8.1
IT operations must meet the requirements arising from the
implementation of the business strategy and from IT-supported business processes
(see AT 7.2
(1) and (2) MaRisk).
|
|
|
- |
8.2
The components of the IT systems and their relationships to each
other must be managed in an appropriate manner, and the inventory data recorded
for this
purpose must be updated regularly and as required. Inventory data includes, in particular:
|
|
|
- |
| Existence and intended use of IT system components with relevant
configuration details (e.g. version and patch level)
|
Fully automated inventory management at all levels of IT:
infrastructure, system components, applications and end-user devices (full-stack
approach).
|
|
100%
Â
 |
|
During the recording process, the versions of operating systems,
programming languages, frameworks and applications in use at the time of recording
are
determined fully automatically.
|
|
100%
Â
|
|
Data from third-party systems, such as IT and network monitoring, IT
service management, cloud providers and business applications, can be easily integrated
and
correlated using the Versio.io topology.
|
|
100%
Â
|
| Owners of IT systems and their components |
Customer-specific information, such as owner or application, can be
defined using environment variables and thus recorded in Versio.io. The topological
relationships between the assets and configuration items of the recorded IT landscape
then
also enable complex content assignments to be queried. This allows, for example,
all
components belonging to an application (top-down) or all applications running on
a computer
(bottom-up) to be determined.
|
|
100%
Â
|
| Location of IT system components |
Geolocations or location data can be transferred from third-party
systems, defined by environment variables or determined by deriving them from the
IP
address.
|
|
100%
Â
|
| List of relevant information on warranties and other support
contracts (with links, if applicable)
|
Contracts in digital form (e.g. Microsoft 365) or key parameters from
paper contracts can be imported or recorded by Versio.io. Versio.io offers audit-proof
data
storage that makes every status and change to a contract traceable throughout its
entire
lifecycle.
The imported contract data can be analysed based on its content (data
attributes, filters) and relationships (topology).
All contract data can be verified for plausibility, integrity and
compliance. Any violations are recorded in an audit-proof manner and appropriate
notifications can be sent.
|
|
100%
Â
|
| Information on the expiry date of the support period for the
components of the IT systems
|
Versio.io provides all release-related information about hardware and
software products in its 'Product Release & End-of-Life Database'. Based on
this information, rulesets can be generated that provide fully automated verification
of
customer-specific product release strategies. For example, release strategies such
as
'last release', 'last patch', 'in maintenance', 'support
provided' or 'long-term support' can be checked.
|
|
100%
Â
|
| Protection requirements for IT systems and their components |
The first step is to determine the level of protection required at a
conceptual level. Versio.io offers the option of operationalising the protection
requirements for IT operations across the entire IT landscape.
Protection requirements can be stored in the form of environment
variables or tags on IT systems and their components. This allows the protection
requirements to be used in all subsequent implementation scenarios (e.g. reporting,
compliance checks, cost allocation, etc.).
|
|
75%
Â
 |
| Accepted period of unavailability of IT systems and maximum
tolerable data loss.
|
Defined maintenance windows from a wide range of third-party systems
(ITSM, monitoring) can be imported and stored in a historical database.
Maintenance windows, including their topological relationships to IT
components, can be analysed, evaluated and verified. This allows maintenance windows
during
critical business hours or without an end time to be identified, for example.
|
|
50%
Â
 |
8.3
The portfolio of IT systems requires management. IT systems
should be updated regularly. Risks arising from outdated IT systems or those no
longer
supported by the manufacturer must be managed (life cycle management).
|
IT systems are recorded fully automatically and continuously. The
shortest update cycle is currently 1 minute. This means that data on the IT landscape
is
available in Versio.io in almost real time.
Versions of operating systems, system components, programming languages,
technologies and applications are recorded. Every version change is verified against
Versio.io's internal 'product release and end-of-life database' according to
customer-specific strategies, such as last release, last patch, long-term support,
product
under maintenance and support.
|
|
100%
Â
|
8.4
The processes for changing IT systems must be designed and
implemented depending on the type, scope, complexity and risk involved. This also
applies to
new purchases or replacements of IT systems and to security-related improvements
(security
patches).
Changes to IT systems also include the maintenance of IT systems. Examples of
changes are:
|
|
|
- |
| Function enhancements or bug fixes for software components |
Functional enhancements to an IT system consist of changes to
configurations in addition to the software code. These include database schemas,
file
configurations (app, web, messaging or database servers), DevOps artefacts (Docker
or
Kubernetes configurations) and network configurations (activation of network segments
and
ports). These configurations can be recorded and documented fully automatically.
Each of
these changes can in turn be verified fully automatically with regard to a target
configuration, security requirements and internal specifications.
IT monitoring and log management systems are usually used to analyse
the causes of errors. Versio.io offers change detection as an additional essential
data
source for identifying the causes of errors in IT operations.
|
|
75%
Â
|
| data migrations |
With Versio.io Batch Job Monitoring, companies can record,
quality-assure and optimise the cyclical execution of daily backup processes for
data
migration in an audit-proof manner.
