Spreadsheet: 702909d1604602040-return-multiple-rows-should-i-be-using-vlookup-sample
Sheet: Master Matrix

Control  Objectives | Control | Inspection | Observation | Results | PBC | PBC Due Date | Responsible Party | Status | Notes
Access to Programs and Data
A4 | Users connecting to CLIENT's internal WLAN must authenticate to Active Directory prior to obtaining access. |  |  |  | CLIENT to provide screenshots of the  internal wireless configuration to show the authentication is configured for Active Directory. |  |  | Accepted
A5 | Remote access is provided via VPN requiring Active Directory Authentication. |  |  |  | CLIENT to provide screenshots of CLIENT’s VPN configuration to show the authentication is configured for Active Directory. |  |  | Accepted
A7 | Access to Epicor, which implements an independent authentication, may only be obtained after connecting to CLIENT's internal network. |  |  |  | CLIENT to provide screenshots of Epicor configuration to show the authentication is configured for local authentication. |  |  | Outstanding
A8 | AD password parameters are configured to require a password to be a minimum of 6 characters, 3 passwords of history, a minimum of 90 days until expiration, 30 min for lockout after 6 failed attempts, and complexity is enabled. |  |  |  | CLIENT to provide screenshots showing AD password parameters. |  |  | Outstanding
A9 | Access Grants to Epicor, AST, Shareworks, ADP, HOST, the Finance Drives, BoardEffects and ActiveDisclosure including admin rights are approved prior to grant. Grants are also reviewed semi-annually. |  |  |  | CLIENT to provide a list of all new and change of access tickets for the test period. |  |  | Outstanding
A9 |  |  |  |  | Staff to provide a random selection of new and change of access tickets for the test period. |  |  | Outstanding
A9 |  |  |  |  | CLIENT to provide tickets for the test period. |  |  | Outstanding
A10 | Only authorized IT staff are provided unique [NAME] and passwords. These grants are reviewed semi-annually and confirmed by the Director of IT and the Security Administrator. |  |  |  | CLIENT to provide list of all members of the Windows Administrator group on the Epicor server. |  |  | Outstanding
A11 | Only authorized IT staff are provided SQL Server and SQL DB admin right. These grants are reviewed semi-annually and confirmed by the Director of IT and the Security Administrator. Note: Users with SQL query rights can query but can't write to the DB's. |  |  |  | CLIENT to provide list of all users with Epicor SQL DB admin accounts. |  |  | Outstanding
A14 | CLIENT disables the default [NAME] GUEST account. |  |  |  | CLIENT to provide screenshot of the default Guest account in Active Directory. |  |  | Outstanding
A28 | Epicor default EPICOR, MANAGER, and PRINT user account passwords have been changed. |  |  |  | Staff to observe that the default EPICOR, MANAGER, and PRINT user account passwords have been changed. |  |  | Outstanding
A17 | Default Active Directory Administrator account has been renamed. |  |  |  | CLIENT to provide a screenshot showing that the default administrator account has been renamed. |  |  | Outstanding
A15 | Only authorized IT staff are provided Active Directory Administrative rights. These grants are reviewed semi-annually and confirmed by the Director of IT and the Security Administrator. |  |  |  | CLIENT to provide screenshot of the default Administrator account in Active Directory (should show the SID). |  |  | Outstanding
A15 |  |  |  |  | CLIENT to provide listing of all Active Directory privileged groups and account members. |  |  | Outstanding
A16 | Firewalls with Intrusion Prevention have been deployed at the perimeter of CLIENT's internal network. Security Administrator reviews console and determines what to update. |  |  |  | CLIENT to provide the logical network diagram showing networks. |  |  | Outstanding
A16 |  |  |  |  | CLIENT to provide screenshot showing interfaces on the firewall. |  |  | Outstanding
A16 |  |  |  |  | CLIENT to provide screenshot showing the routing table on the firewall. |  |  | Outstanding
A29 | Human Resources initiates requests for all new employee network access grants and terminated employees network access grant terminations. |  |  |  | CLIENT to provide a listing of all new employees during the test period. |  |  | Outstanding
A19 | Account passwords are changed and/or accounts are disabled, within two business days of requested termination date. Extensions are approved by the hiring manager with explanations given. |  |  |  | CLIENT to provide a listing of all terminated employees during the test period. |  |  | Outstanding
