bitpie安卓最新版下载|itgc
ITGC - Wikipedia
ITGC - Wikipedia
Jump to content
Main menu
Main menu
move to sidebar
hide
Navigation
Main pageContentsCurrent eventsRandom articleAbout WikipediaContact usDonate
Contribute
HelpLearn to editCommunity portalRecent changesUpload file
Search
Search
Create account
Log in
Personal tools
Create account Log in
Pages for logged out editors learn more
ContributionsTalk
Contents
move to sidebar
hide
(Top)
1General Computer Controls
Toggle General Computer Controls subsection
1.1Global Technology Audit Guide (GTAG)
2See also
3References
4External links
Toggle the table of contents
ITGC
Add languages
Add links
ArticleTalk
English
ReadEditView history
Tools
Tools
move to sidebar
hide
Actions
ReadEditView history
General
What links hereRelated changesUpload fileSpecial pagesPermanent linkPage informationCite this pageGet shortened URLDownload QR codeWikidata item
Print/export
Download as PDFPrintable version
From Wikipedia, the free encyclopedia
This article is about IT general controls. For idle-time garbage collection, see Garbage collection (SSD).
For the International Thwaites Glacier Collaboration, see International Thwaites Glacier Collaboration.
This article relies excessively on references to primary sources. Please improve this article by adding secondary or tertiary sources. Find sources: "ITGC" – news · newspapers · books · scholar · JSTOR (January 2019) (Learn how and when to remove this template message)
IT general controls (ITGC) are controls that apply to all systems, components, processes, and data for a given organization or information technology (IT) environment. The objectives of ITGCs are to ensure the proper development and implementation of applications, as well as the integrity of programs, data files, and computer operations.
The most common ITGCs:
Logical access controls over infrastructure, applications, and data.
System development life cycle controls.
Program change management controls.
Data center physical security controls.
System and data backup and recovery controls.
Computer operation controls.
General Computer Controls[edit]
ITGCs may also be referred to as General Computer Controls (GCC) which are defined as:
Controls, other than application controls, which relate to the environment within which computer-based application systems are developed, maintained and operated, and which are therefore applicable to all applications. The objectives of general controls are to ensure the proper development and implementation of applications, the integrity of program and data files and of computer operations. Like application controls, general controls may be either manual or programmed. Examples of general controls include the development and implementation of an IS strategy and an IS security policy, the organization of IS staff to separate conflicting duties and planning for disaster prevention and recovery process.
Global Technology Audit Guide (GTAG)[edit]
GTAGs are written in straightforward business language to address a timely issue related to information technology (IT) management, control, and security. To date, the Institute of Internal Auditors (IIA) has released GTAGs on the following topics:
GTAG 1: Information Technology Controls
GTAG 2: Change and Patch Management Controls: Critical for Organizational Success
GTAG 3: Continuous Auditing: Implications for Assurance, Monitoring, and Risk Assessment
GTAG 4: Management of IT Auditing
GTAG 5: Managing and Auditing Privacy Risks
GTAG 6: Managing and Auditing IT Vulnerabilities
GTAG 7: Information Technology Outsourcing
GTAG 8: Auditing Application Controls
GTAG 9: Identity and Access Management
GTAG 10: Business Continuity Management
GTAG 11: Developing the IT Audit Plan
GTAG 12: Auditing IT Projects
GTAG 13: Fraud Prevention and Detection in the Automated World
GTAG 14: Auditing User-developed Applications
GTAG 15: Formerly Information Security Governance--Removed and combined with GTAG 17
GTAG 16: Data Analysis Technologies
GTAG 17: Auditing IT Governance
See also[edit]
Information technology controls
Internal Audit
Internal Control
SOX 404 top–down risk assessment
References[edit]
GTAG 8: Christine Bellino, Jefferson Wells, July 2007
GTAG 8: Steve Hunt, Enterprise Controls Consulting LP, Enterprise Controls Consulting LP, July 2007
ISACA Glossary of terms
External links[edit]
The Institute of Internal Auditors
Information Systems Audit and Control Association
Retrieved from "https://en.wikipedia.org/w/index.php?title=ITGC&oldid=1177755896"
Categories: AuditingInformation technology auditHidden categories: Articles lacking reliable references from January 2019All articles lacking reliable references
This page was last edited on 29 September 2023, at 11:16 (UTC).
Text is available under the Creative Commons Attribution-ShareAlike License 4.0;
additional terms may apply. By using this site, you agree to the Terms of Use and Privacy Policy. Wikipedia® is a registered trademark of the Wikimedia Foundation, Inc., a non-profit organization.
Privacy policy
About Wikipedia
Disclaimers
Contact Wikipedia
Code of Conduct
Developers
Statistics
Cookie statement
Mobile view
Toggle limited content width
Definition & Examples of IT General Controls (ITGC) - JumpCloud
Definition & Examples of IT General Controls (ITGC) - JumpCloud
Why JumpCloud
close ×
Why JumpCloud
Build the Foundation for a Unified Stack
JumpCloud's open directory platform makes it possible to unify your technology stack across identity, access, and device management, in a cost-effective manner that doesn't sacrifice security or functionality.
