Control Objectives: Periodic Review

All lifecycle deliverables/artefacts are documented.

Documented Backup & Restore procedures exist and are tested on a regular basis.

Process for accessing and retrieving of archived data exists (if required). NOTE: only applicable if data from this system is archived into an archive.

Documented Disaster Recovery procedures exist and are tested/exercised on a regular basis.

All key roles and responsiblities for the system are defined and assigned and are trained in the relevant CSV procedures. Key roles: - Business Process Owner - System Owner

Adequate Service Agreements are established with internal and external suppliers.

Training Requirements for the users prior to system access are defined

The applicable operational support processes & procedures are defined in the Validation/Qualification Registry and/or the Operational Support Plan

Problems are monitored and resolved following effective procedures.

Corrective actions from a previous Periodic Review, a Validation Report or performed internal audits and external inspections are followed up and closed

The IT Security Checklist attached to this control is completed

An Audit Trail review process exists and is executed, if needed based on a documented assessment.

Changes are implemented following effective procedures.

The performance and availability of the CS application, server(s), network, security, and other supporting infrastructure is monitored as part of day-to-day operations.

SRA kept up-to-date in regards to intended use of the system and resulting controls are implemented as needed.

User access of End-users and IT technical personnel, including privileged users, is reviewed on a regular basis.

User accounts and the associated permissions should be reviewed regularly