Operational Procedures

Documented Operating Procedures

Documented procedures should be prepared for system activities associated with information processing and communication facilities, such as server start-up and closedown procedures, backup, equipment maintenance, media handling, computer room and mail handling, and safety. These operating procedures should be produced and maintained for each system for which the organization is responsible.

The operating procedures should specify the instructions for the detailed execution of each job including:

• processing and handling of information,
• scheduling requirements, including interdependencies with other systems, earliest job start and latest job completion times,
• instructions for handling errors or other exceptional conditions, which might arise during job execution, including restrictions on the use of system utilities,
• support contacts in the event of unexpected operational or technical difficulties,
• special output and media handling instructions, such as the use of special stationery or the management of sensitive output including procedures for secure disposal of output from failed jobs,
• system restart and recovery procedures for use in the event of system failure,
• The management of audit-trail and system log information.

Operating procedures, and the documented procedures for system activities, should be treated as formal documents and changes authorized by management. Where technically feasible, information systems should be managed consistently, using the same procedures, tools, and utilities.

All documented procedures will undergo a regular maintenance review, showing changes and updates.

Change Management

Changes to operational systems will be agreed between the system users, management, and if applicable, IT Service Providers.

Before any changes can be made, the following steps will be taken:

• the change owner or instigator will document the change,
• an impact analysis will be undertaken, including all relevant stakeholders for that infrastructure component or system,
• the change will be tested or otherwise quality assured before it is applied,
• The change will be subject to full review and acceptance by relevant system stakeholders.

Segregation of Duties

All changes to and sensitive operations carried out on ThingLogix system will be subject to an authorization process. This is to reduce the likelihood of unauthorized or unintentional modification or misuse of information or information processing assets.

Separation of development, test and operational facilities

Where different environments exist within the infrastructure, these should be segregated using either physical or logical control mechanisms to prevent unintentional or unauthorized access to live systems and the data they contain.