Avoid IT Sprawl
Use JumpCloud’s open directory platform to easily manage your entire tech stack while reducing the number of point solutions needed to keep things running smoothly.
Reduce Costs
JumpCloud's catalog of pre-built and open integration capabilities, on top of its robust feature set and easy-to-use interface, significantly reduces your total cost of IT.
Complete IT Coverage
Improve your security posture, easily achieve compliance, and get complete support for IT operations with the JumpCloud Directory Platform.
Solutions
close ×
Connect Your Employees ...
... to Any Resource
... from Any Location
... from a Trusted Device
... with One Secure Identity
... All from the Cloud
Modernize Active Directory
Start your journey of AD modernization with a flexible, cloud-first foundation.
Automate Onboarding and Offboarding
Control the access of incoming and outgoing employees to ensure permission accuracy at all times.
Streamline Access Management
Provide and manage user access to resources from a trusted device, including passwordless access via device biometric authenticators.
Security Without Complexity
Empower end users to use one secure identity and passwordless login flows to access all of their resources with JumpCloud.
Unify Your Stack
Centrally manage, secure, and unify identities and their access with JumpCloud's open directory platform.
Achieve and Maintain Compliance
View, manage, and ensure correct user access privileges across all connected resources using JumpCloud.
Phishing-Resistant Passwordless Login
JumpCloud Go™ enables fast, safe user authentication with a hardware-protected, phishing-resistant passwordless login approach.
Modernize Active Directory
Start your journey of AD modernization with a flexible, cloud-first foundation.
Enable Hybrid Work
Configure and secure remote devices, and connect hybrid users to all their digital resources, using JumpCloud.
Implement Zero Trust
Verify identities dynamically and control access with conditional policies no matter where users work.
Streamline Access Management
Provide and manage user access to resources from a trusted device, including passwordless access via device biometric authenticators.
Phishing-Resistant Passwordless Login
JumpCloud Go™ enables fast, safe user authentication with a hardware-protected, phishing-resistant passwordless login approach.
Modernize Active Directory
Start your journey of AD modernization with a flexible, cloud-first foundation.
Streamline Access Management
Provide and manage user access to resources from a trusted device, including passwordless access via device biometric authenticators.
Automate Onboarding and Offboarding
Simplify and automate identity lifecycle management tasks on Windows, Mac, Linux, and mobile devices.
Achieve and Maintain Compliance
View and manage all devices and operating systems used in your IT environment in the JumpCloud Console.
Phishing-Resistant Passwordless Login
JumpCloud Go™ enables fast, safe user authentication with a hardware-protected, phishing-resistant passwordless login approach.
Modernize Active Directory
Start your journey of AD modernization with a flexible, cloud-first foundation.
Security Without Complexity
Empower end users to use one secure identity and passwordless login flows to access all of their resources with JumpCloud.
Unify Your Stack
Securely manage identities, access, and devices in one core platform to create a seamless experience.
Implement Zero Trust
Ensure that only the correct core identities can access the resources they need with layered security.
Achieve and Maintain Compliance
Ensure that only correct and verified identities can access your organization’s resources with JumpCloud.
Phishing-Resistant Passwordless Login
JumpCloud Go™ enables fast, safe user authentication with a hardware-protected, phishing-resistant passwordless login approach.
Modernize Active Directory
Start your journey of AD modernization with a flexible, cloud-first foundation.
Build a Cloud-First Directory
Build your JumpCloud open directory instance from the ground up with full identity, access, and device management.
Unify Your Stack
Centrally manage and unify your people, processes, and technology with JumpCloud's open directory platform.
Phishing-Resistant Passwordless Login
JumpCloud Go™ enables fast, safe user authentication with a hardware-protected, phishing-resistant passwordless login approach.
... to Any Resource
Modernize Active Directory
Automate Onboarding and Offboarding
Streamline Access Management
Security Without Complexity
Unify Your Stack
Achieve and Maintain Compliance
Phishing-Resistant Passwordless Login
... from Any Location
Modernize Active Directory
Enable Hybrid Work
Implement Zero Trust
Streamline Access Management
Phishing-Resistant Passwordless Login
... from a Trusted Device
Modernize Active Directory
Streamline Access Management
Automate Onboarding and Offboarding
Achieve and Maintain Compliance
Phishing-Resistant Passwordless Login
... with One Secure Identity
Modernize Active Directory
Security Without Complexity
Unify Your Stack
Implement Zero Trust
Achieve and Maintain Compliance
Phishing-Resistant Passwordless Login
... All from the Cloud
Modernize Active Directory
Build a Cloud-First Directory
Unify Your Stack
Phishing-Resistant Passwordless Login
Platform
close ×
Platform
Identity Management
Access Management
Device Management
Centralized Identity Control
Cloud Directory
Centrally secure and manage core user identities, with robust access and device control.
Identity Lifecycle Management
Create, update, and revoke user identities and access from a unified open directory platform.
Security and Compliance
Multi-Factor Authentication
Keep users and resources safe by layering native MFA onto every identity in your directory.
Conditional Access
Enforce dynamic security measures to protect identities without hurting the user experience.