The recorded process data can be verified in terms of content to ensure
governance and compliance. This allows you, for example, to be notified if a backup
has
failed or if its execution time has changed significantly from previous process
runs.
For data migration quality assurance, Versio.io's generic data
importers can be used to determine and ensure the completeness of the migration
based on the
number of data records and the correctness of the content using check digits (hash
values)
per data record or object. The Delta Topology Analyser can be used to automatically
detect
differences between the migrated data sources and trigger alerts if necessary.
|
|
50%
Â
|
| Changes to configuration settings of IT systems |
Versio.io's core competence is the detection of changes and their
post-processing (verification, cost allocation, process monitoring, etc.).
Versio.io stores every configuration change in an audit-proof manner.
This means that all configurations are available to the user throughout the entire
lifecycle. This is comparable to a backup or versioning of configurations.
Any configuration changes can be verified fully automatically and based
on rules with regard to existing governance and compliance requirements (security,
product
updates, internal specifications, configuration problems, etc.).
|
|
100%
Â
|
| Replacement of hardware components (servers, routers, etc.) |
The configuration of replaced hardware components in the form of
physical servers, storage systems, routers, mobile devices, etc. can be collected
and
documented fully automatically.
Based on the delta topology analysis, the configurations between the
last configuration and the new replaced hardware component can be compared in order
to
identify configuration differences, for example.
The recorded configurations of the replaced hardware components can be
verified fully automatically in terms of governance and compliance as part of the
initial
recording and any subsequent configuration changes. This ensures compliance with
compliance
and security aspects (known security vulnerabilities, products without maintenance/support,
more recent product versions, internal specifications, valid SSL certificates, open
ports,
etc.).
|
|
75%
Â
|
| Use of new hardware components |
The configuration of new hardware components in the form of physical
servers, storage systems, routers, mobile devices, etc. can be collected and documented
fully automatically.
The newly recorded configurations of the hardware components can be
verified fully automatically in terms of governance and compliance during the initial
recording and any subsequent configuration changes. This ensures compliance with
compliance
and security aspects (known security vulnerabilities, product without maintenance/support,
more recent product versions, internal specifications, valid SSL certificates, open
ports,
etc.).
|
|
75%
Â
|
| Relocation of IT systems to another location |
When relocating IT systems, documenting the current status and
comparing it with the migrated IT system is essential for ensuring a stable and
error-free
migration.
Versio.io's Asset & Configuration Inventory provides all
current configurations of every single component of the entire IT system (VM, host,
processes, services, configurations, database schema, applications, etc.) as an
information
base. In addition, the relationships between all components of the IT system are
provided in
the form of a topology.
Based on the topology, it is possible to compare the existing IT system
(ACTUAL) and the migrated IT system down to the attribute level of a subcomponent.
This
provides proof that the IT system has been restored 1:1 at the new location.
Customer-specific filter adjustments for the topology delta analysis can be configured.
|
|
50%
Â
|
8.5.
Changes to IT systems must be recorded in an orderly manner,
documented, evaluated taking into account possible implementation risks, prioritised,
approved and implemented in a coordinated and secure manner. Suitable processes
must also be
established for time-critical changes to IT systems. The following measures, for
example,
serve to ensure that changes are implemented securely in productive operations:
|
|
|
- |
| Risk analysis with regard to existing IT systems (in particular the
network and upstream and downstream IT systems), also with regard to possible security
or
compatibility problems, as part of the change request
|
The changes detected by Versio.io, e.g. to operating systems, process
technologies, app, web or database servers, router configurations, etc., can be
verified
with regard to known IT security vulnerabilities, outdated release or patch versions,
unavailable maintenance and support for the products used, and internal requirements
for
ensuring operational continuity.
|
|
100%
Â
|
| Testing changes prior to going live for possible incompatibilities
and potential security issues with existing IT systems
|
Versio.io's core competence is the detection of changes and their
post-processing. This means that not only planned but also unplanned changes can
be detected
during tests prior to going live. Furthermore, the scope of the changes can be objectively
controlled operationally by means of delta comparison between the test and production
environments.
The changes to operating systems and process technologies detected by
Versio.io can be verified with regard to known IT security vulnerabilities, outdated
release
or patch versions, and unavailable maintenance and support for the products.
|
|
50%
Â
|
| Testing patches before they go live, taking into account their
criticality
|
Versio.io's core competence is the detection of changes and their
post-processing. This means that not only planned but also unplanned changes can
be detected
during testing prior to going live. Furthermore, the scope of the changes can be
objectively
controlled operationally by means of delta comparison between the test and production
environments.
|
|
25%
Â
 |
| Data backups of the affected IT systems |
With Versio.io Batch Job Monitoring, companies can record,
quality-assure and optimise the cyclical execution of daily data backup runs in
an
audit-proof manner. The recorded process data can be verified in terms of content
to ensure
governance and compliance. This allows you, for example, to be notified if a backup
has
failed or if its execution time has changed significantly from previous process
runs.
|
|
25%
Â
|
| Rollback plans to restore an earlier version of the IT system if a
problem occurs during or after go-live
|
Versio.io fully automates the documentation of all changes to IT
systems. In the event of a reversal, Versio.io provides detailed information on
the state of
the IT system prior to the change (e.g. application configuration, database schema,
etc.).
