                                                |
| >   |                                                                |
| any |                                                                |
| >   |                                                                |
| sys |                                                                |
| tem |                                                                |
| > f |                                                                |
| ail |                                                                |
| ure |                                                                |
| >   |                                                                |
|  or |                                                                |
| >   |                                                                |
| bre |                                                                |
| ach |                                                                |
| > l |                                                                |
| ead |                                                                |
| ing |                                                                |
| >   |                                                                |
|  to |                                                                |
| > f |                                                                |
| ail |                                                                |
| ure |                                                                |
| >   |                                                                |
|  of |                                                                |
| >   |                                                                |
| any |                                                                |
| >   |                                                                |
|  da |                                                                |
| tab |                                                                |
| ase |                                                                |
| >   |                                                                |
|  to |                                                                |
| >   |                                                                |
| ret |                                                                |
| ain |                                                                |
| > p |                                                                |
| ati |                                                                |
| ent |                                                                |
| >   |                                                                |
|  da |                                                                |
| ta. |                                                                |
| >   |                                                                |
| >   |                                                                |
| *Sc |                                                                |
| ore |                                                                |
| >   |                                                                |
|  of |                                                                |
| >   |                                                                |
|  1* |                                                                |
| > = |                                                                |
| >   |                                                                |
|  No |                                                                |
| > P |                                                                |
| ati |                                                                |
| ent |                                                                |
| >   |                                                                |
| Imp |                                                                |
| act |                                                                |
| >   |                                                                |
| and |                                                                |
| >   |                                                                |
|  is |                                                                |
| > d |                                                                |
| efi |                                                                |
| ned |                                                                |
| >   |                                                                |
|  as |                                                                |
| >   |                                                                |
| any |                                                                |
| >   |                                                                |
| sys |                                                                |
| tem |                                                                |
| > f |                                                                |
| ail |                                                                |
| ure |                                                                |
| >   |                                                                |
|  or |                                                                |
| >   |                                                                |
| bre |                                                                |
| ach |                                                                |
| > t |                                                                |
| hat |                                                                |
| >   |                                                                |
| has |                                                                |
| >   |                                                                |
|  no |                                                                |
| >   |                                                                |
| imp |                                                                |
| act |                                                                |
| >   |                                                                |
|  on |                                                                |
| > p |                                                                |
| ati |                                                                |
| ent |                                                                |
| >   |                                                                |
| saf |                                                                |
| ety |                                                                |
| >   |                                                                |
|  or |                                                                |
| > p |                                                                |
| ati |                                                                |
| ent |                                                                |
| >   |                                                                |
|  da |                                                                |
| ta. |                                                                |
| >   |                                                                |
| > ( |                                                                |
| **N |                                                                |
| OTE |                                                                |
| :** |                                                                |
| > * |                                                                |
| sco |                                                                |
| res |                                                                |
| >   |                                                                |
| sho |                                                                |
| uld |                                                                |
| >   |                                                                |
|  be |                                                                |
| >   |                                                                |
|  in |                                                                |
| ter |                                                                |
| pre |                                                                |
| ted |                                                                |
| >   |                                                                |
|  in |                                                                |
| >   |                                                                |
|  co |                                                                |
| nju |                                                                |
| nct |                                                                |
| ion |                                                                |
| > w |                                                                |
| ith |                                                                |
| >   |                                                                |
| the |                                                                |
| >   |                                                                |
|  pr |                                                                |
| oba |                                                                |
| bil |                                                                |
| ity |                                                                |
| >   |                                                                |
|  of |                                                                |
| >   |                                                                |
| any |                                                                |
| >   |                                                                |
|  gi |                                                                |
| ven |                                                                |
| > f |                                                                |
| ail |                                                                |
| ure |                                                                |
| >   |                                                                |
|  or |                                                                |
| >   |                                                                |
| bre |                                                                |
| ach |                                                                |
| >   |                                                                |
| occ |                                                                |
| urr |                                                                |
| ing |                                                                |
| >   |                                                                |
|  in |                                                                |
| >   |                                                                |
|  ad |                                                                |
| dit |                                                                |
| ion |                                                                |
| >   |                                                                |
|  to |                                                                |
| >   |                                                                |
| the |                                                                |
| >   |                                                                |
| ava |                                                                |
| ila |                                                                |
| bil |                                                                |
| ity |                                                                |
| >   |                                                                |
|  of |                                                                |
| >   |                                                                |
|  in |                                                                |
| dep |                                                                |
| end |                                                                |
| ent |                                                                |
| > v |                                                                |
| eri |                                                                |
| fic |                                                                |
| ati |                                                                |
| ons |                                                                |
| >   |                                                                |
| and |                                                                |
| /or |                                                                |
| > s |                                                                |
| upp |                                                                |
| ort |                                                                |
| > s |                                                                |
| yst |                                                                |
| ems |                                                                |
| > t |                                                                |
| hat |                                                                |