Password Manager
Create, store, manage, and protect users' passwords for a secure and intuitive experience.
Integrations
HRIS
Easily import identities from your HR system to simplify and automate identity management.
API Services
Develop custom workflows and perform specialized tasks at scale through an extensible API framework.
Authentication Services
Single Sign-On
Give users frictionless access to all resources via one secure identity. Add passwordless login via JumpCloud Go.
Cloud LDAP
Provide users with easy access to on-prem resources via LDAP, without standing up endpoints.
Cloud RADIUS
Support centralized authentication to Wi-Fi networks and VPNs with no hardware requirements.
Security and Compliance
Multi-Factor Authentication
Secure digital resources, and prevent unauthorized login attempts by enforcing MFA everywhere.
Password Manager
Simplify access workflows by empowering users to securely store and manage their passwords.
Conditional Access
Enforce dynamic security measures to protect your digital resources and improve access control.
Directory Insights
Centrally view directory data for more simplified troubleshooting and compliance monitoring.
Integrations
Application Catalog
Easily provide users with access to the resources they need via our pre-built application catalog.
API Services
Develop custom workflows and perform specialized tasks at scale through an extensible API framework.
Management Protocols
Cross-OS Device Management
Securely and centrally manage your entire fleet — including Windows, macOS, and Linux devices.
Mobile Device Management
Easily enroll and manage mobile devices from the same pane of glass as the rest of your fleet.
Remote Access
Establish secure, direct connections to troubleshoot end user devices.
Security and Compliance
Multi-Factor Authentication
Ensure that only authorized users are able to access company devices by requiring MFA at login.
Conditional Access
Enforce dynamic security measures on all devices to protect them and the resources they house.
Patch Management
Improve device security posture with automated patching schedules and complete version control.
System Insights
Get visibility into device-level events to easily identify issues and minimize security risk.
OS Support
Windows Management
Manage Windows desktops and servers.
Apple MDM
Manage Macs, iPhones, and iPads.
Linux Management
Manage Linux desktops and servers.
Android EMM
Manage BYOD and COD devices.
Identity Management
Centralized Identity Control
Cloud Directory
Identity Lifecycle Management
Security and Compliance
Multi-Factor Authentication
Conditional Access
Password Manager
Integrations
HRIS
API Services
Access Management
Authentication Services
Single Sign-On
Cloud LDAP
Cloud RADIUS
Security and Compliance
Multi-Factor Authentication
Password Manager
Conditional Access
Directory Insights
Integrations
Application Catalog
API Services
Device Management
Management Protocols
Cross-OS Device Management
Mobile Device Management
Remote Access
Security and Compliance
Multi-Factor Authentication
Conditional Access
Patch Management
System Insights
OS Support
Windows Management
Apple MDM
Linux Management
Android EMM
Pricing
Partners
close ×
Partners
Become a Partner
Existing Partners
Find a Partner
Technology Partners
Partner Ecosystem
JumpCloud for MSPs™
Efficiently secure and manage all of your clients from a central open directory platform.
Value-Added Resellers
Enhance your value-added services with a full suite of IT and Security solutions.
Value-Added Distributors
Enhance your portfolio with a full suite of IT and Security solutions.
Case Studies
Read how existing partners have made their clients successful through JumpCloud.
Features and Services
Multi-Tenant Management
Get seamless access to your clients' resources, networks, and endpoints from one interface.
Professional Services for MSPs
Leverage professional services from JumpCloud experts tailored for MSPs.
Get Connected
Become a Partner
Join our growing network of partners to accelerate your business and empower your clients.
Get Started
For Partners
News and Announcements
View resources, news, and support options that are specifically curated for JumpCloud partners.
Resource Hub for Partners
Find and engage with useful resources to inspire and guide your open directory journey.
JumpCloud University
Access comprehensive learning materials and certification opportunities built for partners.
Case Studies
Read how fellow partners found success through their partnership with JumpCloud.
JumpCloud Community
Create and join discussions with other MSPs and JumpCloud experts.
Partner Blogs
Read about shifting trends in IT and security, industry news, best practices, and much more.
Case Studies
Read how fellow partners found success through their partnership with JumpCloud.
JumpCloud Community
Create and join discussions with other MSPs and JumpCloud experts.
Partner Blogs
Read about shifting trends in IT and security, industry news, best practices, and much more.
Get Connected
Register a Deal
Have a new client opportunity? Connect with your JumpCloud rep today.
Login to your MTP
Connect with your JumpCloud Rep
For Partners
Technology Partners
Collaborate with us to become part of our open directory ecosystem as a technology partner.
Integration Catalog
Easily provide users with access to the resources they need via our pre-built application catalog.
Get Started
Add Your App to JumpCloud
Submit a request to our team to be incorporated into our preconfigured SSO applications list.