Based on the Delta Topology Analyser, automated verification can be
performed after reversal to ensure that the configuration corresponds to the last
stable
state of the IT system.
|
|
50%
Â
|
| Alternative recovery options to address the failure of primary
rollback plans
|
If recovery based on standard procedures such as backup or snapshot is
not possible, Versio.io offers complete documentation of an IT system as a prerequisite
for
partial or complete reinstallation of an IT system.
Based on the Delta Topology Analyser, automated verification can be
performed after reinstallation to ensure that the configuration corresponds to the
last
stable state of the IT system.
|
|
50%
Â
|
| For low-risk configuration changes and parameter settings (e.g.
changes to the layout of applications, replacement of defective hardware components,
connection of processors), different procedural specifications/controls can be defined
(e.g.
dual control principle, documentation of changes or downstream control).
|
Any changes in the IT landscape, whether important for evaluation or
not, are automatically documented and logged. Versio.io thus creates an overall
picture and
also enables problem causes to be identified on the basis of seemingly unimportant
configurations.
|
|
100%
Â
|
8.6
Reports of unplanned deviations from normal operations
(malfunctions) and their causes must be recorded in an appropriate manner, evaluated,
prioritised in particular with regard to any resulting risks, and escalated in accordance
with defined criteria.
To this end, standard procedures must be defined, e.g. for measures and
communication as well as responsibilities (e.g. for malicious code on end devices,
malfunctions). Processing, root cause analysis and solution finding, including follow-up,
must be documented. An orderly process for analysing possible correlations between
disruptions and their causes must be in place. The processing status of open reports
on
incidents, as well as the appropriateness of the assessment and prioritisation,
must be
monitored and controlled. The institution must define suitable criteria for informing
the
parties involved (e.g. management, competent supervisory authority) about incidents.
Risks can be identified, for example, by demonstrating the violation of
protection objectives. The root cause analysis must also be carried out if several
IT
systems are used to record and process incidents and causes. Standardised incident
and
problem management solutions can be used here.
|
Classic incident and problem management is provided by specialised ITSM
systems. Versio.io can take over the reports, log them and map existing relationships
to the
affected system components (application, service, process, host, etc.).
Versio.io supports message processing by providing information about
all configurations in the IT landscape and any changes made to them. The change
information
forms the basis for root cause analysis, as changes are often the starting point
for
incidents.
In addition to centralised information provision and root cause
analysis, reports on problem-causing configurations or even the messages themselves
can be
provided.
All measures taken on system components as part of troubleshooting are
automatically documented by Versio.io (e.g. memory expansion, version update, configuration
change, etc.). Each of these changes can be verified in terms of governance and
compliance.
|
|
50%
Â
|
8.7
The requirements for data backup procedures (excluding data
archiving) must be set out in writing in a data backup concept. The requirements
for the
availability, readability and timeliness of customer and business data, as well
as for the
IT systems necessary for their processing, as set out in the data backup concept,
must be
derived from the requirements of the business processes and the business continuity
plans.
The procedures for restoring and ensuring the readability of data must be tested
regularly,
at least once a year, on a random basis and as required.
The requirements for measures to ensure the availability, readability and
timeliness of data, as well as for the tests to be carried out, are derived from
relevant
risk analyses. One or more additional locations may be necessary for the storage
of data
backups.
|
With Versio.io Batch Job Monitoring, companies can record,
quality-assure and optimise the cyclical execution of daily backup processes and
annual
recovery tests in an audit-proof manner. The recorded process data can be verified
in terms
of content to ensure governance and compliance. This allows you, for example, to
be notified
if a backup or recovery test has failed or if its execution time has changed significantly
from previous process runs.
|
|
25%
Â
|
8.8
The current performance and capacity requirements of the IT
systems must be determined. Future performance and capacity requirements must be
estimated.
Service provision must be planned and monitored in order to identify bottlenecks
in a timely
manner and respond appropriately. The performance and capacity requirements of information
security measures must be taken into account during planning.
|
The central asset & configuration inventory in Versio.io provides
configuration data from a wide variety of data sources, such as data centres and
clouds, via
reporting and the open API. This allows the configured resource allocations (number
of CPUs,
amount of working or disk storage, etc.) to be determined. Versio.io does not collect
any
data on the amount of resources actually used!
|
|
25%
Â
|
In 2017, the banking
supervisory requirements for IT (BAIT) were published as a specification of the
minimum
requirements for risk management (MaRisk) addressed IT requirements. These must
be
implemented by financial institutions without a transition period and the IT departments
must be aligned with the BAIT.
