Network Diagram & System Documentation Procedure



BoilerplateThis is a “boilerplate” of a “Network Diagram and System Documentation Procedure,” to be used as a starting point in documenting your Asset Management Program. Copyright / Permission to UsePermission to use this document is conditional upon you receiving this template directly from an infotex consultant, infotex website or e-commerce site, or an infotex workshop / training presentation.By using this template either in its entirety or any portion thereof, you acknowledge that you agree to the terms of use as dictated in the “Transfer of Copyright Agreement” located at . This agreement establishes that when you customize this template to your specific needs, your organization may have copyright of the customized document. However, infotex retains copyright to the template. This agreement also establishes that you will not share this or any other template with third parties other than auditors and examiners. You may not transfer ownership of the customized documents to any other organization without the express written permission of infotex.InstructionsMake sure to read through the template carefully as not all situations will pertain to your organization. However, to assist you in customizing the document to your specific needs, we have attempted to color code areas that will need your special attention. Color coding is as follows:All areas needing customization and/or consideration are in red. Sections that are in brown are optional sections according to our definition of best practices. These sections may be removed if they do not match your needs.Sections in blue are merely instructions or additional information for knowledge purposes and should be removed.Sections in green are examples.Note that you should confirm that all text has been changed to “black” before considering this template final for your organization. If there are any sections in any other color than black, then all situations or customization has not been considered.This section (Templates) may be removed once the document has been customized, for at that time we turn ownership of the customized document over to you.? Copyright 2000 – 2016 infotex, Inc. All rights reserved.Insert Financial Institution Name / LogoNetwork Diagram and System Documentation ProcedureClassified: Confidential Information Contact if found: Name, TitleName of Financial InstitutionCity, StatePolicy ScopeThis procedure applies to all Name of Financial Institution’s employees, temporary workers, contractors, and consultants. It applies to all computer systems that require a password; that has access to Name of Financial Institution’s network; or stores any non-public information. The Information Security Officer is responsible for overseeing the development, implementation, and maintenance of this procedure. It should be reviewed at least annually to ensure relevant information is appropriately considered.Senior Management is responsible for enforcing this procedure.For questions concerning this procedure, see Senior Management. IntroductionFrom time to time, outside parties request documentation of our Information System in order to provide services or quotes for services, as well as consulting regarding the design of our system. For this reason Name of Financial Institution needs to keep current a system inventory as well as network diagrams.ObjectiveThis document covers the procedures for taking an inventory of the Information System and documenting the network topology via a network diagram.Distribution of Network Diagrams and System Inventory InformationAs per the Data Ownership Policy and Access Management Procedure, the network is “owned” by the [Network Administrator / Windows Administrator / Unix Administrator]. Note: Clients with multiple platforms typically divide ownership up between the platforms and this should be stated in the above paragraph if necessary.As such, the Network Owner is responsible for ensuring proper execution of this procedure. Just as important, the Network Owner must approve requests for distributing the Systems Inventory information. Because information on a network diagram and in systems inventories could give malicious attackers helpful information, it is important that access to these documents is controlled as per the safeguards related to information classified as Confidential.If intrusion detection/prevention monitoring is being outsourced to a Managed Security Service Provider (MSSP), Network Diagrams should be delivered to the IDS/IPS vendor as per the vendor contract.Auditors, examiners, and consultants who have undergone appropriate vendor due diligence as per the Vendor Management Procedure may receive these documents as requested, with the permission of the Network work File Structure (or Information Landscape) Restricted directories should be documented as an additional document in the System Inventory. During the annual Access Authorization Review process, as per the Access Management Procedure, the Network Administrator will run a report demonstrating access to each restricted directory.System InventoryA System Inventory will include an inventory of all information assets, high-level network diagrams, detailed network diagrams, and a file structure definition document. Tools used in the system inventory process include: [list tools client is using such as asset management tools, network diagramming software, Trackit, etc.]A form has been included for clients that do not have an automated asset management tool. If this is going to be used, the following language applies: Appendix A includes a form that must be completed when the system inventory is work DiagramThe Network Administrator should maintain high-level diagrams showing MAN/WAN topology, as well as detailed network diagrams showing local area network configurations for each location. Diagrams should