Appendices - Department of Business - Northern Territory Government

appendicesAPPENDIX IIAudit Audit Outcome or Recommendation Summary ActionIT Controls Audit Year ending 30 June 2010Salary Processing Services (PIPS)Compliance 2010The reviewing and interpreting of security logsand events is not formalised and depends onindividual judgment.Security policies were not closely aligned withrecognised standards, policies do not appear to beconsistently reviewed or published on the intranetand compliance management plans do not measurecompliance with security policies and procedures.There is no centralised security managementframework or role within Data Centre Services.Controls over the review and follow up of PIPSexception reports are not always followed up.Controls over the commencement of new employeesand termination of employees could be enhanced.The implementation of a security event managementsystem and the most appropriate means to enhancenetwork security management will be investigated.ICT Security Policies and Standards were reviewedand a rolling upgrade and maintenance programwill commence. Security policies and standards willcontinue to be communicated to service providersand agencies and published on the intranet.A central security manager will be established tofocus on security management activities.The control guide will be reviewed and amendedto manage the exception report process better,especially for nil reports.Compliance with procedures will be reiteratedto staff and a protocol to access records notheld by DBE will be developed in conjunctionwith the Auditor-General’s Office.Department of Business and Employment Annual Report 2009–10187