| >   |                                                                |
|  mi |                                                                |
| tig |                                                                |
| ate |                                                                |
| >   |                                                                |
| the |                                                                |
| > f |                                                                |
| ail |                                                                |
| ure |                                                                |
| *.) |                                                                |
|     |                                                                |
| 3\. |                                                                |
| S   |                                                                |
| ole |                                                                |
| R   |                                                                |
| epo |                                                                |
| sit |                                                                |
| ory |                                                                |
| of  |                                                                |
| Inf |                                                                |
| orm |                                                                |
| ati |                                                                |
| on: |                                                                |
| T   |                                                                |
| his |                                                                |
| s   |                                                                |
| ect |                                                                |
| ion |                                                                |
| is  |                                                                |
| de  |                                                                |
| sig |                                                                |
| ned |                                                                |
| to  |                                                                |
| p   |                                                                |
| rov |                                                                |
| ide |                                                                |
| an  |                                                                |
| i   |                                                                |
| ndi |                                                                |
| cat |                                                                |
| ion |                                                                |
| of  |                                                                |
| le  |                                                                |
| vel |                                                                |
| of  |                                                                |
| rec |                                                                |
| ord |                                                                |
| r   |                                                                |
| edu |                                                                |
| nda |                                                                |
| ncy |                                                                |
| in  |                                                                |
| f   |                                                                |
| ail |                                                                |
| -ov |                                                                |
| er. |                                                                |
|     |                                                                |
| >   |                                                                |
| *Sc |                                                                |
| ore |                                                                |
| >   |                                                                |
|  of |                                                                |
| >   |                                                                |
|  3* |                                                                |
| > = |                                                                |
| > R |                                                                |
| eco |                                                                |
| rds |                                                                |
| >   |                                                                |
| are |                                                                |
| > o |                                                                |
| nly |                                                                |
| >   |                                                                |
| ava |                                                                |
| ila |                                                                |
| ble |                                                                |
| >   |                                                                |
|  el |                                                                |
| ect |                                                                |
| ron |                                                                |
| ica |                                                                |
| lly |                                                                |
| >   |                                                                |
| (no |                                                                |
| >   |                                                                |
|  ot |                                                                |
| her |                                                                |
| >   |                                                                |
| sou |                                                                |
| rce |                                                                |
| >   |                                                                |
|  of |                                                                |
| >   |                                                                |
| dat |                                                                |
| a). |                                                                |
| >   |                                                                |
| >   |                                                                |
| *Sc |                                                                |
| ore |                                                                |
| >   |                                                                |
|  of |                                                                |
| >   |                                                                |
|  2* |                                                                |
| > = |                                                                |
| > R |                                                                |
| eco |                                                                |
| rds |                                                                |
| >   |                                                                |
| are |                                                                |
| >   |                                                                |
| ava |                                                                |
| ila |                                                                |
| ble |                                                                |
| >   |                                                                |
|  in |                                                                |
| >   |                                                                |
| raw |                                                                |
| > f |                                                                |
| orm |                                                                |
| >   |                                                                |
| and |                                                                |
| >   |                                                                |
|  pa |                                                                |
| per |                                                                |
| > c |                                                                |
| opy |                                                                |
| >   |                                                                |
|  in |                                                                |
| >   |                                                                |
|  ad |                                                                |
| dit |                                                                |
| ion |                                                                |
| >   |                                                                |
|  to |                                                                |
| >   |                                                                |
|  el |                                                                |
| ect |                                                                |
| ron |                                                                |
| ica |                                                                |
| lly |                                                                |
| > ( |                                                                |
| sou |                                                                |
| rce |                                                                |
| > d |                                                                |
| ata |                                                                |
| >   |                                                                |
|  is |                                                                |
| >   |                                                                |
| ava |                                                                |
| ila |                                                                |
| ble |                                                                |
| >   |                                                                |
| tho |                                                                |
| ugh |                                                                |
| >   |                                                                |
|  it |                                                                |
| >   |                                                                |
|  re |                                                                |
| qui |                                                                |
| res |                                                                |
| >   |                                                                |
| man |                                                                |
| ipu |                                                                |
| lat |                                                                |
| ion |                                                                |
| >   |                                                                |
|  in |                                                                |
| >   |                                                                |
|  or |                                                                |
| der |                                                                |
| >   |                                                                |
|  to |                                                                |
| >   |                                                                |
| re- |                                                                |
| cre |                                                                |
| ate |                                                                |
| >   |                                                                |
| the |                                                                |
| >   |                                                                |
| rec |                                                                |
| ord |                                                                |
| s). |                                                                |
| >   |                                                                |
| >   |                                                                |
| *Sc |                                                                |
| ore |                                                                |
| >   |                                                                |
|  of |                                                                |
| >   |                                                                |
|  1* |                                                                |
| > = |                                                                |
| > R |                                                                |
| eco |                                                                |
| rds |                                                                |
| >   |                                                                |
| are |                                                                |
