Operations and Maintenance
Operations and maintenance encompasses the activities required for the day-to-day operation of assets and systems, as well as the efforts to maintain, repair, and optimize them to ensure functionality, efficiency, and safety throughout their lifespan.
4 slides · 1 min read · Domain 8
During the operations and maintenance phase, the system is being used throughout the organization. The activities that must be done are monitoring the system's performance regularly but also ensuring continuity of operations. This may require making certain components redundant and detecting defects or weaknesses and addressing them.
During operations and maintenance, the organization also needs to manage and prevent system problems, recover from system problems, and implement system changes.
The specific security activities that need to be done during this phase include testing backup and recovery procedures, ensuring proper controls for data and reports, and generally ensuring the effectiveness of security controls and processes. During the maintenance phase, periodic risk analysis and recertification of sensitive applications may be required, especially when significant changes occur. Significant changes may include changes in data classification or sensitivity; relocation or major changes to the physical environment; and purchasing and implementation of new equipment, new internal or external interfaces, new or upgraded operating system (OS) software, and new application software.
Throughout the operation and maintenance phase, it is important to verify that any changes to anything related to the system, including procedures or functionality, do not disable or affect the required security that already exists.
Also, stakeholders need to verify compliance with applicable service-level agreements (SLAs) and contracts according to the initial operational and security baselines.