2022-077-E-IT Dept-PUBLIC LIBRARY ASSOCIATION, a divison of the American Library Association-Digital learning

Browse Search

DocuSign Envelope ID:24BBAFA9-CD81-4144-ACEF-E9036E703739 • At least once per month, review system access logs and remove any terminated users from the access control lists. Validate termination lists with Human Resources or the user's supervisor before removal. • Ensure vulnerabilities are managed according to the standards of the Network and Systems Operations Policy. • Logging must be enabled at the operating system, application\database and system level. All logs must be sent to their designated central log system. 90 days of logs will be stored in an online storage in SIEM (Security Information and Event Management) system. At least one year of logs will be maintained at all times, either online or offline, easily accessible in the event of an incident for review. • Ensure that internal and external network vulnerability scans are run at least quarterly and after any significant change in the network (e.g., new system component installations, changes in network topology, firewall rule modifications, product upgrades). • Internal and external vulnerability scans with vulnerabilities will be sent to appropriate teams to address. Rescans will be performed once remediation work has been completed. This will continue until a passing results are obtained. • Conduct periodic "spot checks" of system configurations to ensure standard systems configuration guidelines are being followed. • Ensure that penetration tests are conducted according to the standards of the Network and Systems Operations Policy. • Ensure that a wireless analyzer is used periodically to identify all wireless devices in use. • Ensure that all alerts from file integrity monitors and intrusion detection systems are promptly reviewed. • Test security controls, limitations, network connections and restrictions routinely to make sure they can adequately identify or stop any unauthorized access attempts Internal Audit Testing Methodology • The designated Jende Solutions internal auditor will perform an annual audit of Information Technology (IT) systems. The audit will include testing risk management and operational processes and render a report to the Audit Committee of the Board of Directors regarding the information security program and overall information systems activities and related operations. The auditor and the Chief Information Security Officer (CISO) will track all exceptions. The CISO will prepare a response for any deficiencies identified in the audit report. • The auditor is charged with responsibility for an annual in-depth review of all network and information systems activities, related controls, training support, supporting operations and related policies and procedures, internal reporting systems, and Management's follow-up on previously cited exceptions. Audit reports will be issued to the Executive Leadership Team, the Security/IT Steering Committee, and the Jende Solutions Board of Directors. • This will include internal vulnerability assessment and web application scans being performed at least quarterly and after any significant changes in the network or applications respectively. External Vulnerability Assessment and Penetration Testing • The CISO will supervise an independent assessment for the effectiveness of the Jende Solutions information security program at least once per year. At a minimum, the assessment should include evaluating systems security parameters and profiles such as access controls, password strength, network privileges, system configuration, vulnerability management, security safeguard implementation, staff training, startup files, and login violations. The CISO is also responsible for ensuring penetration tests are performed at least annually and after significant infrastructure changes, application upgrades or modification. • The CISO will also coordinate all required external vulnerability scans to ensure compliance with Jende Solutions Policies. The CISO is responsible for ensuring that all vulnerabilities detected in