| >   |                                                                |
| all |                                                                |
| >   |                                                                |
| ava |                                                                |
| ila |                                                                |
| ble |                                                                |
| >   |                                                                |
|  in |                                                                |
| >   |                                                                |
|  pa |                                                                |
| per |                                                                |
| > f |                                                                |
| orm |                                                                |
| >   |                                                                |
|  in |                                                                |
| >   |                                                                |
|  ad |                                                                |
| dit |                                                                |
| ion |                                                                |
| >   |                                                                |
|  to |                                                                |
| >   |                                                                |
|  el |                                                                |
| ect |                                                                |
| ron |                                                                |
| ica |                                                                |
| lly |                                                                |
| > ( |                                                                |
| sou |                                                                |
| rce |                                                                |
| > d |                                                                |
| ata |                                                                |
| > d |                                                                |
| oes |                                                                |
| >   |                                                                |
| not |                                                                |
| > r |                                                                |
| equ |                                                                |
| ire |                                                                |
| >   |                                                                |
| man |                                                                |
| ipu |                                                                |
| lat |                                                                |
| ion |                                                                |
| >   |                                                                |
|  in |                                                                |
| >   |                                                                |
|  or |                                                                |
| der |                                                                |
| >   |                                                                |
|  to |                                                                |
| >   |                                                                |
| re- |                                                                |
| cre |                                                                |
| ate |                                                                |
| >   |                                                                |
| rec |                                                                |
| ord |                                                                |
| s). |                                                                |
| >   |                                                                |
| >   |                                                                |
| 4\. |                                                                |
| >   |                                                                |
| Int |                                                                |
| ens |                                                                |
| ity |                                                                |
| >   |                                                                |
|  of |                                                                |
| > U |                                                                |
| se: |                                                                |
| > T |                                                                |
| his |                                                                |
| > s |                                                                |
| ect |                                                                |
| ion |                                                                |
| >   |                                                                |
|  is |                                                                |
| >   |                                                                |
|  de |                                                                |
| sig |                                                                |
| ned |                                                                |
| >   |                                                                |
|  to |                                                                |
| > p |                                                                |
| rov |                                                                |
| ide |                                                                |
| >   |                                                                |
|  an |                                                                |
| > i |                                                                |
| ndi |                                                                |
| cat |                                                                |
| ion |                                                                |
| >   |                                                                |
|  of |                                                                |
| >   |                                                                |
| how |                                                                |
| >   |                                                                |
|  in |                                                                |
| ten |                                                                |
| siv |                                                                |
| ely |                                                                |
| >   |                                                                |
| the |                                                                |
| >   |                                                                |
| sys |                                                                |
| tem |                                                                |
| >   |                                                                |
|  is |                                                                |
| > u |                                                                |
| sed |                                                                |
| >   |                                                                |
| dur |                                                                |
| ing |                                                                |
| >   |                                                                |
| any |                                                                |
| >   |                                                                |
|  gi |                                                                |
| ven |                                                                |
| >   |                                                                |
| per |                                                                |
| iod |                                                                |
| >   |                                                                |
|  of |                                                                |
| >   |                                                                |
|  ti |                                                                |
| me. |                                                                |
| >   |                                                                |
| >   |                                                                |
| *Sc |                                                                |
| ore |                                                                |
| >   |                                                                |
|  of |                                                                |
| >   |                                                                |
|  3* |                                                                |
| > = |                                                                |
| >   |                                                                |
|  In |                                                                |
| ten |                                                                |
| siv |                                                                |
| ely |                                                                |
| > U |                                                                |
| sed |                                                                |
| > m |                                                                |
| ean |                                                                |
| ing |                                                                |
| >   |                                                                |
|  mu |                                                                |
| lti |                                                                |
| ple |                                                                |
| >   |                                                                |
|  ti |                                                                |
| mes |                                                                |
| > t |                                                                |
| hro |                                                                |
| ugh |                                                                |
| out |                                                                |
| >   |                                                                |
| any |                                                                |
| >   |                                                                |
|  gi |                                                                |
| ven |                                                                |
| > d |                                                                |
| ay. |                                                                |
| >   |                                                                |
| >   |                                                                |
| *Sc |                                                                |
| ore |                                                                |
| >   |                                                                |
|  of |                                                                |
| >   |                                                                |
|  2* |                                                                |
| > = |                                                                |
| > M |                                                                |
| ode |                                                                |
| rat |                                                                |
| ely |                                                                |
| > U |                                                                |
| sed |                                                                |
| > m |                                                                |
| ean |                                                                |
| ing |                                                                |
| > a |                                                                |
| ppr |                                                                |
| oxi |                                                                |
| mat |                                                                |
| ely |                                                                |
| > o |                                                                |
| nce |                                                                |
| >   |                                                                |
|  or |                                                                |
| >   |                                                                |
|  tw |                                                                |
| ice |                                                                |
| > a |                                                                |
| >   |                                                                |
|  we |                                                                |
