Enterprise Controls Framework for the Technology Platform Operations domain — the optimised set of process controls that give effect to its technical controls.
12 process controls, grouped by sub-policy and shown in full six-level lineage with operational artifacts.
CAO-600 Technology Platform Operations
CAO-610 Operational Resilience Policy
CAO-600 Technology Platform Operations › CAO-610 Operational Resilience Policy › CAO-611 Availability and Capacity › CAO-6111 Manage service availability, capacity and performance › CAO-61111 Service availability, capacity and performance managed to meet defined requirements.
CAO-611111 · Examine capacity and availability management to confirm performance requirements are met.
Method: Examine · Expected evidence: Capacity and availability monitoring records
Operational controls: CAO-6111111 Capacity and Availability Plan
CAO-600 Technology Platform Operations › CAO-610 Operational Resilience Policy › CAO-612 Operational Resilience › CAO-6121 Ensure operational resilience › CAO-61211 Operational resilience maintained so that critical services withstand and recover from disruption.
CAO-612111 · Examine resilience arrangements to confirm critical services can withstand and recover from disruption.
Method: Examine · Expected evidence: Resilience assessment and test records
Operational controls: CAO-6121111 Operational Resilience Register
CAO-600 Technology Platform Operations › CAO-610 Operational Resilience Policy › CAO-613 Backup and Redundancy › CAO-6131 Back up and ensure redundancy of information › CAO-61311 Information backed up and redundancy provided to ensure recoverability.
CAO-613111 · Examine backup and redundancy configuration and tests to confirm information is recoverable.
Method: Examine, test · Expected evidence: Backup and redundancy records
Operational controls: CAO-6131111 Backup and Redundancy Register
CAO-620 Business Continuity and Disaster Recovery Policy
CAO-600 Technology Platform Operations › CAO-620 Business Continuity and Disaster Recovery Policy › CAO-621 Business Continuity Management › CAO-6211 Establish a business continuity management system › CAO-62111 Business continuity management system established and maintained.
CAO-621111 · Examine the business continuity management system to confirm it is established, documented and maintained.
Method: Examine · Expected evidence: BCMS documentation
Operational controls: CAO-6211111 Business Continuity Management System — template
CAO-600 Technology Platform Operations › CAO-620 Business Continuity and Disaster Recovery Policy › CAO-622 Disaster Recovery › CAO-6221 Plan and test disaster recovery › CAO-62211 Disaster recovery plans established and tested to restore services within recovery objectives.
CAO-622111 · Examine disaster-recovery plans and test results to confirm recovery objectives are met.
Method: Examine, test · Expected evidence: DR plan and test records
Operational controls: CAO-6221112 DR Test Register · CAO-6221111 Disaster Recovery Plan — template
CAO-600 Technology Platform Operations › CAO-620 Business Continuity and Disaster Recovery Policy › CAO-623 Continuity of Security › CAO-6231 Ensure continuity of security during disruption › CAO-62311 Information security maintained during disruption and continuity activities.
CAO-623111 · Examine continuity arrangements to confirm security controls remain effective during disruption.
Method: Examine · Expected evidence: Continuity security assessment
Operational controls: CAO-6231111 Security Continuity Register
CAO-630 Configuration, Change and Asset Management Policy
CAO-600 Technology Platform Operations › CAO-630 Configuration, Change and Asset Management Policy › CAO-631 Configuration and Change Management › CAO-6311 Manage secure configuration and change › CAO-63111 Secure configuration and change managed across systems through controlled processes.
CAO-631111 · Examine configuration baselines and change records to confirm secure configuration and change control.
Method: Examine · Expected evidence: Configuration baselines and change records
Operational controls: CAO-6311112 Change Management Register · CAO-6311111 Configuration Management Standard
CAO-600 Technology Platform Operations › CAO-630 Configuration, Change and Asset Management Policy › CAO-632 Asset Management › CAO-6321 Manage and acceptably use information assets › CAO-63211 Information assets inventoried, owned and used acceptably.
CAO-632111 · Examine the asset inventory and acceptable-use controls to confirm assets are managed.
Method: Examine · Expected evidence: Asset inventory and acceptable-use records
Operational controls: CAO-6321112 Acceptable Use Policy — template · CAO-6321111 Information Asset Register
CAO-640 Service Management Policy
CAO-600 Technology Platform Operations › CAO-640 Service Management Policy › CAO-641 Incident and Request Management › CAO-6411 Manage IT service incidents and service requests › CAO-64111 IT service incidents and service requests managed through defined processes.
CAO-641111 · Examine incident and request records to confirm they are managed through defined processes.
Method: Examine · Expected evidence: Incident and request records
Operational controls: CAO-6411111 Incident and Request Management Work Instruction
CAO-600 Technology Platform Operations › CAO-640 Service Management Policy › CAO-642 Problem Management › CAO-6421 Manage problems › CAO-64211 Problems identified, analysed and resolved to prevent recurring incidents.
CAO-642111 · Examine problem records to confirm problems are analysed and resolved.
Method: Examine · Expected evidence: Problem records
Operational controls: CAO-6421111 Problem Management Register
CAO-600 Technology Platform Operations › CAO-640 Service Management Policy › CAO-643 Service Level Management › CAO-6431 Manage service levels and the service catalogue › CAO-64311 Service levels and the service catalogue defined, agreed and monitored.
CAO-643111 · Examine service-level agreements and the catalogue to confirm services are defined and monitored.
Method: Examine · Expected evidence: SLAs and service catalogue
Operational controls: CAO-6431111 Service Catalogue and SLA Register
CAO-600 Technology Platform Operations › CAO-640 Service Management Policy › CAO-644 Service Operation › CAO-6441 Operate, monitor and administer IT services › CAO-64411 IT services operated, monitored and administered to meet agreed requirements.
CAO-644111 · Examine service-operation records to confirm services are operated and monitored per requirements.
Method: Examine · Expected evidence: Service operation and monitoring records
Operational controls: CAO-6441111 Service Operations Register