| 5.1 Service Evaluation Manager: | | Our Service Evaluation Manager is an internal auditor who continually checks if the right balance of internal and external requirements is being achieved. | | Right answeres do not always exist as it is easy to spend more on security and increase the price the customer has to pay, but where this is not cost justified, the Evaluation Manager must come down on the side of the customer and possibly reduce prices. | | Audit compliance is implemented by a number of integrated policies that include: (1) history of every field value, (2) what-did-i-do audit trail of every user action and (3) data cannot be deleted or lost. |
| Deletion Policy: | | No data can be deleted. | | When a new record is created, every field value that is entered is recorded as history. | | When any field value is changed, history of that change is recorded. |
| Encryption Policy: | | All stored data is encrypted in a database using the strongest professional standards. | | No operational data is stored in documents or files. | | No database server is connected to the Internet - see Three-Tier Architecture. |
| Replication Policy: | | Database replication with encrypted message switching is employed. | | Any change to a database in one data center is posted to a message queue to be sent to a database in another data center. | | Each database is encrypted and each message switch transfer of data is encrypted. | | Message switching enables one data center to be more up to date than another with Internet delays resulting in messages being backed up in the queue until they can be sent. | | Message switch policy is that data will be sent at least once, but may be sent twice - logic accomodates this policy that avoids any loss of data. |
| Legal Audit: | | Every application service is subject to the Data Protection Act (DPA) to some degree that is covered by data protection registration number PZ9322564. | | All application data processing facilities are hidden behind a secure sign-in facility and all stored data is encrypted. | | Application services involving finance or insurance are subject to FSA and MiFID regulation. | | Markets in Financial Instruments Directive (MiFID) is a European law to provide consumer protection in investment services. | | Financial Services Authority (FSA) is a UK body that has equivalent bodies in other European countries to regulate market confidence, public awareness, consumer protection and reduction of financial crime. FSA regulation of the motor industry selling insurance products has a major impact on certain applications. | | Payment Card Industry Data Security Standard (PCI-DSS) is a worldwide information security standard that is driven by the banking industry. PCI-DSS standards with its 220 rules are applicable to all applications where people are involved and should not be viewed as just applicable for credit card transactions. |
| PCI-DSS Framework: | | 1. Install and maintain a firewall configuration to protect all operational data. | | 2. Do not use vendor supplied defaults for system passwords and other security parameters. | | 3. Protect stored data (by encryption of database). | | 4. Encrypt transmission of critical data across open public networks. | | 5. Use and regularly update anti-virus software on all systems commonly affected by malware. | | 6. Develop and maintain secure systems and applications. | | 7. Restrict access to operational data by business need-to-know. | | 8. Assign a unique ID to each person with computer access. | | 9. Restrict physical access to operational data. | | 10. Track and monitor all access to network resources and operational data. | | 11. Regularly test security systems and processes. | | 12. Maintain a policy that addresses information security. |
| History: | | All data is stored in two parts: (1) active current values and (2) history of all previous values. | | When a field value is changed, its original value is stored in history and its current value is stored as active. | | History cannot be changed, cannot be deleted and can be viewed by everybody who has the right to see the active data value. | | Every field value change is shown by date, time and name of user who made the change. | | With reference to the WDID audit trail, the field value change event can be traced to a specific computer network, browser and session that identifies all data requests made by the same person. |
| What Did I Do (WDID): | | What Did I Do is a user audit trail of every request made by a user on a daily basis. | | WDID can be viewed but cannot be changed or deleted. | | For any selected date, every data request is shown in time order to show every page opened and every record processed. |
| WDID Data: | | WDID audit trail data is recorded by the calendar month. | | By the end of each month, the WDID data is frozen and stored in up to five remote secure data centers - nobody has physical access to these data centers. | | For any selected date, every data request is shown in time order to show every page opened and every record processed. |
| Backup Policy: | | No data is backed up to removable magnetic tape media that could be stolen. | | Database replication with encrypted message switching is employed. | | No data ever physically leaves a secure data center. | | By eliminating traditional backups, the source of most data leaks has been eliminated. |
| Support Audit: | | Real-time support is provided to ensure that application services can be used in an effective way. | | Any authorized user may add a new support request at any time and may assign an applicable priority level. | | We achieve better than a one hour response to 90% of all priority 1 support requests and every request has a same day response. | | A massive knowledgebase of support queries has accumulated that is shared with all users for self-service. | | We are not in a position to fix Internet delays and interuptions, or to fix local computer problems, but all application issues can normally be resolved within the hour. |
| | | Can a document be created and then cancelled? | | YES. The date, time and user who changed the quote to cancelled is recorded in history for all to view. |
| Can a document be created, sent to a customer and then changed? | | YES. Where an invalid quote is created and sent to a customer, that quote can be corrected and reissued with a full history of every field value change recorded. |
| Can a document be created, manually changed and sent to a customer? | | NO. Every document is 100% created from stored data that has a full audit trail. No document can be manually changed using utilities like Office. No document can be fraudulently hand crafted to the same style as an original. Every document is created with a hidden fingerprint. |
| Systems and Applications Audit: | | An audit to verify that the systems and applications are appropriate, are efficient and are adequately controlled to ensure valid, reliable, timely and secure input, processing and output at all levels of system activity. | | Appropriate application facilities are delivered with continual improvements to ensure that are the business evolve, the application will be improved and the systems will evolve to match the evolving requirements. By granting users the right to make improvement requests, the application is more likely to be appropriate than by any other measure. | | Efficient application facilities are delivered by making the application optional so it will only be used where it delivers real efficiency benefits to its users. | | Control remains with line management who gain considerable management information benefits with measurable information. The very nature of the application ensures valid, reliable, timely and secure processing to levels that would simply not be achievable using other methods. |
| Security Audit: | | A special audit to verify data, computers and networks are secure in proportion to risk needs to begin with the ITIL framework that includes the security policy. | | At an abstract level, for the last ten-years, hundreds of bespoke application services have been operated without any loss of data and without any loss of service. | | History is no guarantee of the future, but it does indicate a professional approach that greatly exceeds that of local authorities, banks and other application services. | | Multiple different domain names may be provided to access your bespoke application service - such high levels of availability with privacy are only available from the most professional service providers. |
| Evaluation Data: | | 1. Name of the IT service under review | | 2. Date and time of the review | | 3. Person in charge of the review | | 4. Participants of the Service Review Meeting | | . 1. Business and user representatives | | . 2. Service provider representatives | | 5. Summary presentation of agreed vs. achieved service levels | | 6. Report on exceptional situations | | 7. Satisfaction regarding service quality on the client-side | | . 1. Compliments | | . 2. Complaints | | 8. Areas which must be addressed by improvement initiatives (resulting in changes to the service and/ or to its underlying processes, or to customer agreements) | | . 1. From the customer viewpoint: New or changed requirements for the service | | .. 1. Changes in business processes or strategy which lead to new functional requirements | | .. 2. Changes in risk perceptions, priorities and criticalities which lead to changed Service Level Targets | | .. 3. Anticipated changes in service consumption, short term as well as medium and long-term | | .. 4. Required short-term modifications (e.g. due to current/ recent problems) | | .. 5. Changed requirements with respect to service level reporting | | . 2. From the IT viewpoint | | .. 1. Areas where service quality is to be improved | | .. 2. Conceivable cost-optimizations, e.g. by using new technologies or optimizing processes, or by influencing service demand |
| Document Control: | | 2016 Dec 16 : Latest edition as (public) page 165100. Part of common ITIL application service. |
|