Canada ITSG-33 - IT Security Risk Management A2-4.1: 4.1 Maintain secure operations

What does A2-4.1 require?

Operations groups administer and maintain security according to the operations plan: assign operational security roles, train staff and users, perform periodic security maintenance, change security solutions for new requirements, threats, incidents and vulnerabilities, patch, and manage security configurations. Change requests describe their security impact; changes that raise residual risk trigger TRA and may need assessor impact assessments or a new project. Routine changes need impact assessment and operational approval; major changes also need authorizer approval and optionally an assessor's analysis; upgrades require security testing, a vulnerability assessment and an updated residual risk assessment.