Content library
TISAX: Information security
5.2.6: IT System Management

Requirement description

Objective: The objective of technical checks is the detection of states which can jeopardize the availability, confidentiality or integrity of IT systems and services.

Requirements (must): Requirements for auditing IT systems or services are determined.
The scope of the system audit is specified in a timely manner.
System or service audits are coordinated with the operator and users of the IT systems or services.
The results of system or service audits are stored in a traceable manner and reported to the relevant management.
Measures are derived from the results.

Requirements (should): System and service audits are planned taking into account any security risks they might cause (e.g. disturbances).
Regular system or service audits are performed
- carried out by qualified personnel
- suitable tools (e.g. vulnerability scanners) are used for system and service audits (if applicable)
- performed from the internet and the internal network
Within a reasonable period following completion of the audit, a report is prepared.

How to fill the requirement

TISAX: Information security

5.2.6: IT System Management

Task name
Priority
Status
Theme
Policy
Other requirements
Defining IT system auditing requirements
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
System management
Data system management
1
requirements

Examples of other requirements this task affects

5.2.6: IT System Management
TISAX
See all related requirements and other information from tasks own page.
Go to >
Defining IT system auditing requirements
1. Task description

The organisation must have a defined requirements for conducting audits on IT systems or for a service conducting the audit. In addition the following must be taken into account:

  • Definition of scope of system audit in a timely manner
  • The audits must be coordinated with the operators and users of the system
  • The audit results are stored in a traceable manner and reported to relevant management
  • The results must be analyzed to derive new measures based on the results
Protection of data systems during audit-related testing
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
System management
Data system management
2
requirements

Examples of other requirements this task affects

8.34: Protection of information systems during audit testing
ISO 27001
5.2.6: IT System Management
TISAX
See all related requirements and other information from tasks own page.
Go to >
Protection of data systems during audit-related testing
1. Task description

Reviews and other verification actions e.g. during audits, that target data systems, must be planned in advance and agreed with the appropriate testers and management. This aims to minimize the impact of actions on operational processes.

When planning practices, the following points must be taken into account:

  • inspection requests are approved with the appropriate responsible person
  • the scope of technical tests is agreed in advance and their the implementation is monitored
  • tests are restricted to read-only use as far as possible or are only implemented by experienced system administrators
  • fulfilment of security requirements is ensured in advance on devices that require access to systems
  • tests that may affect the availability of important systems, are performed outside office hours
  • the actions taken during the inspections and the access rights granted for them are recorded in a log

Tasks included in the policy

Task name
Priority
Status
Theme
Policy
Other requirements
No items found.

Never duplicate effort. Do it once - improve compliance across frameworks.

Reach multi-framework compliance in the simplest possible way
Security frameworks tend to share the same core requirements - like risk management, backup, malware, personnel awareness or access management.
Cyberday maps all frameworks’ requirements into shared tasks - one single plan that improves all frameworks’ compliance.
Do it once - we automatically apply it to all current and future frameworks.
Get to know Cyberday
Start your free trial
Cyberday is your all-in-one solution for building a secure and compliant organization. Whether you're setting up a cyber security plan, evaluating policies, implementing tasks, or generating automated reports, Cyberday simplifies the entire process.
With AI-driven insights and a user-friendly interface, it's easier than ever to stay ahead of compliance requirements and focus on continuous improvement.
Clear framework compliance plans
Activate relevant frameworks and turn them into actionable policies tailored to your needs.
Credible reports to proof your compliance
Use guided tasks to ensure secure implementations and create professional reports with just a few clicks.
AI-powered improvement suggestions
Focus on the most impactful improvements in your compliance with help from Cyberday AI.