utilize standard naming conventions and iconology. WAN diagrams must state the connection type (DSL, T1, T3, ATM, etc.) as well as bandwidth constraints (256k/512k, 1MB, etc.) Servers and routers should following naming protocols established in the Network Devices Security Standards. All network diagrams should include the IP addresses of all significant network devices and servers. Workstations can be grouped in one icon expressing IP address ranges if appropriate. Diagrams should include effective date, author, name of network, distribution list, etc.Data Flow DiagramsTo be at baseline in the FFIEC’s Cybersecurity Assessment, we must document where customer data leaves our control in our outsourcing relationships. Meanwhile, we want to benefit from the awareness advantages of teaching management where data is going. Thus, we want to maintain the following “data flow diagrams:”E-communications: E-mail, Secure Messaging, Instant MessagingNew AccountsCompliance Data Processing: BSA, OFAC, and Other Data Connections Out for Compliance PurposesMortgage Loan ProcessingCommercial Loan ProcessingConsumer Loan ProcessingBranchless Banking: Internet Banking, Mobile Banking, ATMs, Billpay, P2P, etc.Collections Access Database designed in 2003. Data flow diagrams will be maintained by the Information Security Officer. The <IT Steering Committee / Technology Team / Information Security Officer> will determine who should receive data flow diagrams. As data flow drawings should be explained as a means of understanding, those receiving data flow diagrams will participate in a meeting where the Information Security Officer explains the drawings. The [IT Steering Committee Meeting Minutes] will reflect the review of the data flow diagrams. (Note: Infotex uses GoToMeeting for this next sentence): The review of the data flow diagram will be conducted in an environment where the review can be recorded.Management is free to choose conventions and standards for data flow diagrams, other than the following requirements:All entities receiving data should be represented on the drawing.All persons involved in the process should be represented on the drawing.All drawings should be dated and author noted.Drawings should be approved by the <IT Steering Committee / Technology Team / Information Security Officer.>The audience for each drawing, in the form of a “distribution list,” should be identified on each drawing.Drawings for which the audience is “technical” should follow appropriate symbol conventions.Updating ScheduleNetwork Diagrams should be updated quarterly as well as whenever major modifications are made. System Inventories should be updated semi-annually or whenever major acquisitions are made. The File Structure documentation should be updated as new restricted root-directories are created. Data Flow Diagrams should be updated annually, when we perform our risk assessment, or whenever a new change, product, service, application, process, or vendor would create a major change in data flow.Due DiligenceThe Information Security Officer / Compliance Officer is responsible for creating and executing a due diligence process to ensure that this procedure is being enforced. All other workforce members will be required to funnel materials gathered as a part of this procedure to the Information Security Officer for processing. The Information Security Officer will also be responsible for gathering annual documentation as required by this procedure, and working with the Internal Auditor / Compliance Officer to ensure procedure enforcement.Status ReportingThe Compliance Officer will ensure that this procedure has been met during ongoing auditing practices and will report to the Audit Committee annually that this procedure has been met. The Audit Committee will then report this to the Board of Directors.Contribution to Control Objectives for Information Technology Enforcement of this procedure contributes to the achievement of CobiT:P05: Manage the IT investment.PO9: DS3:Manage performance and capacity.DS6:Identify and allocate costs.DS9:Manage the configuration.DS13:Manage operations.NoncomplianceViolation of this procedure may result in disciplinary action which may include termination for employees and temporaries; termination of employment relations in the case of contractors or consultants; or dismissal for interns. Additionally, individuals are subject to loss of Name of Financial Institution’s Information Resources access privileges, and civil and/or criminal prosecution.Procedure TrainingThe Information Security Officer, Network Administrator, and Senior Management will review this procedure annually and hold training to ensure that all appropriate personnel understands the provisions of this procedure, as well as the implications upon their job description responsibilities.Distribution ListThe following positions will receive this procedure and any changes to this procedure: List those individuals. Consider establishing an e-mail alias corresponding to the individuals.Storage of ProcedureThe active copy of this procedure will be stored in the [list location of procedure]. Note: We recommend that the Financial Institution develop a method of off-site, on-line, secure storage of policies and procedures such as in a portal, mirrored intranet site, etc.Procedure OwnerTitle HereProcedure ReviewersTitles HereRelated Policies / Procedures / ToolsNetwork Diagram and System Documentation ProcedureSystem Inventory FormAppendix A: System Inventory FormLocation:?????Date:_______________________??????????System Inventory Form: P36A1??????????Inventory NumberSerial #Device NameDept / LocationIP AddressVendorDate OrderedCostOut of ServiceComments?????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????? ................
................

In order to avoid copyright disputes, this page is only a partial summary.

Google Online Preview   Download