Become a Partner
Partner Ecosystem
JumpCloud for MSPs™
Value-Added Resellers
Value-Added Distributors
Case Studies
Features and Services
Multi-Tenant Management
Professional Services for MSPs
Get Connected
Become a Partner
Get Started
Existing Partners
For Partners
News and Announcements
Resource Hub for Partners
JumpCloud University
Case Studies
JumpCloud Community
Partner Blogs
Case Studies
JumpCloud Community
Partner Blogs
Get Connected
Register a Deal
Login to your MTP
Connect with your JumpCloud Rep
Find a Partner
Technology Partners
For Partners
Technology Partners
Integration Catalog
Get Started
Add Your App to JumpCloud
Resources
close ×
Resources
Engage
Learn
Support
Demo
Watch our demo video or sign up for a live demo of JumpCloud's open directory platform.
Weekly Product Demo
Attend our live weekly demo to learn about the JumpCloud Open Directory Platform from our experts.
Community
Create a new thread or join an existing discussion with JumpCloud experts and other users.
The IT Hour
Join us each Friday as we discuss curated community topics that admins face every day.
Webinars
Watch our webinars to get a deeper understanding of JumpCloud and trending IT topics.
Events
Learn how JumpCloud can fit into your tech strategy by attending one of our events.
Guided Product Simulations
Learn how to use the JumpCloud Directory Platform by exploring our hands-on simulations.
Resource Hub
Find and engage with useful resources to inspire and guide your open directory journey.
Blog
Read about shifting trends in IT and security, industry news, best practices, and much more.
JumpCloud University
Get access to comprehensive learning materials and certification opportunities in JCU.
YouTube Channel
Watch videos to learn more about JumpCloud's capabilities, how to use the platform, and more.
Case Studies
Learn how different organizations use JumpCloud to reduce costs, unify their tech, and more.
Support Site
Use our comprehensive support site to find technical information about JumpCloud's capabilities.
Professional Services
Get personalized attention and support while you implement and use the JumpCloud Directory Platform.
JumpCloud Lounge on Slack
Join conversations in Slack and get quick JumpCloud support from experts and other users.
Engage
Demo
Weekly Product Demo
Community
The IT Hour
Webinars
Events
Guided Product Simulations
Learn
Resource Hub
Blog
JumpCloud University
YouTube Channel
Case Studies
Support
Support Site
Professional Services
JumpCloud Lounge on Slack
Login
Search
Language
United States (English)
France (Français)
Spain (Español)
Get Started
Contact Us
Request a Demo
Contact Sales
Weekly Live Demo
What Are IT General Controls (ITGC)?
Written by
Kelsey Kinzer on August 23, 2023
Blog Home >
Remote Work > What Are IT General Controls (ITGC)?
Share This Article
Whether employees know it or not, IT has a tremendous effect on their everyday working lives.
IT is essentially the lifeblood of a company, ensuring employees’ laptops work, procuring and installing the applications employees need to do their jobs, and instituting and upholding rules to help the company stay compliant.
But how does the IT team accomplish those tasks in a standardized, secure way?
The answer lies in IT general controls. IT general controls, or ITGCs, are a set of directives that govern how an organization’s systems operate. Yet, knowing what ITGCs are and how they work in practice isn’t always straightforward.
In this post, we’ll explain what ITGCs are, share examples of how they work in practice, and review the compliance frameworks that serve as their foundation.
Definition of IT General Controls (ITGC)
ITGC, or IT general controls, are a set of policies and procedures that govern how a company’s IT systems operate and ensure the confidentiality, integrity, and availability of data.
These controls help prevent unauthorized access, data breaches, and operational disruptions. ITGC covers every aspect of IT, including software implementation, user account creation, and data management. Effective ITGC can improve the reliability and accuracy of financial reporting and reduce the risk of fraud. Companies are required to establish and maintain ITGC to comply with various regulatory requirements such as SOX, HIPAA, and PCI DSS.
One important thing to note is that Information Technology General Controls are not the same as application controls. ITGCs govern the use of all systems within a company, from ERPs to servers, directory platforms, and project management tools. Application controls restrict what users can do within one particular platform, and typically these permissions are configured directly within that application and pertain to specific features or use cases.
Importance of ITGC in Organizations
IT general controls are non-negotiable for companies that access, store, and leverage consumer data — particularly sensitive information, such as healthcare, financial, and personal records.
Without ITGC, companies are at a high risk of cybersecurity attacks and regulatory noncompliance, jeopardizing their ability to build trust with customers and sustain regular business operations. Proper ITGC implementation reduces the chances of an internal or external breach and noncompliance, protecting your organization’s reputation and safeguarding your customers’ information.
Examples and Key Components of ITGC
ITGCs can take on many forms, but most fall under a few distinct categories. Let’s review each in detail.
Access Controls
ITGCs should include various methods of preventing unauthorized access and data manipulation. Coupling robust password management with a least-privilege access policy can instantly lower the chances of a cyberattack. Full disk encryption is also a common access-related ITGC because it completely locks devices, even while at rest. So if a device is stolen, the hard drive cannot be accessed without the proper recovery key. Access-related ITGCs may also entail quarterly or annual inventory audits to pinpoint the most valuable data and reevaluate the controls designed to protect it.
Change Management
IT environments are always changing; new applications are added, others are removed, and some are updated to the newest release. Change management controls help companies document and authorize changes and perform a root cause analysis if something goes wrong. Most regulatory bodies dedicate an entire section of their audit to the effectiveness of your change management processes.
