(2)

System software shall be comprehensively tested and its security functionality validated prior to implementation.

(3)

All vendor supplied default user IDs shall be deleted or password changed before allowing users to access the computer system.

(4)

Versions of system software installed on the computer system and communication devices shall be regularly updated.

(5)

All changes proposed in the system software must be appropriately justified and approved by an authorised party.

(6)

A log of all changes to system software shall be maintained, completely documented and tested to ensure the desired results.

(7)

Procedures to control changes initiated by vendors shall be in accordance with Para 21 pertaining to "Change Management ".

(8)

There shall be no standing "Write " access to the system libraries. All "Write " access shall be logged and reviewed by the System Administrator for dubious activities.

(9)

System Programmers shall not be allowed to have access to the application system's data and programme files in the production environment.

(10)

Procedures to control the use of sensitive system utilities and system programmes that could bypass intended security controls shall be in place and documented. All usage shall be logged and reviewed by the System Administrator and another person independent of System Administrator for dubious activities.