Auditing Policy, Standards, and Procedures In addition to checking the status of server configuration and policy compliance, you should audit policy, standards, and procedures to ensure that they are up-to-date, meet needs, and are correct for the way your organization operates today. In many organizations, policy addresses security in a broad way, leaving others to define the technology and controls to be used to implement a policy. In these organizations, standards are written that state which technologies will be used and procedures to define how they will be configured. In other organizations, a policy may be specific as to technology and may even state procedural implementation steps. Other organizations may implement security policy using a mixture of these techniques.In all cases, these written documents should be examined. At least consider the following questions about them: Do they address mobile computing issues such as remote access using PDAs or wireless networks? Do they reference technologies that no longer exist on your network or lack information on technologies you may have implemented? Do they address the current risks of the organization? (Are you doing more sensitive work and haven't updated risk assessments and mitigations?)Windows Server 2003 mostly improved technologies introduced with Windows 2000, and you may find that your policy and documentation is current. However, many implementations are the direct result of a need to introduce newer technologies, so you should check to ensure that those technologies are addressed by security policies, standards, and procedures. |