Data Backup and Recovery
Accidents, natural disasters, or cyberattacks can happen anytime, and without backup or recovery plans in place, companies can lose significant data. Most companies enact ITGCs to minimize data loss through database segregation, automated backups, and business continuity plans. ITGCs may also incorporate regular testing of these configurations and plans to confirm their effectiveness and make adjustments as needed.
Security Management
When we think of hackers, we often think of a person behind a computer, but that’s not always the case. Unfortunately, people with ill-intent enter an office to wreak havoc, so it’s important to define and consistently test physical security controls, like key badge entry to sensitive areas and intrusion detection systems.
IT Operation Controls
General IT controls may refer to how IT systems are managed, who oversees those systems, where the IT roadmap is going, how and when to conduct risk assessments, and what best practices IT projects should follow.
ITGCs in this group may also refer to overall security measures like email filtering, firewalls, antivirus software, and routine pen testing. In this age of remote work, general IT administration may apply to corporate-owned device (COD) and bring your own device (BYOD) policies as well.
Implementation of ITGC
Implementing multiple ITGCs at once can feel overwhelming. Breaking them down into more manageable pieces makes the process easier and decreases the chances of misconfiguration.
Planning and Scoping
First, you need to decide what types of IT general controls you want and need to implement. Consider what type of industry you’re in, what types of data you collect, store, and use, and where your customers are located.
Once you’ve narrowed down which ITGCs you want to achieve, estimate how long it will take to implement them. If you have a targeted end date, work backward to create a reasonable timeline for implementation, given the number of resources on your IT team, the existing tasks on their plate, and/or the bandwidth of your managed service provider (MSP).
Risk Assessment
Next, establish a baseline for each control. That involves an in-depth review of your current IT processes and tools to understand the controls you are already managing well and any additional security measures you may need to incorporate into your plan. Prioritize these new additions based on importance and inclusion in any upcoming audits you may need to pass.
Control Design and Implementation
Now that you know what controls you need, it’s time to start thinking about how to put those controls into practice. Controls can be proactive or reactive, and as their names suggest, proactive controls attempt to prevent adverse events or impacts, while reactive controls are corrective mechanisms when something goes wrong. Using proactive and reactive controls for each key area of your security program can help you cover your bases.
While some ITGC are fairly universal and straightforward, some organizations may have more complex requirements based on the type of product they sell or services they offer. Working with an experienced auditing firm can help you design and customize the proper controls for your company.
Control Testing
Testing is critical. Be sure to thoroughly test each and every ITGC to verify that it accomplishes what it was designed to do. It’s a good idea to have several people test the same ITGC with different profiles to identify any abnormalities in how the control functions.
Ongoing Monitoring
ITGC is not a one-and-done exercise. Be sure you have a process in place for continuously monitoring the controls you’ve implemented and fix any bugs or gaps as quickly as possible.
ITGC Compliance Frameworks
ITGC is a subsection of the larger IT controls space. To guarantee the highest level of compliance, companies lean on three overarching security frameworks to inform their ITGCs.
COSO
The Committee of Sponsoring Organizations (COSO) framework integrates controls into everyday business processes that validate ethical and transparent operations. COSO has five requirements:
Control environments to uphold industry-standard practices and reduce organizations’ legal exposure.
Control activities to make sure tasks are carried out in a way that minimizes risk and accomplishes business objectives.
Information and communications that help stakeholders understand and comply with legal requirements, such as privacy regulations.
Monitoring by internal and/or external auditors to ensure employees are following existing controls.
Risk assessment and management to identify and mitigate as many risks as possible.
While these components are fairly vague, COSO has published detailed requirements for ESG, AI, and cloud computing-focused companies to observe corresponding regulations in those fields.
COBIT
The IT Governance Institute established the Control Objectives for Information Technology (COBIT) framework to outline recommended ITGC objectives and approaches. The basic premise behind COBIT is that IT processes should satisfy specific business requirements to streamline operations and safeguard enterprise data. The five key COBIT principles are:
Meeting stakeholder needs.
Covering the enterprise end to end.
Applying a single integrated framework.
Enabling a holistic approach.
Separating governance from management.
In the United States, the COBIT framework is used to achieve compliance with the Sarbanes-Oxley Act (SOX).
ISO
ISO 27001 is a framework related to information security and change management. More specifically, ISO 27001 sets out policies and procedures to lessen the legal, physical, and technical risks associated with implementing, monitoring, reviewing, maintaining, and improving an information security management system. ISO 27001 uses a top-down approach, with six steps to attain compliance:
Define a security policy.
Define the scope of the information security management system.
Conduct a risk assessment.
Manage identified risks.
Select control objectives and controls to be implemented.
Prepare a statement of applicability.
By following ISO 27001 conditions, companies show customers that they take security seriously and conform to industry standards.
Security Concerns with ITGC
IT general controls lessen a company’s exposure to threats and potential compliance violations that can have devastating consequences on operations, reputation, and revenue.
