Support processes and resources are in place before a computerized system goes live; system administration tasks are listed, written down and governed by procedures, administrators are trained with evidence of competency retained, administration duties are generally segregated from operational processing duties, activities not covered by standard administration procedures go through operational change and configuration management, administrator privileges are assigned on the principle of least privilege to the limited number of people who need them, providers performing administration are bound by service level agreements or contracts to the same principles, and activities are documented. Tasks are commonly managed in IT tools that hold the instructions and records, or in procedures, work instructions, agreements or administration plans, and typically include user and administrator account management and review, housekeeping, backup and restoration, repair by replacing a part with an identical one or with a qualified equivalent, nonfunctional static data management, database tuning and capacity management and some security and performance monitoring. The system owner is accountable for the processes and procedures that keep the system used and maintained compliantly and ensures delegated tasks are identified and documented, and the administrator develops sufficiently detailed procedures, executes tasks in compliance with them and maintains the required records.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.