| ek. |                                                                |
| >   |                                                                |
| >   |                                                                |
| *Sc |                                                                |
| ore |                                                                |
| >   |                                                                |
|  of |                                                                |
| >   |                                                                |
|  1* |                                                                |
| > = |                                                                |
| >   |                                                                |
| Rar |                                                                |
| ely |                                                                |
| > U |                                                                |
| sed |                                                                |
| > m |                                                                |
| ean |                                                                |
| ing |                                                                |
| > t |                                                                |
| hat |                                                                |
| >   |                                                                |
| the |                                                                |
| >   |                                                                |
| pro |                                                                |
| ces |                                                                |
| ses |                                                                |
| >   |                                                                |
|  co |                                                                |
| uld |                                                                |
| >   |                                                                |
|  oc |                                                                |
| cur |                                                                |
| > w |                                                                |
| ith |                                                                |
| out |                                                                |
| >   |                                                                |
|  sy |                                                                |
| ste |                                                                |
| m's |                                                                |
| > u |                                                                |
| se. |                                                                |
+-----+----------------------------------------------------------------+

  ------------------ ------------------------- ------------------------------------------
  **General                                    **Responses:**
  Considerations**                             

  1\.                Which electronic records  
                     in the system, if any,    
                     require signature per     
                     predicate rule or         
                     internal SOP?             

  2\.                List interfaces to other  
                     systems either used for   
                     GXP data capture or to    
                     export GXP data to other  
                     systems                   

  3\.                Identify key system       
                     personnel including: User 
                     and user groups, system   
                     owner, system             
                     administrator             

  4\.                Provide an overview of    
                     the system platform and   
                     architecture relative to  
                     security, audit logs      

  5\.                Where ER/ES have been     
                     identified, has the       
                     functionality been        
                     validated against 21 CFR  
                     Part 11?                  

  6\.                Are existing procedural   
                     controls in place that    
                     provide an interim        
                     solution and reduce the   
                     risk of non-compliance?   
  ------------------ ------------------------- ------------------------------------------

+---+-------------------------+-----+-------+----------+----------------+
|   |                         | **  | **    | **Inf    | **Steps to     |
|   |                         | Cha | Compl | ormation | Remediate      |
|   |                         | lle | iance | on       | Gap**          |
|   |                         | nge | Gap   | Risk**   |                |
|   |                         | M   | Qu    |          |                |
|   |                         | et? | antif |          |                |
|   |                         | Ye  | ied** |          |                |
|   |                         | s/N |       |          |                |
|   |                         | o** |       |          |                |
+===+=========================+=====+=======+==========+================+
| # |                         |     |       |          |                |
| # |                         |     |       |          |                |
| # |                         |     |       |          |                |
| # |                         |     |       |          |                |
| # |                         |     |       |          |                |
| # |                         |     |       |          |                |
| # |                         |     |       |          |                |
| # |                         |     |       |          |                |
| # |                         |     |       |          |                |
|   |                         |     |       |          |                |
| * |                         |     |       |          |                |
| * |                         |     |       |          |                |
| P |                         |     |       |          |                |
| o |                         |     |       |          |                |
| l |                         |     |       |          |                |
| i |                         |     |       |          |                |
| c |                         |     |       |          |                |
| y |                         |     |       |          |                |
|   |                         |     |       |          |                |
| a |                         |     |       |          |                |
| n |                         |     |       |          |                |
| d |                         |     |       |          |                |
| / |                         |     |       |          |                |
| o |                         |     |       |          |                |
| r |                         |     |       |          |                |
|   |                         |     |       |          |                |
| P |                         |     |       |          |                |
| r |                         |     |       |          |                |
| o |                         |     |       |          |                |
| c |                         |     |       |          |                |
| e |                         |     |       |          |                |
| d |                         |     |       |          |                |
| u |                         |     |       |          |                |
| r |                         |     |       |          |                |
| a |                         |     |       |          |                |
| l |                         |     |       |          |                |
|   |                         |     |       |          |                |
| R |                         |     |       |          |                |
| e |                         |     |       |          |                |
| q |                         |     |       |          |                |
| u |                         |     |       |          |                |
| i |                         |     |       |          |                |
| r |                         |     |       |          |                |
| e |                         |     |       |          |                |
| m |                         |     |       |          |                |
| e |                         |     |       |          |                |
| n |                         |     |       |          |                |
| t |                         |     |       |          |                |
| s |                         |     |       |          |                |
| * |                         |     |       |          |                |
| * |                         |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 1 | Has a review of the use |     |       |          |                |
| \ | of signatures been      |     |       |          |                |
| . | carried out against     |     |       |          |                |
|   | each record maintained  |     |       |          |                |
|   | by the system?          |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 2 | Is the system fully     |     |       |          |                |
| \ | documented including    |     |       |          |                |
| . | HW/SW controls,         |     |       |          |                |
|   | lifecycle development   |     |       |          |                |
|   | documentation and       |     |       |          |                |
|   | operational procedures  |     |       |          |                |
|   | and manuals?            |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 3 | Has an assessment of ER |     |       |          |                |
| \ | maintained by the       |     |       |          |                |
| . | system been made in     |     |       |          |                |
|   | order to identify those |     |       |          |                |
|   | required to be          |     |       |          |                |
|   | submitted to FDA        |     |       |          |                |
|   | electronically vs.      |     |       |          |                |
|   | those required for      |     |       |          |                |
|   | operational use?        |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 4 | For those records to be |     |       |          |                |
| \ | submitted, have they    |     |       |          |                |
| . | been identified in      |     |       |          |                |
|   | Public Docket No 92S-T  |     |       |          |                |
|   | as being a type 0251    |     |       |          |                |
|   | submission which the    |     |       |          |                |
|   | FDA accepts in          |     |       |          |                |
|   | electronic form?        |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 5 | Is the system 'closed'  |     |       |          |                |
| \ | or 'open'?              |     |       |          |                |
| . |                         |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 6 | If closed, has the      |     |       |          |                |
| \ | system been validated   |     |       |          |                |
| . | to ensure accuracy,     |     |       |          |                |
|   | reliability, consistent |     |       |          |                |
|   | intended performance,   |     |       |          |                |
|   | and the ability to      |     |       |          |                |
|   | discern invalid or      |     |       |          |                |
|   | altered records?        |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 7 | Are procedures and/or   |     |       |          |                |
| \ | plans in place to       |     |       |          |                |
| . | manage GXP record       |     |       |          |                |
|   | retention for the       |     |       |          |                |
|   | defined retention       |     |       |          |                |
|   | period?                 |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 8 | Are suitable backup and |     |       |          |                |
| \ | restoration procedures  |     |       |          |                |
| . | in place?               |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 9 | Are disaster recovery   |     |       |          |                |
| \ | procedures in place to  |     |       |          |                |
| . | ensure that ER and      |     |       |          |                |
|   | applications can be     |     |       |          |                |
|   | restored to a known     |     |       |          |                |
|   | point following data    |     |       |          |                |
|   | loss or corruption?     |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 1 | Are security procedures |     |       |          |                |
| 0 | in place in order to    |     |       |          |                |
| \ | ensure that only        |     |       |          |                |
| . | authorized users are    |     |       |          |                |
|   | granted access to the   |     |       |          |                |
|   | system? That users      |     |       |          |                |
|   | leaving the company or  |     |       |          |                |
|   | changing roles are      |     |       |          |                |
|   | de-authorized from      |     |       |          |                |
|   | access the system?      |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 1 | Are records in place to |     |       |          |                |
