Find Resources & Connect with members on topics that interest you.

Applications

Audit

Business Processes

Career Management

Cloud Computing/Virtualization

COBIT

Controls and Monitoring

Databases

Fraud and Computer Crime

Governance and Management

Industry

Information Security

IT Service Management

Mobile/Wireless

Operating Systems

Privacy/Data Protection

Regulations

Risk

Standards

AI - Acquire and Implement

PO - Plan and Organize

DS - Deliver and Support

ME - Monitor and Evaluate

Application Controls

Process Controls

Please sign in to see your topics.

You must be logged in to join this group.

PO4.14 - Contracted Staff Policies and Procedures

This topic is intended to enable collaboration and sharing of information to facilitate a better understanding and approach to implementing this COBIT control objective based on the risk, value and guidance provided by its corresponding control practices.

COBIT Control Objective PO4.14 - Contracted Staff Policies and Procedures is contained within Process Popup Define the IT Processes, Organisation and Relationships

Learn more about COBIT and related publications.

Click “Join This Community” to be able to actively participate in discussions and contribute content. You must be an ISACA member to join this topic. Join ISACA now.

 
This Topic Has:
1 Members
0 Online
848 Visits

 Recent Discussions

Community Leader

Knowledge Center Manager

Knowledge Center Manager

Title: Become a Topic Leader!

Points: 3

Contracted Staff Policies and Procedures

Ensure that consultants and contract personnel who support the IT function know and comply with the organisation’s policies for the protection of the organisation’s information assets such that they meet agreed-upon contractual requirements.

View value and Risk Drivers  help

Hide value and Risk Drivers help


Value Drivers

  • Contracted staff supporting the needs of the business
  • Knowledge sharing and retention within the organisation
  • Protection of the information assets
  • Control over the contracted personnel’s activities
   Risk Drivers
  • Increased dependence on key (contracted) individuals
  • Gaps between expectations and the capability of contracted personnel
  • Work performed not aligned with business requirements
  • No knowledge capture or skills transfer from contracted personnel
  • Inefficient and ineffective use of contracted staff
  • Failure of contracted staff to adhere to organisational policies for the protection of information assets
  • Litigation costs from disagreements over expectations for responsibility and accountability

View Control Practices  help

Hide Control Practices  help

  1. Implement policies and procedures that describe when, how and what type of work can be performed or augmented by consultants and/or contractors, in accordance with the organisation’s enterprisewide IT procurement policy.
  2. Require contractors to comply with the organisation’s policies and procedures (e.g., requirements for security clearance, physical and logical access control requirements, client equipment and personnel, information confidentiality requirements, and nondisclosure agreements). At the commencement of the contract, the contractor formally agrees to be bound by the organisation’s IT policies. Contractors are advised that management reserves the right to monitor and inspect all usage of IT resources, including e-mail, voice communications, and all programs and data files.
  3. Provide contractors with a clear definition of their roles and responsibilities as part of their contracts. Contractors are explicitly required to document their work to agreed-upon standards and formats.
  4. Ensure that an individual with appropriate authority within the IT function has responsibility for reviewing the contractor’s work and approving payments.

 

Discussions: 0 total

Must be a Topic member to contribute

No Results Found

Documents & Publications: 70 total

Must be a Topic member to contribute
View All »
Downloads
Val IT Framework 2.0
Posted by ISACA 344 days ago
Downloads
VAL IT Business Case
Posted by ISACA 397 days ago
Research
Virtualization Desktop Infrastructure (VDI)
Posted by ISACA 23 hours ago
Books
Information Security Policies Made Easy, Version 12
Posted by ISACA 11 days ago
Books
Information Security Roles & Responsibilities Made Easy, Version 3.0
Posted by ISACA 34 days ago
Books
A Practical Guide to IBM i and i5/OS Security and Compliance
Posted by Sunitha Kancherla 34 days ago
View All »

