IT Release Management

206 ◾ Appendix G: Security Risk Assessment

17. If a third party is anticipated to be used, has a contract been signed already

with the third party?

( ) Yes ( ) No ( ) Not sure

[Enter description here.]

18. Will the third party require inbound access to the internal network? If so,

please indicate what will need to be accessible and the business justica-

tion. Has a ird Party Access Agreement been established, reviewed, and

approved by management?

( ) Yes ( ) No ( ) Not sure

[Enter description here.]

19. Will there be any anticipated reporting (transactional, management, audit,

regulatory) available within the system(s)? Please describe the overall review

processes. How often would this be performed and who would have the

responsibilit ...