Insider Threats
Employees, partners, vendors, interns, and contractors can all be weak links in your company’s security. They may unwittingly fall for a social engineering attack or accidentally share classified information. Some may even intentionally create a user account without proper permissions to access confidential files or steal company IP to get ahead in a new role elsewhere. ITGCs that limit and monitor data movement can prevent malicious — and unintentional — insider threats.
External Threats
The volume of cyberattacks isn’t showing signs of slowing. Hackers are constantly brainstorming new ways to access company data, whether it be through vulnerabilities in business applications, lateral movement, spreading ransomware, taking advantage of poor password management, or employee manipulation. Monitoring audit logs, installing antivirus software, and automatically installing updates are all ways to thwart external threats.
Compliance with Regulations
Most modern businesses must comply with at least one federal or global regulation. ITGC helps companies adhere to those rules and maintain compliance over time, avoiding hefty penalties that can result from noncompliance.
Benefits of ITGC
IT general controls give companies more than peace of mind. Let’s take a look at several concrete ways ITGC benefit an organization.
Improved Security
Security is one of the main purposes of instituting IT general controls. Observing security frameworks will force your organization team to adopt identity and access management (IAM) based on Zero Trust security principles, robust monitoring, encryption, and antimalware — all of which keep your data and your client’s data safe.
Better Risk Management
ITGC inherently mitigate the risk of insider and external threats by locking down end points like laptops, kiosks, and mobile devices, eliminating vulnerabilities in the applications people use every day, maintaining IAM best practices, and educating employees on the signs of a possible cyberattack.
Increased Compliance with Regulations
By leveraging frameworks like COSO, COBIT, and ISO 27001, companies can adequately prepare for an initial security and compliance audit. Perhaps more importantly, routinely reviewing and amending IT policies and best practices helps companies uphold industry mandates and standards over time.
Enhanced Business Continuity
During a security breach, everyday business tasks screech to a halt. In the days it takes companies to get the organization back up and running, they can lose hundreds of thousands of dollars in sales and productivity. Having ITGC in place reduces a company’s exposure to vulnerabilities, leaks, and other cyber threats that can interrupt business activity and hurt profitability.
Best Practices for ITGC Security
Bolstering organizational security should be at the top of IT teams’ priority lists. Here are a few best practices to consider:
Employee training: Cyberattackers know that one misinformed employee can be the key to organization access and specifically design campaigns to get them to give up information. Making employees aware of cyber threats with regular security training, regularly testing their knowledge, and notifying them of new phishing or social engineering techniques can decrease the chances of a full-blown attack.
Implementing key security frameworks: Following COSO, COBIT, and ISO 27001 principles align your company’s practices with globally-defined security standards, helping you prepare for compliance audits, certifications, and other necessary requirements for enterprise and government work.
Making continuous updates: There’s a reason why applications, systems, and networks have updates 一 releases contain new features or patch existing vulnerabilities. When users don’t regularly update their programs, they do themselves a disservice and put their companies at risk of an attack. That’s why many ITGCs force regular updates and consistently monitor their organization’s applications, systems, and network service-level commitments.
Weaving ITGC into procurement: Ask vendors to supply a Service Organization Controls Report (SOC) and assess whether extra controls are required to keep data safe and secure. It’s also a good idea to implement patch management tools that automatically deploy patches to operating systems, browsers, and applications that are behind schedule.
How JumpCloud Can Strengthen Your IT General Controls
ITGCs are essential for any business, but especially for enterprise organizations. Without ITGCs, companies of all sizes struggle with compliance, operational, and security issues. Not only do these problems drain IT departments of their time and energy, they also put businesses’ reputations at risk. Enacting ITGCs keeps everyone on track, forcing them to uphold and work from a single source of truth while protecting an organization’s invaluable data.
But developing and sustaining them is easier said than done. Fortunately, JumpCloud’s capabilities make IT control management a breeze. Working from a “trust nothing, verify everything” principle, JumpCloud’s Zero Trust security model allows IT teams to oversee user access to applications, files, networks, devices, and more, all from an open directory platform. JumpCloud is easy to implement, works with existing multi-factor authentication (MFA) protocols companies may already have, and helps meet SOC, HIPAA, GDPR, and PCI compliance requirements.
Learn more about JumpCloud’s approach to compliance today.
Remote WorkUnification
Security
Build the Foundation for a Unified Stack
Reduce IT costs and complexity
Kelsey Kinzer
Kelsey is a passionate storyteller and Content Writer at JumpCloud. She is particularly inspired by the people who drive innovation in B2B tech. When away from her screen, you can find her climbing mountains and (unsuccessfully) trying to quit cold brew coffee.