Events & Online Learning: 10 total

View All »
7 May 2012
ISACA International Event
North America CACS 2012
Orlando, Florida, USA
Get the knowledge you need to stay one step ahead of the competition and keep up with changing professional trends at ISACA’s North America CACS Conference.
More »
Add to my Outlook
15 May 2012
ISACA International Event
Microsoft Security Development Conference
Washington, DC, USA
More »
Add to my Outlook
12 Jun 2012
ISACA International Event
Training Dallas Texas USA
Dallas, Texas, USA
ISACA Training is a unique educational event designed to provide the tools you need to maintain, update and upgrade your skills, and to continue your professional development.
More »
Add to my Outlook
Register Now
7 Aug 2012
ISACA International Event
Training Chicago Illinois USA 2012
Chicago, Illinois, USA
ISACA Training is a unique educational event designed to provide the tools you need to maintain, update and upgrade your skills, and to continue your professional development.
More »
Add to my Outlook
Register Now
10 Sep 2012
ISACA International Event
Information Security and Risk Management Conference: Europe
Munich, Germany
EuroCACS/ISRM is a multidimensional event featuring audit, security, governance and risk content, and the audit and security programs, tools and the resources you need to be responsive to industry changes.
More »
Add to my Outlook
Register Now
11 Sep 2012
ISACA International Event
Training San Francisco California USA
San Francisco, California, USA
ISACA Training is a unique educational event designed to provide the tools you need to maintain, update and upgrade your skills, and to continue your professional development.
More »
Add to my Outlook
Register Now
View All »

Journal Articles: 174 total

View All »
Volume 2, 2012
Making Preparedness Pay
by Steven J. Ross, CISA, CISSP, MBCP
The Conference Board study addresses the resilience of companies “to bounce back from a disruption” caused by security events, which are defined rather loosely as environmental disasters, terrorism and cyberattacks.
Volume 5, 2011
Analyzing IT Value Management at KLM Through the Lens of Val IT
by Steven De Haes, Ph.D., Dirk Gemke, John Thorp, CMC, ISP, and Wim Van Grembergen, Ph.D.
The goal of this article is to provide insight to practitioners regarding how to introduce better value management approaches.
Volume 2, 2011
What Is the Value of Security?
by Steven J. Ross, CISA, CISSP, MBCP
How much more is a secure company worth than an insecure one?
Volume 2, 2011
HelpSource Q&A
by Gan Subramaniam, CISA, CISM, CCNA, CCSA, CIA, CISSP, ISO 27001 LA, SSCP
What should be our approach to determining and reaching agreement on the optimal percentage of business operations that must be or can be recovered in the event of a crisis?
Volume 2, 2011
Value Assessment Tool for ICT Projects at the European Commission
by Stefka Dzhumalieva, Franck Noël and Sébastien Baudu
The Value Assessment Tool (VAST) of the European Commission is the subject of this article.
Volume 3, 2010
Building Your Bridge to the Future
by James Reed, FCIPD
The author discusses the effects of the economic crisis on an IT professionals career, providing tips and advice.
View All »

User Contributed External Links: 0 total

Wikis: 2 total

Blog Posts: 48 total

View All »
12 May 2012
Understanding the Business Environment the Key to Value-Add Auditing
Gone are the days of check list auditing (Tick and bash audit). To add value to business auditors need to go beyond check listing. Be it an application control review (ACR), IT General Controls Review (ITGCR), A project review or an integrated audit, i...
Posted By : Tichaona Zororo CISA, CISM, CRISC, CGEIT | 0 comments
8 May 2012
How do I become an IT Auditor?
During my audits, training & teaching sessions one of the frequent queries I came across is 'Sir, How do I become an IT Auditor? What are the qualification criteria?' The best answer for this to quote from the famous book, Information Systems Control and ...
Posted By : KvR | 0 comments
7 Mar 2012
Beware... the Chinese are coming... or should we say don't wait to install a telephone until you need to call 911.
So two things happened today. While talking about the need to get the business folks excited about IT Risk Management I used a simple analogy trying to relate to the usual perception, perhaps justifiably so, the business folks have, and that is, IT securi...
Posted By : Umesh391 | 0 comments
7 Mar 2012
Cloud Computing
To share various espects in cloud computing viz; history, availability, deployment, integrity, availability, confidentiality, security, cloud sharing etc.
Posted By : MoizB583519 | 2 comments
6 Mar 2012
SQL Injection story is 14 year old and still the monster is far from being tamed
On March 1st,  I was invited to speak at the CampIT conference on Enterprise Risk/Security Management at Rosemont Convention Center. Before me there were two speakers. The first presenter spent an hour presenting the story from the trenches of technolog...
Posted By : Umesh391 | 0 comments
2 Feb 2012
VENEZUELA, CURSOS CISM JUNIO 2011
Hola, se les informa a todos los interesados para los cursos de CISM en JUNIO 2.011, que los mismos comenzarán los siguientes días: 06FEB - 40 Hrs Grupo A 13FEB - 40 Hrs Grupo B 20FEB - 40 Hrs Grupo C Modalidad 16 Hrs intensivas y Presenciales (09:00 a...
Posted By : Alexander Osorio | 0 comments
View All »
Report An Issue