Risk Control Matrix - - IS ITGC Review

Process Name Data Center

Applications in Scope
Testing Period
Sampling Method
Testing Methodology
Policy Documents
Overall Conclusion
Prepared By and Date

Risk assessment
Risk Control owner Manual / automated / Preventive / Frequency Documents Referred To
Process Sub Process Control Objective Control description Test Results semi-automated detective

Data Center Physical Access Policies should exist regarding entry Absence or inadequate policy regarding the entry restricitons may lead to
only by authorised personnel access by unauthorised personnel and chances of data tampering,
corruption, embezellement would be present
Data Center Physical Access Having controlled environment Environment in the Data center should be controlled by having adequate
cooling systems without which servers/systems would crash

Data Center Physical Backup Disaster Recovery Equipment Standby servers, Fire extinguishers, High ground raising etc should be a
part of the data center room to protect the equipments present in the data
center
Server Connectivity Continuous Uptime Continuous Uptime of the server can be ensured by having a dedicated
network line and should not be shared among other systems

Network Access Security Access Presence of a Proxy server and a To hide identity of iskcon in the internet and to prevent unauthorised
firewall network intrusions
Server Physical Access Logging There should be a provison of logging the access of personnel on the
server in order to keep track of the access

Page 1 of 3
Testing Period
Sampling Method
Testing Methodology
Policy Documents
Overall Conclusion
Prepared By and Date

Risk assessment
Risk Control owner Manual / automated / Preventive / Frequency Documents Referred To
Process Sub Process Control Objective Control description Test Results semi-automated detective

Preventive Automated
Detective Semi-Automated
Manual

Page 2 of 3
Testing Period
Sampling Method
Testing Methodology
Policy Documents
Overall Conclusion
Prepared By and Date

Risk assessment
Risk Control owner Manual / automated / Preventive / Frequency Documents Referred To
Process Sub Process Control Objective Control description Test Results semi-automated detective

Preventive
Detective

Page 3 of 3