A.10 Communications and operations management

A.10.1 Operational procedures and responsibilitie.

Objective: To ensure the correct and secure operation of information processing facilities.

A.10.1.1 Documented operating procedures

Control

Operating procedures shall be documented, maintained, and made available to all users who need them.

A.10.1.2 Change management

Control

Changes to information processing facilities and systems shall be controlled.

A.10.1.3 Segregation of duties

Control

Duties and areas of responsibility shall be segregated to reduce opportunities for unauthorized or unintentional modification or misuse of the organization’s assets.

A.10.1.4 Separation of development, test and operational facilities

Control

Development, test and operational facilities shall be separated to reduce the risks of unauthorised access or changes to the operational system.