| 1 | demonstrate that        |     |       |          |                |
| \ | individuals involved in |     |       |          |                |
| . | the development,        |     |       |          |                |
|   | maintenance,            |     |       |          |                |
|   | administration and      |     |       |          |                |
|   | operation of ERES       |     |       |          |                |
|   | systems have the        |     |       |          |                |
|   | education, training and |     |       |          |                |
|   | experience to perform   |     |       |          |                |
|   | their job?              |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 1 | Are written policies in |     |       |          |                |
| 2 | place that hold         |     |       |          |                |
| \ | individuals accountable |     |       |          |                |
| . | and responsible for     |     |       |          |                |
|   | actions initiated under |     |       |          |                |
|   | their ES?               |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 1 | Are procedures in place |     |       |          |                |
| 3 | to control access,      |     |       |          |                |
| \ | maintenance and         |     |       |          |                |
| . | distribution of system  |     |       |          |                |
|   | documentation?          |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 1 | Are change control      |     |       |          |                |
| 4 | procedures in place to  |     |       |          |                |
| \ | manage changes to       |     |       |          |                |
| . | systems and system      |     |       |          |                |
|   | documentation?          |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 1 | Are procedures in place |     |       |          |                |
| 5 | to ensure uniqueness of |     |       |          |                |
| \ | ES and that they are    |     |       |          |                |
| . | not re-used or          |     |       |          |                |
|   | re-allocated?           |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 1 | Do system access        |     |       |          |                |
| 6 | authorization           |     |       |          |                |
| \ | procedures include      |     |       |          |                |
| . | verification of the     |     |       |          |                |
|   | identify of personnel   |     |       |          |                |
|   | before granting access? |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 1 | Are records in place to |     |       |          |                |
| 7 | demonstrate that        |     |       |          |                |
| \ | individuals associated  |     |       |          |                |
| . | with the use, operation |     |       |          |                |
|   | and administration of   |     |       |          |                |
|   | the system understand   |     |       |          |                |
|   | and accept that use of  |     |       |          |                |
|   | a specific electronic   |     |       |          |                |
|   | signature is the        |     |       |          |                |
|   | legally binding         |     |       |          |                |
|   | equivalent of the       |     |       |          |                |
|   | signers' hand-written   |     |       |          |                |
|   | signature?              |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 1 | Are policies in place   |     |       |          |                |
| 8 | to ensure personnel do  |     |       |          |                |
| \ | not disclose their ES?  |     |       |          |                |
| . |                         |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 1 | Are procedures in place |     |       |          |                |
| 9 | to periodically review  |     |       |          |                |
| \ | user accounts in order  |     |       |          |                |
| . | to determine that       |     |       |          |                |
|   | access authorizations   |     |       |          |                |
|   | are still appropriate?  |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 2 | Are procedures in place |     |       |          |                |
| 0 | to ensure that user     |     |       |          |                |
| \ | profiles and access     |     |       |          |                |
| . | rights are controlled?  |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 2 | Are procedures in place |     |       |          |                |
| 1 | to ensure that          |     |       |          |                |
| \ | passwords are           |     |       |          |                |
| . | periodically changed?   |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 2 | Are procedures in place |     |       |          |                |
| 2 | to manage the loss of   |     |       |          |                |
| \ | passwords and their     |     |       |          |                |
| . | reissue?                |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 2 | Are procedures in place |     |       |          |                |
| 3 | to distinguish between  |     |       |          |                |
| \ | intended security       |     |       |          |                |
| . | violations and those    |     |       |          |                |
|   | arising from personnel  |     |       |          |                |
|   | forgetting security     |     |       |          |                |
|   | codes? Do these         |     |       |          |                |
|   | procedures address the  |     |       |          |                |
|   | investigation of        |     |       |          |                |
|   | intended security       |     |       |          |                |
|   | violations?             |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 2 | Where security input    |     |       |          |                |
| 4 | devices are utilized,   |     |       |          |                |
| \ | are procedures in place |     |       |          |                |
| . | to periodically test    |     |       |          |                |
|   | the devices or tokens?  |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
|   |                         |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| * |                         |     |       |          |                |
| * |                         |     |       |          |                |
| * |                         |     |       |          |                |
| T |                         |     |       |          |                |
| e |                         |     |       |          |                |
| c |                         |     |       |          |                |
| h |                         |     |       |          |                |
| n |                         |     |       |          |                |
| i |                         |     |       |          |                |
| c |                         |     |       |          |                |
| a |                         |     |       |          |                |
| l |                         |     |       |          |                |
| C |                         |     |       |          |                |
| o |                         |     |       |          |                |
| n |                         |     |       |          |                |
| t |                         |     |       |          |                |
| r |                         |     |       |          |                |
| o |                         |     |       |          |                |
| l |                         |     |       |          |                |
| s |                         |     |       |          |                |
| f |                         |     |       |          |                |
| o |                         |     |       |          |                |
| r |                         |     |       |          |                |
| C |                         |     |       |          |                |
| l |                         |     |       |          |                |
| o |                         |     |       |          |                |
| s |                         |     |       |          |                |
| e |                         |     |       |          |                |
| d |                         |     |       |          |                |
| S |                         |     |       |          |                |
| y |                         |     |       |          |                |
| s |                         |     |       |          |                |
| t |                         |     |       |          |                |
| e |                         |     |       |          |                |
| m |                         |     |       |          |                |
| s |                         |     |       |          |                |
| * |                         |     |       |          |                |
| * |                         |     |       |          |                |
| * |                         |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 2 | Are automated controls  |     |       |          |                |
| 5 | in place to detect      |     |       |          |                |
| \ | unauthorized changes to |     |       |          |                |
| . | electronic records?     |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 2 | Can the system generate |     |       |          |                |
| 6 | both in human readable  |     |       |          |                |
| \ | and electronic form,    |     |       |          |                |
| . | accurate and complete   |     |       |          |                |
|   | copies of records for   |     |       |          |                |
|   | inspection, review and  |     |       |          |                |
|   | copying by regulatory   |     |       |          |                |
|   | agencies?               |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 2 | Where records are       |     |       |          |                |
| 7 | exported, are they      |     |       |          |                |
| \ | secure from             |     |       |          |                |
| . | modification and        |     |       |          |                |
|   | falsification and is    |     |       |          |                |
|   | the system able to      |     |       |          |                |
|   | detect modification to  |     |       |          |                |
|   | records re-imported for |     |       |          |                |
|   | viewing?                |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 2 | Are devices that store  |     |       |          |                |
| 8 | ER (e.g., file/database |     |       |          |                |
| \ | servers and backup and  |     |       |          |                |
| . | archive devices)        |     |       |          |                |
|   | located in controlled   |     |       |          |                |
|   | areas or physically     |     |       |          |                |
|   | secure?                 |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 2 | Are systems used to     |     |       |          |                |
| 9 | store ER installed in   |     |       |          |                |
| \ | environmentally         |     |       |          |                |
| . | controlled areas?       |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 3 | Does the system provide |     |       |          |                |
| 0 | functionality to detect |     |       |          |                |
| \ | or prevent users from   |     |       |          |                |
| . | manipulating,           |     |       |          |                |
|   | overriding or otherwise |     |       |          |                |
|   | invalidating ER,        |     |       |          |                |
|   | application code or the |     |       |          |                |
|   | operating environment   |     |       |          |                |
|   | of the system?          |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 3 | Are file servers and    |     |       |          |                |
| 1 | host computers          |     |       |          |                |
| \ | operating using USP, or |     |       |          |                |
| . | other battery backup    |     |       |          |                |
|   | measures in order to    |     |       |          |                |
|   | facilitate controlled   |     |       |          |                |
|   | system shutdown?        |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 3 | Does the system ensure  |     |       |          |                |
| 2 | that data cannot be     |     |       |          |                |
| \ | recreated after system  |     |       |          |                |
| . | failure such as         |     |       |          |                |
|   | synchronized forward    |     |       |          |                |
|   | data recovery and error |     |       |          |                |
|   | processing for database |     |       |          |                |
|   | applications?           |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 3 | Where ER are replicated |     |       |          |                |
| 3 | in different systems,   |     |       |          |                |
| \ | are measures in place   |     |       |          |                |
| . | to ensure record        |     |       |          |                |
|   | synchronization?        |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 3 | Does the system prevent |     |       |          |                |