A21 | Upon completion of access change for all new employee hires, terminations, or position changes, Human Resources is automatically notified by email when IT closes the ticket. |  |  |  | CLIENT to provide a listing of all position changes during the test period. |  |  | Outstanding
A22 | CLIENT conducts semi-annual reviews for appropriate access to [NAME].  Reviews of accounts, roles, and groups are conducted with managers and data owners for appropriate access and segregation of duties. |  |  |  | CLIENT to provide documentation of semi-annual review for appropriate access to [NAME]. |  |  | Outstanding
A27 | Epicor is configured to require a password to have a minimum of 6 characters, complexity enabled, and a lockout after 6 failed attempts. |  |  |  | CLIENT to provide screenshots showing Epicor password parameters. |  |  | Outstanding
Program Changes
PC2 | IT Steering Committee members consist of IT and business management who review and approve major changes within the organization. |  |  |  | CLIENT to provide |  |  | Outstanding
PC2 |  |  |  |  | Staff to select |  |  | Outstanding
PC2 |  |  |  |  | CLIENT to provide |  |  | Outstanding
PC3 | Changes to Epicor and Host and Shareworks are made in accordance with the Change Control Procedure (evidencing [NAME]'s SDLC), which includes but is not limited to the following. a) the change is approved to be made, b)change is made in development, c) change is tested and approved fro production, d) change is tested in production and confirmed to close ticket. |  |  |  | CLIENT to provide a list of all changes to Epicor, Host, and Shareworks during the test period. |  |  | Outstanding
PC3 |  |  |  |  | CLIENT to provide a copy of the Change Control Procedure. |  |  | Outstanding
Computer Operations
CO2 | Changes to jobs will follow the change management process above. 9/1/2020 |  |  |  | CLIENT to provide a list of all Epicor job changes during the test period. |  |  | Outstanding
CO2 |  |  |  |  | Staff to provide a random selection of Epicor job changes. |  |  | Outstanding
CO2 |  |  |  |  | CLIENT to provide documentation of Epicor job changes. |  |  | Outstanding
CO3 | Notifications of scheduled job failures in the production environment are sent to IT for timely resolution. |  |  |  | CLIENT to provide screenshots showing job failure notification configuration. |  |  | Outstanding
CO4 | Access capabilities to request updates, modifications and deletions to job schedules in the job scheduling system is limited to IT Personnel with job scheduling responsibilities and is segregated from the development function. These access grants are reviewed semi-annually. |  |  |  | CLIENT to provide a list of all administrator access to jobs in Epicor. |  |  | Outstanding
CO5 | IT Management has documented back-up requirements defining back-up sets, recovery requirements, and data retention periods. |  |  |  | CLIENT to provide a copy of the backup requirements. |  |  | Outstanding
CO5 |  |  |  |  | Staff to provide a random selection of dates. |  |  | Outstanding
CO5 |  |  |  |  | CLIENT to provide evidence of backups in accordance with documented back-up requirements. |  |  | Outstanding
CO6 | Epicor SQL is configured to automatically create a support ticket for failed jobs. |  |  |  | CLIENT to provide screenshots showing the Epicor SQL configuration for failed job notifications. |  |  | Outstanding
CO6 |  |  |  |  | CLIENT to provide a list of failed jobs for the test period. |  |  | Outstanding
CO6 |  |  |  |  | Staff to  provide a random selection of failed jobs. |  |  | Outstanding
CO6 |  |  |  |  | CLIENT to provide support tickets for random selection of failed jobs. |  |  | Outstanding
CO7 | Backup media and data is stored at a secure location that is physically located in a different state. |  |  |  | Staff to observe that  that backups are physically located in a different state. |  |  | Outstanding
CO9 | CLIENT uses Epicor's most recent backup to refresh the development and test databases.  Done not less than semi-annually. |  |  |  | Vaoptherm to provide listing of all Epicor development and test restores. |  |  | Outstanding
CO10 | IT has documented backup schedule requirements for all production environments.  Service agreements with the hosting provider include the notification and resolution of backup failures. |  |  |  | CLIENT to provide a copy of the service agreements with hosting provider(s). |  |  | Outstanding
CO10 |  |  |  |  | See CO5.1 |  |  | Outstanding
