System development controls

Definitions

System development controls

Policies and procedures designed to ensure that information systems are planned, designed, tested, and implemented in a way that promotes reliability, security, accuracy, and alignment with business requirements. These controls reduce the risk of errors, fraud, or system failures during the system development life cycle (SDLC).

These controls ensure that systems are designed and implemented with reliability and security in mind. This is directly linked to the system development life cycle (SDLC), a structured framework used to guide the development and maintenance of information systems.

The SDLC is discussed in more detail in CMA Part 1, Section F. The SDLC typically includes the following phases:

• Planning: Define objectives, scope, and resource requirements.
• Analysis: Gather and analyze user and system requirements.
• Design: Develop detailed system and process specifications.
• Development: Build or program the system according to design specifications.
• Testing: Verify system functionality, security, and accuracy.
• Deployment: Convert from the old system to the new one (e.g., parallel, phased, or direct cutover) and move it into production.
• Maintenance: Monitor, update, and improve the system as needed.

To ensure the integrity, security, and effectiveness of systems throughout these phases, the following key controls should be implemented:

• System authorization activities: Ensure that any system development or change is explicitly authorized by appropriate levels of management so that only justified, cost-effective projects consistent with organizational strategy proceed, and no unapproved changes reach production programs.
• User specification activities: Involve end users during the requirements-gathering phase to ensure that systems are designed to meet actual business needs.
• Technical design activities: Translate user requirements into detailed technical specifications to guide development.
• Internal audit participation: Include internal auditors in the design and review process to ensure that control requirements are adequately addressed.
• Program testing: Conduct rigorous testing to compare actual program performance against predetermined standards and identify issues prior to implementation.
• User test and acceptance procedure: Ensure users formally test the system and document the outcomes to support the final decision on deployment.
• Program change controls: Formally request, approve, test, and document every change to a production program; use version control to track who changed what and allow rollback; and keep development, test, and production environments separate so programmers cannot move untested code into production.

Example: Untested code reaches production

A programmer finishes a new feature and pushes it directly into the production system without going through the normal review process. Which controls would have caught this before it caused a problem?

Answer: Program testing would catch functional errors before release, the user acceptance procedure would confirm the system meets business needs, and program change controls — specifically the requirement that management authorize every change before it reaches production — would have blocked the unauthorized push entirely. Version control also lets the team pinpoint exactly what changed and roll it back if needed.

Physical access controls

Definitions

Physical access controls

Security measures designed to restrict unauthorized individuals from entering sensitive areas where critical IT infrastructure and data are stored, such as server rooms, data centers, communication hubs, and storage facilities.

Physical access controls can be preventive (they stop unauthorized entry before it happens) or detective (they identify that unauthorized entry occurred after the fact).

Effective physical access control measures include:

• Badge-based entry systems: Employees and authorized personnel are issued access cards or badges that grant entry to specific locations based on their role. These systems can log entries and exits for audit purposes.

• Biometric authentication: High-security areas may require fingerprint scans, facial recognition, or iris scans to verify the identity of individuals entering the premises.

• Surveillance systems (CCTV): Continuous monitoring through cameras deters unauthorized access and provides video evidence in case of a breach or incident.

• Security personnel: Trained guards can control access points, perform identity verification, and respond to incidents or alarms.

• Visitor logs and escorts: All non-employees must sign in and out, present valid identification, and be accompanied by authorized staff while inside secure areas.

Related physical safeguards (not access controls strictly speaking):

• Environmental controls: These include systems for fire suppression, temperature and humidity control, and backup power—designed to protect hardware from environmental threats.

• Secure hardware enclosures: Physical locking cabinets and racks within server rooms provide an additional layer of protection for critical equipment.

Example: Badge reader and CCTV in a server room

A data center uses a badge reader to control entry and a CCTV system to record who comes and goes. Which control prevents theft, and which one detects it?

Answer: The badge reader is preventive — it stops anyone without proper credentials from entering in the first place. CCTV is detective — it doesn’t stop the entry, but it creates a record that helps identify what happened and who was involved after the fact.

Implementing layered physical access controls reduces the risk of theft, vandalism, espionage, or tampering.