| 4 | concurrent update of ER |     |       |          |                |
| \ | by multiple users or    |     |       |          |                |
| . | processes?              |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 3 | Does the system ensure  |     |       |          |                |
| 5 | that for unsuccessful   |     |       |          |                |
| \ | multi-stage updates to  |     |       |          |                |
| . | ER, all fields          |     |       |          |                |
|   | associated with the     |     |       |          |                |
|   | record are restored to  |     |       |          |                |
|   | their original state?   |     |       |          |                |
|   | (e.g. rollback)         |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 3 | Do back-up functions    |     |       |          |                |
| 6 | maintain                |     |       |          |                |
| \ | synchronization between |     |       |          |                |
| . | ER distributed across   |     |       |          |                |
|   | different systems?      |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 3 | Are security controls   |     |       |          |                |
| 7 | provided to restrict    |     |       |          |                |
| \ | access to components of |     |       |          |                |
| . | the application, such   |     |       |          |                |
|   | as screens and reports, |     |       |          |                |
|   | or data and functions   |     |       |          |                |
|   | such as read, update or |     |       |          |                |
|   | deleted by user or user |     |       |          |                |
|   | group?                  |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 3 | Does the system provide |     |       |          |                |
| 8 | security measures to    |     |       |          |                |
| \ | control remote access   |     |       |          |                |
| . | to a closed system?     |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 3 | Are remote access       |     |       |          |                |
| 9 | sessions automatically  |     |       |          |                |
| \ | logged-off when the     |     |       |          |                |
| . | session is terminated?  |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 4 | Does the system enable  |     |       |          |                |
| 0 | user access rights to   |     |       |          |                |
| \ | be displayed or printed |     |       |          |                |
| . | including User ID and   |     |       |          |                |
|   | all of their access     |     |       |          |                |
|   | permissions? (e.g.,     |     |       |          |                |
|   | file access, grants,    |     |       |          |                |
|   | permissions etc.)       |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 4 | Is access to ER by      |     |       |          |                |
| 1 | ordinary means          |     |       |          |                |
| \ | prevented other than    |     |       |          |                |
| . | via the validated user  |     |       |          |                |
|   | interface?              |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 4 | Does the system         |     |       |          |                |
| 2 | generate audit trail    |     |       |          |                |
| \ | records for all create, |     |       |          |                |
| . | modification and        |     |       |          |                |
|   | deletion operations and |     |       |          |                |
|   | contain: record         |     |       |          |                |
|   | reference; modification |     |       |          |                |
|   | date and time; old      |     |       |          |                |
|   | data; new data; User    |     |       |          |                |
|   | ID?                     |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 4 | Are system users        |     |       |          |                |
| 3 | prevented from          |     |       |          |                |
| \ | modifying the system    |     |       |          |                |
| . | clock?                  |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 4 | Are audit trails secure |     |       |          |                |
| 4 | from modification       |     |       |          |                |
| \ | either by means of      |     |       |          |                |
| . | tools provided by the   |     |       |          |                |
|   | application or by other |     |       |          |                |
|   | applications such as    |     |       |          |                |
|   | SQL, database packages, |     |       |          |                |
|   | text editors, etc?      |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 4 | Is the audit trail      |     |       |          |                |
| 5 | documentation retained  |     |       |          |                |
| \ | with the associated ER  |     |       |          |                |
| . | for a period at least   |     |       |          |                |
|   | as long as that         |     |       |          |                |
|   | required for the ER and |     |       |          |                |
|   | is the audit trail      |     |       |          |                |
|   | available for agency    |     |       |          |                |
|   | review and copying?     |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 4 | Is previously recorded  |     |       |          |                |
| 6 | information still       |     |       |          |                |
| \ | available for review    |     |       |          |                |
| . | following modification  |     |       |          |                |
|   | and is such information |     |       |          |                |
|   | identified in the audit |     |       |          |                |
|   | trail?                  |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 4 | Are operator entries    |     |       |          |                |
| 7 | traceable to a User ID  |     |       |          |                |
| \ | that can be uniquely    |     |       |          |                |
| . | linked to its owner?    |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 4 | Are critical operator   |     |       |          |                |
| 8 | actions (e.g., create,  |     |       |          |                |
| \ | insert, delete, modify) |     |       |          |                |
| . | identified in, or       |     |       |          |                |
|   | deducted from the audit |     |       |          |                |
|   | trail?                  |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 4 | Is there a display or   |     |       |          |                |
| 9 | report available for    |     |       |          |                |
| \ | viewing the audit       |     |       |          |                |
| . | trail?                  |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 5 | Is it possible to       |     |       |          |                |
| 0 | export audit trail      |     |       |          |                |
| \ | information securely,   |     |       |          |                |
| . | without risk of         |     |       |          |                |
|   | modification or         |     |       |          |                |
|   | falsification?          |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 5 | When audit trail        |     |       |          |                |
| 1 | records are exported    |     |       |          |                |
| \ | for backup, archive or  |     |       |          |                |
| . | other means, does the   |     |       |          |                |
|   | system record the       |     |       |          |                |
|   | data/time of export,    |     |       |          |                |
|   | User ID, number of      |     |       |          |                |
|   | records exported?       |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 5 | Are all authorizations, |     |       |          |                |
| 2 | approvals and other     |     |       |          |                |
| \ | critical operations     |     |       |          |                |
| . | recorded in the audit   |     |       |          |                |
|   | trail?                  |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 5 | Does the system utilize |     |       |          |                |
| 3 | logical checks to       |     |       |          |                |
| \ | enforce sequencing of   |     |       |          |                |
| . | steps and events, as    |     |       |          |                |
|   | appropriate?            |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 5 | Do user sessions        |     |       |          |                |
| 4 | automatically log-off   |     |       |          |                |
| \ | when a session          |     |       |          |                |
| . | disconnect is detected? |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 5 | Does the system utilize |     |       |          |                |
| 5 | device checks (e.g.,    |     |       |          |                |
| \ | terminal) to determine, |     |       |          |                |
| . | as appropriate, the     |     |       |          |                |
|   | validity of the source  |     |       |          |                |
|   | data input or           |     |       |          |                |
|   | operational             |     |       |          |                |
|   | instructions? (this     |     |       |          |                |
|   | applies to systems      |     |       |          |                |
|   | requiring additional    |     |       |          |                |
|   | access control to       |     |       |          |                |
|   | ensure data was entered |     |       |          |                |
|   | from a specific device) |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| * |                         |     |       |          |                |
| * |                         |     |       |          |                |
| * |                         |     |       |          |                |
| T |                         |     |       |          |                |
| e |                         |     |       |          |                |
| c |                         |     |       |          |                |
| h |                         |     |       |          |                |
| n |                         |     |       |          |                |
| i |                         |     |       |          |                |
| c |                         |     |       |          |                |
| a |                         |     |       |          |                |
| l |                         |     |       |          |                |
| C |                         |     |       |          |                |
| o |                         |     |       |          |                |
| n |                         |     |       |          |                |
| t |                         |     |       |          |                |
| r |                         |     |       |          |                |
| o |                         |     |       |          |                |
| l |                         |     |       |          |                |
| s |                         |     |       |          |                |
| f |                         |     |       |          |                |
| o |                         |     |       |          |                |
| r |                         |     |       |          |                |
| O |                         |     |       |          |                |
| p |                         |     |       |          |                |
| e |                         |     |       |          |                |
| n |                         |     |       |          |                |
| S |                         |     |       |          |                |
| y |                         |     |       |          |                |
| s |                         |     |       |          |                |
| t |                         |     |       |          |                |
| e |                         |     |       |          |                |
| m |                         |     |       |          |                |
| s |                         |     |       |          |                |
| * |                         |     |       |          |                |
| * |                         |     |       |          |                |
| * |                         |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 5 | Does the system provide |     |       |          |                |
| 6 | controls, including     |     |       |          |                |
| \ | challenges noted in     |     |       |          |                |
| . | items 25-55 above, to   |     |       |          |                |
|   | ensure the              |     |       |          |                |
|   | authenticity, integrity |     |       |          |                |
|   | and as appropriate, the |     |       |          |                |
|   | confidentiality of ER   |     |       |          |                |
|   | from the point of their |     |       |          |                |
|   | creation to the point   |     |       |          |                |
|   | of their receipt? (such |     |       |          |                |
|   | controls may include    |     |       |          |                |
|   | document encryption and |     |       |          |                |
|   | use of appropriate      |     |       |          |                |
