The security manager signs off on all new systems and processes or major changes to systems and processes. Re-certification of security and internal controls is obtained for service providers on a routine cycle. Interview selected project managers and the security officer. Review functional and operational security requirements for selected projects. Interview the change control manager.
Review reports certifying the security of selected new systems and processes.
Review test plans and scripts to ascertain whether security measures where tested. Interview the UAT analyst. Review signoff of selected new systems and processes. Obtain copies of reports certifying the security of operations for service providers. Control Activity A company-wide security program is documented, approved and maintained.