Certified Information Systems Auditor (CISA) | Domain 4 IT Operations and Service Management 01

Separating approval and the move to production from development, and restricting access, prevents unauthorised changes.

Accurate configuration information supports change impact analysis, incident response and asset management.

The correct approved version must be identified and distributed to the environments in a repeatable way.

Monitor logs recording execution status and abnormal terminations, and act on the exceptions.

Incident management limits the impact on the business and restores normal service quickly.

Problem management manages root causes and known errors and leads to permanent fixes.

Measuring performance against the agreed levels, reporting it and improving demonstrate effective service management.

Secure the performance and capacity needed in good time, based on usage trends and business plans.

Assess the risk and the urgency, and apply the patch with testing, approval and a recovery plan.

To keep privileged operations accountable, protect the logs and have them reviewed independently.

Database constraints prevent invalid references and the creation of orphan records.

Important end-user computing needs change, verification, access and backup controls comparable to those of a formal system.

The service model and the contract determine what the customer and the provider are each responsible for managing.