Madhya Pradesh Agency for Promotion of Information Technology

(A CERT-In Empanelled organisation of Govt. M.P Under Dept. of Science & Technology)

B.3.2Auditee Organization Responsibilities: Organization Responsibilities: Besides the conditions that get specified in the contract, the following form part of auditee obligations: B.3.2.1 B.3.2.2 Auditee refrains from carrying out any unusual or major network changes during auditing/testing. B.3.2.2 To prevent temporary raise in security only for the duration of the test, the auditee notifies only key people about the auditing/testing. It is the auditee's judgment, which discerns whothe key people are; however, it is assumed that they will be people at policy making level, managers of security processesincident response, and security operations. B.3.2.3 If necessary for privileged testing, the auditee must only provide temporary access tokens, login credentials, certificates, secure ID numbers etc. and ensure that privilege is removed after the audit. B.3.2.4 A Technical team should be assigned as point of contact by the auditee organization for assisting and monitoring the auditors during the audit and the details of the technical team should be shared with the concerned auditors. Auditee should assure and schedule regular interaction of technical team with auditors. B.3.2.5 A Formal Confidentiality & Non-disclosure agreement must be signed with the auditor before starting of the work. B.3.2.6 There should be a well defined escalation matrix both for the auditee and auditing organization for addressing any problem encountered during the audit process which should be shared with respective authorities. B.3.2.7 Awell defined mechanism must be in place which clearly states the procedure in which the report would be stored and destroyed after the completion of audit by the auditing organization. Thus, the mechanism should be designed in such a way that it confirms the following:

- • handling of report at transit. • handling of report at transit.
- • handling of report at rest. • handling of report at rest.
- • time of report and related information by auditor. • time of report and related information by auditor.
- C.AUDITEE EXPECTATIONS

The following are the expectations of auditee organization from an auditor: C.1 C.2 Verifying possible vulnerable services only with explicit written permission from the auditee. C.2 Auditors must verify the existing policies of the organization against the industry standards and best practices and suggest the necessary improvements if required. C.3 Refrain from security testing of obviously highly insecure and unstable systems, locations, and processes until the security has been put in place. C.4 A formal Confidentiality & Non-disclosure agreement should be signed by the IT Security auditing organization prior to commencing the cyber security auditing work. The auditing organization and its auditors are ethically bound to maintain confidentiality, non-disclosure of auditee information, and security testing results. C.5 The security auditor always assumes a limited amount of liability as per responsibility. Acceptable limited liability could be equal to the cost of service (this includes both malicious and non-malicious errors and project mismanagement). C.6 C.7 Clarity in explaining the limits and dangers of the security test. C.7 In the case of remote testing, the origin of the testers by telephone numbers and/or IP addresses is made known and a formal written permission with a clear definition of the tasks to be performed should be taken. C.8 Seeking specific permissions for tests involving survivability failures, denial of service, process testing, or social engineering. C.9 The scope is clearly defined contractually before verifying vulnerable services. C.10 C.11 C.12 The scope clearly explains the limits of the security test. C.11 The test plan includes both calendar time and man-hours. C.12 The test plan includes hours of testing.

State IT Center, 47-A, Arera Hills, Bhopal -462011, Tel: +91-755-2518702

Website: www.mapit.gov.in|| Email: info@mapit.gov.in