Continue Learning with Related Posts
Visit the Search Page
Continue Learning with our Newsletter
USA: +1.855.212.3122
UK: +44.20.4571.9942
Review Pricing
Platform
API Services
Cloud Directory
Cloud LDAP
Cloud RADIUS
Conditional Access
Device Management
Directory Insights
HRIS
Mobile Device Management
Multi-Factor Authentication
Password Manager
Patch Management
Remote Access
Single Sign-On
System Insights
User Lifecycle Management
Solutions
Achieve and Maintain Compliance
Automate Onboarding and Offboarding
Build a Cloud-First Directory
Enable Hybrid Work
Implement Zero Trust
Modernize Active Directory
Phishing-Resistant Passwordless Login
Streamline Access Management
Security Without Complexity
Unify Your Stack
Partners
MSP
Multi-Tenant Portal
Existing Partners
Global Partners
Technology Partners
Value-Added Distributors
Value-Added Resellers
Resources
Resource Hub
Events
Webinars
Blog
Demo
Guided Product Simulations
Case Studies
Community
JumpCloud University
About Us
About JumpCloud
Leadership
Co-Founders
Careers
Press Page
Awards and Recognition
Contact
Support
Contact Support
Professional Services
Technical Documentation
Status
Weekly Product Demo
Privacy Policy
Trust
Legal
Security
GDPR
Patents
Your Privacy Choices
© JumpCloud Inc. All rights reserved. 2024
Various trademarks held by their respective owners.
Cookie Settings
www.sailpoint.com | 502: Bad gateway
www.sailpoint.com | 502: Bad gateway
Bad gateway
Error code 502
Visit cloudflare.com for more information.
2024-03-12 20:50:47 UTC
You
Browser
Working
Hong Kong
Cloudflare
Working
www.sailpoint.com
Host
Error
What happened?
The web server reported a bad gateway error.
What can I do?
Please try again in a few minutes.
Cloudflare Ray ID: 8636a8943f37e686
•
Your IP:
Click to reveal
49.157.13.121
•
Performance & security by Cloudflare
Information technology controls - Wikipedia
Information technology controls - Wikipedia
Jump to content
Main menu
Main menu
move to sidebar
hide
Navigation
Main pageContentsCurrent eventsRandom articleAbout WikipediaContact usDonate
Contribute
HelpLearn to editCommunity portalRecent changesUpload file
Search
Search
Create account
Log in
Personal tools
Create account Log in
Pages for logged out editors learn more
ContributionsTalk
Contents
move to sidebar
hide
(Top)
1IT general controls (ITGC)
2IT application controls
3IT controls and the CIO/CISO
4Internal control frameworks
Toggle Internal control frameworks subsection
4.1COBIT (Control Objectives for Information Technology)
4.2COSO
5IT controls and the Sarbanes-Oxley Act (SOX)
Toggle IT controls and the Sarbanes-Oxley Act (SOX) subsection
5.1Real-time disclosure
6See also
7References
Toggle the table of contents
Information technology controls
1 language
العربية
Edit links
ArticleTalk
English
ReadEditView history
Tools
Tools
move to sidebar
hide
Actions
ReadEditView history
General
What links hereRelated changesUpload fileSpecial pagesPermanent linkPage informationCite this pageGet shortened URLDownload QR codeWikidata item
Print/export
Download as PDFPrintable version
From Wikipedia, the free encyclopedia
All
Information technology controls (or IT controls) are specific activities performed by persons or systems to ensure that computer systems operate in a way that minimises risk. They are a subset of an organisation's internal control. IT control objectives typically relate to assuring the confidentiality, integrity, and availability of data and the overall management of the IT function. IT controls are often described in two categories: IT general controls (ITGC) and IT application controls. ITGC includes controls over the hardware, system software, operational processes, access to programs and data, program development and program changes. IT application controls refer to controls to ensure the integrity of the information processed by the IT environment. Information technology controls have been given increased prominence in corporations listed in the United States by the Sarbanes-Oxley Act. The COBIT Framework (Control Objectives for Information Technology) is a widely used framework promulgated by the IT Governance Institute, which defines a variety of ITGC and application control objectives and recommended evaluation approaches.
IT general controls (ITGC)[edit]
ITGC represent the foundation of the IT control structure. They help ensure the reliability of data generated by IT systems and support the assertion that systems operate as intended and that output is reliable. ITGC usually include the following types of controls:
Control environment, or those controls designed to shape the corporate culture or "tone at the top."
Change management procedures - controls designed to ensure the changes meet business requirements and are authorized.
Source code/document version control procedures - controls designed to protect the integrity of program code
Software development life cycle standards - controls designed to ensure IT projects are effectively managed.
Logical access policies, standards and processes - controls designed to manage access based on business needs.
Incident management policies and procedures - controls designed to address operational processing errors.
Problem management policies and procedures - controls designed to identify and address the root cause of incidents.
Technical support policies and procedures - policies to help users perform more efficiently and report problems.
Hardware/software configuration, installation, testing, management standards, policies, and procedures.
Disaster recovery/backup and recovery procedures, to enable continued processing despite adverse conditions.
Physical security - controls to ensure the physical security of information technology from individuals and from environmental risks.
IT application controls[edit]
IT application or program controls are fully automated (i.e., performed automatically by the systems) and designed to ensure the complete and accurate processing of data, from input through output. These controls vary based on the business purpose of the specific application. These controls may also help ensure the privacy and security of data transmitted between applications. Categories of IT application controls may include:
Completeness checks - controls that ensure all records were processed from initiation to completion.
Validity checks - controls that ensure only valid data is input or processed.
Identification - controls that ensure all users are uniquely and irrefutably identified.
Authentication - controls that provide an authentication mechanism in the application system.