CO11 | Physical and logical access to the offsite data center is restricted to only authorized CLIENT IT personnel. The listing of approved individuals is reviewed semi-annually. |  |  |  | CLIENT to provide a listing of all users with physical access to offsite data center. |  |  | Outstanding
CO11 |  |  |  |  | CLIENT to provide a listing of all users with logical access to offsite data center. |  |  | Outstanding
CO13 | The production environment is monitored to identify system/application related incidents, problems and errors and critical issues are ticketed. |  |  |  | CLIENT to provide evidence showing the production environment is monitored. |  |  | Outstanding
CO13 |  |  |  |  | CLIENT to provide a screenshots showing the configuration for alerts for the production monitoring system. |  |  | Outstanding
CO13 |  |  |  |  | CLIENT to provide a listing of all production environment alert tickets for the test period. |  |  | Outstanding
CO16 | Firewalls are configured to identify system and network related incidents, problems and errors and critical issues are ticketed. |  |  |  | CLIENT to provide screenshots showing the configuration for alerts for the firewall. |  |  | Outstanding
CO16 |  |  |  |  | CLIENT to provide a listing of all firewall notification tickets for the test period. |  |  | Outstanding
CO15 | Weekly, IT management receives a report of open tickets. |  |  |  | CLIENT to provide weekly notifications of open tickets for randomly selected weeks. |  |  | Outstanding
Network Security
NS1 | CLIENT conducts an annual internal and external vulnerability assessment. |  |  |  | CLIENT to provide a copy of the annual internal vulnerability assessment. |  |  | Outstanding
NS1 |  |  |  |  | CLIENT to provide a copy of the annual external vulnerability assessment. |  |  | Outstanding
NS2 | Access to CLIENT's corporate offices are restricted by a key card access system.  Access to rooms containing IT infrastructure, systems and equipment is limited to IT departmental staff and facilities management. The IT grants are reviewed semi-annually. |  |  |  | CLIENT to provide evidence for the randomly selected semi-annual review. |  |  | Outstanding
NS3 | Workstation operating system and application security patches are checked automatically and installed when available. IT reviews a report of unpatched workstations and follows up to patch. |  |  |  | CLIENT to provide a listing of all workstations. |  |  | Outstanding
NS3 |  |  |  |  | Staff to randomly select |  |  | Outstanding
NS3 |  |  |  |  | CLIENT to provide |  |  | Outstanding
NS4 | Endpoint protection is installed on all workstations and servers.  Virus signatures are checked daily and updated as they become available. Scans are scheduled and performed daily. |  |  |  | CLIENT to provide a listing of all workstations. |  |  | Outstanding
NS4 |  |  |  |  | CLIENT to provide a listing of all servers. |  |  | Outstanding
NS4 |  |  |  |  | Staff to provide a random selection of workstations and servers. |  |  | Outstanding
NS4 |  |  |  |  | CLIENT to provide evidence of workstations and servers are configured for daily signature updates and daily scans. |  |  | Outstanding
NS5 | CLIENT's internal WLAN is secured by requiring of WPA2-Enterprise and requiring users to authenticate to Active Directory prior to obtaining access. |  |  |  | CLIENT to provide evidence that the internal WLAN is configured for WPA2-Enterprise security and users authenticate to [NAME]. |  |  | Outstanding
NS6 | CLIENT utilizes VLANs to segment and isolate network traffic. |  |  |  | CLIENT to provide a listing of VLAN configuration from the core switch. |  |  | Outstanding
NS7 | Archives log files from all production servers and firewalls and logs are reviewed monthly for hardware failures, system errors, and administrator access. |  |  |  | See NS4.2 |  |  | Outstanding
NS7 |  |  |  |  | See NS4.3 |  |  | Outstanding
NS7 |  |  |  |  | CLIENT to provide a listing of all firewalls. |  |  | Outstanding
NS7 |  |  |  |  | Staff to randomly select firewall(s). |  |  | Outstanding
NS7 |  |  |  |  | CLIENT to provide configuration showing the randomly selected firewalls and production servers are logged. |  |  | Outstanding
NS7 |  |  |  |  | CLIENT to provide documentation of the reviews  of hardware failures, system errors, and administrator access for the random selection of months. |  |  | Outstanding
NS8 | All CLIENT owned mobile devices (tablets, laptops, and smart phones) authorized to access company data are inventoried and tracked by IT personnel. |  |  |  | CLIENT to provide a listing of all CLIENT owned mobile devices. |  |  | Outstanding