Server Base Image Security Auditing Policy

• Table of Contents

  • EDC Inc Server Base Image Security Auditing Policy
  • 1. Policy Statement
  • 2. Scope
  • 3. Responsibilities
  • 4. Auditing Procedures
  • 5. Change Management
  • 6. Enforcement
  • 7. Review and Update
  • Summary

EDC Inc Server Base Image Security Auditing Policy

This policy outlines the procedures and responsibilities for maintaining the security of server base images at EDC Inc. It is designed to ensure that all server base images are secure, up-to-date, and compliant with all relevant regulations and standards.

1. Policy Statement

EDC Inc is committed to maintaining the highest level of security for all server base images. This includes regular auditing, patching, and monitoring to detect and prevent any potential security threats. This policy applies to all server base images managed by EDC Inc, regardless of their location or purpose.

2. Scope

This policy applies to all departments within EDC Inc that manage or use server base images, including but not limited to IT Server Operations, IT Server Build Operations, IT-SOC, Corporate Physical Security, IT Security Operations, IT Monitoring Operations, IT Database Operations, and IT Audit and Compliance.

3. Responsibilities

• The IT Server Operations department is responsible for the regular patching of server base images. This must be done every 30 days, unless an “IT Exception” is approved by IT Security.
• The IT Security Operations department is responsible for approving any “IT Exceptions” to the regular patching schedule.
• The IT Audit and Compliance department is responsible for conducting regular audits of server base images to ensure compliance with this policy and all relevant regulations and standards.
• The IT-SOC is responsible for managing any incidents related to server base image security.
• All other departments are responsible for cooperating with these departments and complying with this policy in their use of server base images.

4. Auditing Procedures

Audits of server base images will be conducted by the IT Audit and Compliance department using the CMDB inventory management tool. These audits will check for the following:

• Compliance with the regular patching schedule
• Approval and documentation of any “IT Exceptions”
• Any potential security threats or vulnerabilities

Any issues identified during these audits will be reported to the IT-SOC for incident management and to the relevant department for resolution.

5. Change Management

Any changes to server base images must be approved by the CAB (Change Audit Board). This includes changes to the base image itself, changes to the patching schedule, and changes to the auditing procedures.

6. Enforcement

Failure to comply with this policy may result in disciplinary action, up to and including termination of employment. Any suspected violations of this policy should be reported to the IT Security Operations department immediately.

7. Review and Update

This policy will be reviewed and updated annually by the IT Audit and Compliance department to ensure it remains effective and relevant. Any proposed changes to this policy must be approved by the CAB.

Summary

This Server Base Image Security Auditing Policy is a critical component of EDC Inc’s overall IT security strategy. By ensuring that all server base images are secure, up-to-date, and compliant with all relevant regulations and standards, we can significantly reduce the risk of security incidents and ensure the integrity of our IT infrastructure. All employees are expected to comply with this policy and cooperate with the relevant departments in their efforts to maintain the security of our server base images.

96 comments