It risk Assessment Document

1. 
   Who are the system administrator(s)?
   

2. 
   List the system administrator’s duties and responsibilities.
   

3. 
   Is there a backup administrator?
   

4. 
   What skills requirements and development exists for administrator(s)?
   

5. 
   What is the relationship between system administrator and security admin?
   

6. 
   What types of background checks are conducted on IT employees? Is this conducted with HR? Do IT employees sign confidentiality agreements?
   

7. 
   For Security/Compliance Administration versus system administration- is it the same people/procedures?
   

8. 
   What are the technical staff termination procedures/deprovisioning procedures?
   

Build Checklist-

1. 
   Does a list of all vendors with access rights exist?
   

2. 
   What processes are in place to sponsor vendors (Each vendor must be owned by a designated individual- Sys or app admin)?
   

3. 
   Are individuated access control lists in place?
   

4. 
   Do vendors follow config/change management procedures?
   

5. 
   Are vendor access logs by individual reviewed annually?
   

6. 
   Do vendors have system rights?
   

7. 
   Do vendors have constraints on physical access to systems? Does this include escorts?
   

8. 
   Are remote communications encrypted?
   

1. 
   Do Maintenance Plans exist for:
   
   • 
     workstations and
     
   • 
     Devices
     

2. 
   What are the automated patch management procedures?
   

3. 
   What are the automated AV management procedures?
   

4. 
   Do Monthly checks exist for lagging servers (patch/AV) or at risk devices?
   

5. 
   Are there limitations to remote access (specific ports, authentication, remote device security, and encryption)?
   

6. 
   What are the “break glass” access procedures?
   

7. 
   Is there a prohibition on shared access accounts?
   

8. 
   Are there written standards for escalating maintenance changes to change control process?
   

1. 
   Is there an inventory of monitoring, log management, and alerting tools?
   

2. 
   What procedures exist to monitor patch management and AV management?
   

3. 
   Are server configuration integrity checks run on a routine basis? What is the timeframe?
   

4. 
   What type of routine server vulnerability monitoring- such as Nessus- exists?
   

5. 
   Does a process that includes performance monitoring of servers with documented alert triggers and escalation procedures exist?
   

6. 
   Are security logs maintained for 60 days?
   

Successful and unsuccessful access attempts

Config changes

Systems or services accessed

Network addresses/ports and protocols

Deactivation or Activation of security tools

Standard Clocking

Are there procedures in place for Post intrusion prevention triggers and alerts based on anomalies in security logs?

1. 
   Is a risk assessment conducted and are security controls documented according to risk?
   

2. 
   Are new applications and services are reviewed for security risk?
   

3. 
   Does staff have designated individuals for addressing user security questions and issues?
   

4. 
   Are security policies and standards reviewed biannually and are additional security controls deployed as needed?
   

5. 
   Does IT staff discourage users from using unencrypted USB drives or other mobile media?
   

6. 
   Do the password policies for users conform to standards?
   

7. 
   Are there more stringent password settings for system administrators- such as multifactor authentication or 15 character passwords?
   

8. 
   Are there prohibitions against unencrypted laptops or personal electronic devices?
   

9. 
   Are the procedures for terminating user accounts are coordinated with HR and enterprise systems? What is the timeframe for removing user accounts? What is the timeframe for terminating admin accounts? Are admin accounts annually recertified?
   

1. 
   Do documented procedures exist for identifying and classifying problems (e.g. usability or interfaces)? What are the procedures?
   

2. 
   Do customers and partners have channel for communicating problems?
   

3. 
   What are the documented procedures for escalating problems and events to incidents?
   

4. 
   Are incident handlers identified based on type and scope of incidents?
   

5. 
   Does an incident policy and procedure exist, and is it documented?
   

6. 
   Are incident post mortems are conducted? Are remediation actions planned and deployed?
   

1. 
   Is there an inventory of applications and services near EOL?
   

2. 
   Do migration plans for EOL systems including maintenance and support exist?
   

3. 
   What data migration plans for EOL including formats, structures exist?
   

4. 
   Are device disposal procedures followed with respect specifically environmental and confidentiality controls?
   

5. 
   Are all server hard drives wiped or destroyed? What type of documentation exists for the destruction?
   

6. 
   Is there a process is in place to destroy Workstation hard drives?
   

7. 
   Do contractual or procedural controls for digital media disposition (e.g. photocopiers, printers, PED, etc) exist?
   

8. 
   What types of routine communications on EOL and disposal to affected units exist?
   

1. 
   Is there a software package for monitoring system and/or user activity? What is it? What does it monitor?
   

2. 
   What is the extent of vendor support (i.e., on-site, off-site, warranty coverage, extended hours, and system maintenance agreements)?
   

What security controls are in place for network closets?

Are access rights reviewed annually?

1. 
   Is there a DR plan? Does it include the inventory of hardware and software assets?
   

2. 
   What is the date of the last DR test?
   

3. 
   Does the DR plan include a Recovery Time Objective (RTO), and a Recovery Point Objective?
   

4. 
   Is the DR plan coordinated with the Hopkins DR plan?
   

5. 
   Is the DR plan linked to the BCP plan(s)?
   

1. 
   Does the network policy include the acceptable use of network services? Network authorization procedures?
   

2. 
   What type of network segmentation exists?
   

3. 
   Is NAT or PAT in use?
   

4. 
   Where are the firewalls located?
   

5. 
   Is there a formal firewall policy in place? Is it reviewed against the IDS and IPS?
   

6. 
   Is there filtering between the DMZ and the production network?
   

7. 
   Are there testing processes in place for Web applications (such as SQL injection, XSS)?
   

8. 
   What processes monitor database activity?
   

9. 
   What policies are in place for email? Are there email checks on the gateway?
   

10. 
    What restrictions are in place for numbers of email sent (assists in preventing spam)?
    

11. 
    Are there procedures for internal or external penetration testing of the infrastructure?
    

12. 
    Is remote administrative access limited to certain IP addresses?
    

13. 
    Are users trained in acceptable use procedures? If yes, explain the process.
    

14. 
    What type of encryption exists on the wireless network?
    

15. 
    Is there a wireless guest network?
    

16. 
    Is there a process to monitor for unauthorized WAP’s?