|   | digital signature       |     |       |          |                |
|   | standards to ensure     |     |       |          |                |
|   | record authenticity,    |     |       |          |                |
|   | integrity and           |     |       |          |                |
|   | confidentiality.        |     |       |          |                |
|   | Example of encryption   |     |       |          |                |
|   | standards are RSA,      |     |       |          |                |
|   | NIST's DDS)             |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| * |                         |     |       |          |                |
| * |                         |     |       |          |                |
| * |                         |     |       |          |                |
| S |                         |     |       |          |                |
| i |                         |     |       |          |                |
| g |                         |     |       |          |                |
| n |                         |     |       |          |                |
| a |                         |     |       |          |                |
| t |                         |     |       |          |                |
| u |                         |     |       |          |                |
| r |                         |     |       |          |                |
| e |                         |     |       |          |                |
| M |                         |     |       |          |                |
| a |                         |     |       |          |                |
| n |                         |     |       |          |                |
| i |                         |     |       |          |                |
| f |                         |     |       |          |                |
| e |                         |     |       |          |                |
| s |                         |     |       |          |                |
| t |                         |     |       |          |                |
| a |                         |     |       |          |                |
| t |                         |     |       |          |                |
| i |                         |     |       |          |                |
| o |                         |     |       |          |                |
| n |                         |     |       |          |                |
| s |                         |     |       |          |                |
| * |                         |     |       |          |                |
| * |                         |     |       |          |                |
| * |                         |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 5 | Does the system include |     |       |          |                |
| 7 | as part of any human    |     |       |          |                |
| \ | readable form of signed |     |       |          |                |
| . | electronic records:     |     |       |          |                |
|   | printed name of the     |     |       |          |                |
|   | signer; data/time of    |     |       |          |                |
|   | when signature was      |     |       |          |                |
|   | executed; meaning       |     |       |          |                |
|   | associated with the     |     |       |          |                |
|   | signature               |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| * |                         |     |       |          |                |
| * |                         |     |       |          |                |
| * |                         |     |       |          |                |
| S |                         |     |       |          |                |
| i |                         |     |       |          |                |
| g |                         |     |       |          |                |
| n |                         |     |       |          |                |
| a |                         |     |       |          |                |
| t |                         |     |       |          |                |
| u |                         |     |       |          |                |
| r |                         |     |       |          |                |
| e |                         |     |       |          |                |
| / |                         |     |       |          |                |
| R |                         |     |       |          |                |
| e |                         |     |       |          |                |
| c |                         |     |       |          |                |
| o |                         |     |       |          |                |
| r |                         |     |       |          |                |
| d |                         |     |       |          |                |
| L |                         |     |       |          |                |
| i |                         |     |       |          |                |
| n |                         |     |       |          |                |
| k |                         |     |       |          |                |
| i |                         |     |       |          |                |
| n |                         |     |       |          |                |
| g |                         |     |       |          |                |
| * |                         |     |       |          |                |
| * |                         |     |       |          |                |
| * |                         |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 6 | Are ES and hand-written |     |       |          |                |
| 8 | signatures linked to    |     |       |          |                |
| \ | their respective ERs so |     |       |          |                |
| . | that the signature      |     |       |          |                |
|   | cannot be repudiated,   |     |       |          |                |
|   | excised, copied or      |     |       |          |                |
|   | otherwise transferred   |     |       |          |                |
|   | to falsify an ER by     |     |       |          |                |
|   | ordinary means?         |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 6 | Are electronic or       |     |       |          |                |
| 9 | hand-written signatures |     |       |          |                |
| \ | applied and linked when |     |       |          |                |
| . | charges are made to     |     |       |          |                |
|   | previously              |     |       |          |                |
|   | authorized/approved ER? |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 7 | Do hybrid systems have  |     |       |          |                |
| 0 | robust procedures to    |     |       |          |                |
| \ | ensure ERs are          |     |       |          |                |
| . | synchronized with       |     |       |          |                |
|   | approved paper records? |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 7 | Does the system ensure  |     |       |          |                |
| 1 | that a signature of     |     |       |          |                |
| \ | another person cannot   |     |       |          |                |
| . | replace previously      |     |       |          |                |
|   | executed ES, even if    |     |       |          |                |
|   | that person is a        |     |       |          |                |
|   | supervisor or manager?  |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| * |                         |     |       |          |                |
| * |                         |     |       |          |                |
| * |                         |     |       |          |                |
| G |                         |     |       |          |                |
| e |                         |     |       |          |                |
| n |                         |     |       |          |                |
| e |                         |     |       |          |                |
| r |                         |     |       |          |                |
| a |                         |     |       |          |                |
| l |                         |     |       |          |                |
| R |                         |     |       |          |                |
| e |                         |     |       |          |                |
| q |                         |     |       |          |                |
| u |                         |     |       |          |                |
| i |                         |     |       |          |                |
| r |                         |     |       |          |                |
| e |                         |     |       |          |                |
| m |                         |     |       |          |                |
| e |                         |     |       |          |                |
| n |                         |     |       |          |                |
| t |                         |     |       |          |                |
| s |                         |     |       |          |                |
| f |                         |     |       |          |                |
| o |                         |     |       |          |                |
| r |                         |     |       |          |                |
| E |                         |     |       |          |                |
| l |                         |     |       |          |                |
| e |                         |     |       |          |                |
| c |                         |     |       |          |                |
| t |                         |     |       |          |                |
| r |                         |     |       |          |                |
| o |                         |     |       |          |                |
| n |                         |     |       |          |                |
| i |                         |     |       |          |                |
| c |                         |     |       |          |                |
| R |                         |     |       |          |                |
| e |                         |     |       |          |                |
| c |                         |     |       |          |                |
| o |                         |     |       |          |                |
| r |                         |     |       |          |                |
| d |                         |     |       |          |                |
| s |                         |     |       |          |                |
| * |                         |     |       |          |                |
| * |                         |     |       |          |                |
| * |                         |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 7 | Are electronic          |     |       |          |                |
| 2 | signatures unique to    |     |       |          |                |
| \ | one individual?         |     |       |          |                |
| . |                         |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 7 | Are measures in place   |     |       |          |                |
| 3 | to prevent reuse and    |     |       |          |                |
| \ | reassignment of ES?     |     |       |          |                |
| . |                         |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| * |                         |     |       |          |                |
| * |                         |     |       |          |                |
| * |                         |     |       |          |                |
| E |                         |     |       |          |                |
| l |                         |     |       |          |                |
| e |                         |     |       |          |                |
| c |                         |     |       |          |                |
| t |                         |     |       |          |                |
| r |                         |     |       |          |                |
| o |                         |     |       |          |                |
| n |                         |     |       |          |                |
| i |                         |     |       |          |                |
| c |                         |     |       |          |                |
| S |                         |     |       |          |                |
| i |                         |     |       |          |                |
| g |                         |     |       |          |                |
| n |                         |     |       |          |                |
| a |                         |     |       |          |                |
| t |                         |     |       |          |                |
| u |                         |     |       |          |                |
| r |                         |     |       |          |                |
| e |                         |     |       |          |                |
| C |                         |     |       |          |                |
| o |                         |     |       |          |                |
| m |                         |     |       |          |                |
| p |                         |     |       |          |                |
| o |                         |     |       |          |                |
| n |                         |     |       |          |                |
| e |                         |     |       |          |                |
| n |                         |     |       |          |                |
| t |                         |     |       |          |                |
| s |                         |     |       |          |                |
| a |                         |     |       |          |                |
| n |                         |     |       |          |                |
| d |                         |     |       |          |                |
| C |                         |     |       |          |                |
