Document ID: chunk:federal_register_of_legislation:F2023C01130:body:0:p102
Version: federal_register_of_legislation:F2023C01130
Segment Type: other
Provision Reference: 
Character Range: 312427–319647

Yes ‒ for certain applications and databases                                                    Yes
Manage Access                                                                                                                                                                               System settings: Systems are not adequately configured or updated to restrict system access to properly authorised and appropriate users.                                                                                                                    Access is authenticated through unique user IDs and passwords or other methods as a mechanism for validating that users are authorised to gain access to the system.  Password parameters meet company or industry standards (e.g., password minimum length and complexity, expiration, account lockout)                     Yes – password authentication only                       Yes – mix of password and multi-factor authentication                                           Yes
The key attributes of the security configuration are appropriately implemented                                                                                                              N/A – no technical security configurations exist                                                                                                                                                                                                             Yes ‒ for certain applications and databases                                                                                                                                                                                                                                                                                 Yes
Manage Change                                                                                                                                                                               Application changes: Inappropriate changes are made to application systems or programs that contain relevant automated controls (i.e., configurable settings, automated algorithms, automated calculations, and automated data extraction) or report logic.  Application changes are appropriately tested and approved before being moved into the production environment                                                                                                                                                                                                                 N/A ‒ would verify no source code installed              Yes ‒ for non-commercial software                                                               Yes
Access to implement changes into the application production environment is appropriately restricted and segregated from the development environment                                         N/A                                                                                                                                                                                                                                                          Yes for non-commercial software                                                                                                                                                                                                                                                                                              Yes

Manage Change                                                                                                                                                                               Database changes: Inappropriate changes are made to the database structure and relationships between the data.                                                                                                                                               Database changes are appropriately tested and approved before being moved into the production environment                                                                                                                                                                                                                    N/A – no database changes made at entity                 Yes ‒ for non-commercial software                                                               Yes
Manage Change                                                                                                                                                                               System software changes: Inappropriate changes are made to system software (e.g., operating system, network, change-management software, access-control software).                                                                                           System software changes are appropriately tested and approved before being moved to production                                                                                                                                                                                                                               N/A – no system software changes are made at entity      Yes                                                                                             Yes
Manage Change                                                                                                                                                                               Data conversion: Data converted from legacy systems or previous versions introduces data errors if the conversion transfers incomplete, redundant, obsolete, or inaccurate data.                                                                             Management approves the results of the conversion of data (e.g., balancing and reconciliation activities) from the old application system or data structure to the new application system or data structure and monitors that the conversion is performed in accordance with established conversion policies and procedures  N/A – Addressed through manual controls                  Yes                                                                                             Yes
IT Operations                                                                                                                                                                               Network: The network does not adequately prevent unauthorised users from gaining inappropriate access to information systems.                                                                                                                                Access is authenticated through unique user IDs and passwords or other methods as a mechanism for validating that users are authorised to gain access to the system.  Password parameters meet company or professional policies and standards (e.g., password minimum length and complexity, expiration, account lockout)    N/A – no separate network authentication method exists   Yes                                                                                             Yes
Network is architected to segment web-facing applications from the internal network, where ICFR relevant