proc9000-1403-SOP.doc

SBA Procedural NoticePRIVATE

TO:

All Employees and Contractors

CONTROL NO.: 9000-1403

SUBJECT:

Automated Information System Support Separation of Duties

EFFECTIVE: 1/7/2003

This is a reminder to all employees and contractors who work with automated information systems. Work responsibilities that involve support of IT systems must be segregated so that one individual does not control all critical stages of a process.

· Segregation of duties between major operating and programming activities, including duties performed by users, application programmers, and data center staff, is required.

· Generally speaking, the following distinct IT system support functions should be performed by different individuals:

· IS management

· System design

· Application programming

· Systems programming

· Quality assurance/testing

· Computer library management/change management

· Computer operations

· Production control and scheduling

· Data control

· Data security

· Data administration

· Network administration

· Specifically:

· Programmers should not be responsible for moving programs into production or have access to production libraries or data.

· Access to production software libraries should be restricted to library management personnel.

· Persons other than server operators should not set up or operate the production computer.

· Server operators should not have access to program libraries or data files.

· Data processing personnel must not initiate, input, or correct transactions.

· There must be a separation of duties between the security personnel who administer the access control function and those who administer the audit trail.

· Documented job descriptions should accurately reflect assigned duties and segregation of functions.

· Senior management should provide adequate resources and training to ensure that segregation of duty functions are established, understood, and enforced. Where resource limitations make segregation of duties impossible to implement, senior management must ensure that the appropriate supervisory review measures are in place to check for the lack of separation of duties.

If you require additional information about this Notice, please contact Lewis Baskerville at (202) 401-1980 or Joyce Lewis at (202) 205-6318.

Lawrence E. Barrett

Chief Information Officer

Expires: 1/1/2003