| o |                         |     |       |          |                |
| n |                         |     |       |          |                |
| t |                         |     |       |          |                |
| r |                         |     |       |          |                |
| o |                         |     |       |          |                |
| l |                         |     |       |          |                |
| * |                         |     |       |          |                |
| * |                         |     |       |          |                |
| * |                         |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 7 | Do ES contain at least  |     |       |          |                |
| 4 | two distinct ID         |     |       |          |                |
| \ | components, such as an  |     |       |          |                |
| . | ID code and password,   |     |       |          |                |
|   | and is at least one     |     |       |          |                |
|   | component confidential  |     |       |          |                |
|   | to the owner?           |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 7 | Does the system ensure  |     |       |          |                |
| 5 | that when an individual |     |       |          |                |
| \ | executes a series of    |     |       |          |                |
| . | signings during a       |     |       |          |                |
|   | single, continuous      |     |       |          |                |
|   | period of controlled    |     |       |          |                |
|   | system access, the      |     |       |          |                |
|   | first signing is        |     |       |          |                |
|   | executed using all ES   |     |       |          |                |
|   | components? (subsequent |     |       |          |                |
|   | signings can be         |     |       |          |                |
|   | executed by one ES      |     |       |          |                |
|   | components that is only |     |       |          |                |
|   | executable by and       |     |       |          |                |
|   | designed to be used     |     |       |          |                |
|   | only by the individual) |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 7 | When an individual      |     |       |          |                |
| 6 | executes one or more    |     |       |          |                |
| \ | signings not performed  |     |       |          |                |
| . | during a single,        |     |       |          |                |
|   | continuous period of    |     |       |          |                |
|   | controlled system       |     |       |          |                |
|   | access, does the system |     |       |          |                |
|   | ensure that each        |     |       |          |                |
|   | signing is executed     |     |       |          |                |
|   | using all of the ES     |     |       |          |                |
|   | components?             |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 7 | Is the ES system        |     |       |          |                |
| 7 | designed to ensure that |     |       |          |                |
| \ | attempted use of an     |     |       |          |                |
| . | individual's ES by      |     |       |          |                |
|   | anyone other than its   |     |       |          |                |
|   | genuine owner requires  |     |       |          |                |
|   | collaboration of two or |     |       |          |                |
|   | more individuals?       |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 7 | Does the system prevent |     |       |          |                |
| 8 | access to ES            |     |       |          |                |
| \ | information by ordinary |     |       |          |                |
| . | means?                  |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 7 | Are ES based upon       |     |       |          |                |
| 9 | biometrics designed to  |     |       |          |                |
| \ | ensure that they cannot |     |       |          |                |
| . | be used by anyone other |     |       |          |                |
|   | than their genuine      |     |       |          |                |
|   | owner?                  |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| * |                         |     |       |          |                |
| * |                         |     |       |          |                |
| * |                         |     |       |          |                |
| C |                         |     |       |          |                |
| o |                         |     |       |          |                |
| n |                         |     |       |          |                |
| t |                         |     |       |          |                |
| r |                         |     |       |          |                |
| o |                         |     |       |          |                |
| l |                         |     |       |          |                |
| s |                         |     |       |          |                |
| f |                         |     |       |          |                |
| o |                         |     |       |          |                |
| r |                         |     |       |          |                |
| I |                         |     |       |          |                |
| d |                         |     |       |          |                |
| e |                         |     |       |          |                |
| n |                         |     |       |          |                |
| t |                         |     |       |          |                |
| i |                         |     |       |          |                |
| f |                         |     |       |          |                |
| i |                         |     |       |          |                |
| c |                         |     |       |          |                |
| a |                         |     |       |          |                |
| t |                         |     |       |          |                |
| i |                         |     |       |          |                |
| o |                         |     |       |          |                |
| n |                         |     |       |          |                |
| o |                         |     |       |          |                |
| f |                         |     |       |          |                |
| C |                         |     |       |          |                |
| o |                         |     |       |          |                |
| d |                         |     |       |          |                |
| e |                         |     |       |          |                |
| s |                         |     |       |          |                |
| / |                         |     |       |          |                |
| P |                         |     |       |          |                |
| a |                         |     |       |          |                |
| s |                         |     |       |          |                |
| s |                         |     |       |          |                |
| w |                         |     |       |          |                |
| o |                         |     |       |          |                |
| r |                         |     |       |          |                |
| d |                         |     |       |          |                |
| s |                         |     |       |          |                |
| * |                         |     |       |          |                |
| * |                         |     |       |          |                |
| * |                         |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 8 | Does the system ensure  |     |       |          |                |
| 0 | that identification     |     |       |          |                |
| \ | codes are unique and    |     |       |          |                |
| . | allow for personnel who |     |       |          |                |
|   | may have the same name? |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 8 | Do the system(s) force  |     |       |          |                |
| 1 | users to periodically   |     |       |          |                |
| \ | change their password?  |     |       |          |                |
| . |                         |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 8 | Does the system provide |     |       |          |                |
| 2 | controls that prevent   |     |       |          |                |
| \ | re-use of recently used |     |       |          |                |
| . | passwords?              |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 8 | Do passwords contain a  |     |       |          |                |
| 3 | minimal number of       |     |       |          |                |
| \ | characters to prevent   |     |       |          |                |
| . | easy determination by   |     |       |          |                |
|   | unauthorized users      |     |       |          |                |
|   | (e.g., \>6 characters)  |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 8 | Does the system verify  |     |       |          |                |
| 4 | password lengths and    |     |       |          |                |
| \ | formats at the time of  |     |       |          |                |
| . | creation by users?      |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 8 | Are stored passwords    |     |       |          |                |
| 5 | prevented from access   |     |       |          |                |
| \ | by ordinary means?      |     |       |          |                |
| . | (e.g., password file    |     |       |          |                |
|   | encryption)             |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 8 | Are passwords obscured  |     |       |          |                |
| 6 | when entered?           |     |       |          |                |
| \ |                         |     |       |          |                |
| . |                         |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 8 | Are loss management     |     |       |          |                |
| 7 | procedures in place to  |     |       |          |                |
| \ | electronically          |     |       |          |                |
| . | de-authorize lost,      |     |       |          |                |
|   | stolen, missing or      |     |       |          |                |
|   | otherwise potentially   |     |       |          |                |
|   | compromised tokens,     |     |       |          |                |
|   | cards, and other        |     |       |          |                |
|   | devices that fear or    |     |       |          |                |
|   | generate identification |     |       |          |                |
|   | code or password        |     |       |          |                |
|   | information?            |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 8 | Does the system detect  |     |       |          |                |
| 8 | and report any attempts |     |       |          |                |
| \ | at unauthorized use of  |     |       |          |                |
| . | User IDs to the system  |     |       |          |                |
|   | security unit and, as   |     |       |          |                |
|   | appropriate,            |     |       |          |                |
|   | organizational          |     |       |          |                |
|   | management?             |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 8 | Does the ES system      |     |       |          |                |
| 6 | provide a record of all |     |       |          |                |
| \ | security violations     |     |       |          |                |
| . | that include: User ID   |     |       |          |                |
|   | who created the         |     |       |          |                |
|   | violation; date/time of |     |       |          |                |
|   | the violation; nature   |     |       |          |                |
|   | of the violation?       |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 8 | Does the system suspend |     |       |          |                |
| 7 | user access after       |     |       |          |                |
| \ | multiple unsuccessful   |     |       |          |                |
| . | consecutive attempts to |     |       |          |                |
|   | enter a password until  |     |       |          |                |
|   | either: the security    |     |       |          |                |
|   | administrator resets    |     |       |          |                |
|   | the password; the       |     |       |          |                |
|   | system lock-out period  |     |       |          |                |
|   | expires?                |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+
| 8 | Are devices such as     |     |       |          |                |
| 8 | tokens or cards that    |     |       |          |                |
| \ | veer or generate        |     |       |          |                |
| . | identification code or  |     |       |          |                |
|   | password information    |     |       |          |                |
|   | periodically tested to  |     |       |          |                |
|   | ensure that they        |     |       |          |                |
|   | function properly and   |     |       |          |                |
|   | have not been altered   |     |       |          |                |
|   | in an unauthorized      |     |       |          |                |
|   | manner?                 |     |       |          |                |
+---+-------------------------+-----+-------+----------+----------------+