Authorization - controls that ensure only approved business users have access to the application system.
Input controls - controls that ensure data integrity fed from upstream sources into the application system.
Forensic controls - control that ensures data is scientifically correct and mathematically correct based on inputs and outputs
IT controls and the CIO/CISO[edit]
An organization's Chief Information Officer or Chief Information Security Officer is typically responsible for the security, accuracy and the reliability of the systems that manage and report the company's data, including financial data.
Internal control frameworks[edit]
COBIT (Control Objectives for Information Technology)[edit]
COBIT is a widely utilized framework containing best practices for the governance and management of information and technology, aimed at the whole enterprise. It consists of domains and processes. The basic structure indicates that IT processes satisfy business requirements, which are enabled by specific IT activities. COBIT defines the design factors that should be considered by the enterprise to build a best-fit governance system. COBIT addresses governance issues by grouping relevant governance components into governance and management
objectives that can be managed to the required capability levels.[1]
COSO[edit]
The Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies five components of internal control: control environment, risk assessment, control activities, information and communication and monitoring, that need to be in place to achieve financial reporting and disclosure objectives; COBIT provides similar detailed guidance for IT, while the interrelated Val IT concentrates on higher-level IT governance and value-for-money issues. The five components of COSO can be visualized as the horizontal layers of a three-dimensional cube, with the COBIT objective domains applying to each individually and in aggregate. The four COBIT major domains are: plan and organize, acquire and implement, deliver and support, and monitor and evaluate.
IT controls and the Sarbanes-Oxley Act (SOX)[edit]
SOX (part of United States federal law) requires the chief executive and chief financial officers of public companies to attest to the accuracy of financial reports (Section 302) and require public companies to establish adequate internal controls over financial reporting (Section 404). Passage of SOX resulted in an increased focus on IT controls, as these support financial processing and therefore fall into the scope of management's assessment of internal control under Section 404 of SOX.
The COBIT framework may be used to assist with SOX compliance, although COBIT is considerably wider in scope. The 2007 SOX guidance from the PCAOB[2] and SEC[3] state that IT controls should only be part of the SOX 404 assessment to the extent that specific financial risks are addressed, which significantly reduces the scope of IT controls required in the assessment. This scoping decision is part of the entity's SOX 404 top-down risk assessment. In addition, Statements on Auditing Standards No. 109 (SAS109)[4] discusses the IT risks and control objectives pertinent to a financial audit and is referenced by the SOX guidance.
IT controls that typically fall under the scope of a SOX 404 assessment may include:
Specific application (transaction processing) control procedures that directly mitigate identified financial reporting risks. There are typically a few such controls within major applications in each financial process, such as accounts payable, payroll, general ledger, etc. The focus is on "key" controls (those that specifically address risks), not on the entire application.
IT general controls that support the assertions that programs function as intended and that key financial reports are reliable, primarily change control and security controls;
IT operations controls, which ensure that problems with the processing are identified and corrected.
Specific activities that may occur to support the assessment of the key controls above include:
Understanding the organization’s internal control program and its financial reporting processes.
Identifying the IT systems involved in the initiation, authorization, processing, summarization and reporting of financial data;
Identifying the key controls that address specific financial risks;
Designing and implementing controls designed to mitigate the identified risks and monitoring them for continued effectiveness;
Documenting and testing IT controls;
Ensuring that IT controls are updated and changed, as necessary, to correspond with changes in internal control or financial reporting processes; and
Monitoring IT controls for effective operation over time.
To comply with Sarbanes-Oxley, organizations must understand how the financial reporting process works and must be able to identify the areas where technology plays a critical part. In considering which controls to include in the program, organizations should recognize that IT controls can have a direct or indirect impact on the financial reporting process. For instance, IT application controls that ensure the completeness of transactions can be directly related to financial assertions. Access controls, on the other hand, exist within these applications or within their supporting systems, such as databases, networks, and operating systems, which are equally important, but do not directly align to a financial assertion. Application controls are generally aligned with a business process that gives rise to financial reports. While there are many IT systems operating within an organization, Sarbanes-Oxley compliance only focuses on those that are associated with a significant account or related business process and mitigate specific material financial risks. This focus on risk enables management to significantly reduce the scope of IT general control testing in 2007 relative to prior years.
Section
Title
Description
302
Corporate Responsibility for Financial Reports
Certifies that financial statement accuracy and operational activities have been documented and provided to the CEO and CFO for certification
404
Management Assessment of Internal Controls
Operational processes are documented and practiced demonstrating the origins of data within the balance sheet. SOX Section 404 (Sarbanes-Oxley Act Section 404) mandates that all publicly traded companies must establish internal controls and procedures for financial reporting and must document, test and maintain those controls and procedures to ensure their effectiveness.
409
Real-time Issuer Disclosures
Public companies must disclose changes in their financial condition or operations in real time to protect investors from delayed reporting of material events
802
Criminal Penalties for Altering Documents
Requires public companies and their public accounting firms to retain records, including electronic records that impact the company’s assets or performance.
Fines and imprisonment for those who knowingly and willfully violates this section with respect to (1) destruction, alteration, or falsification of records in federal investigations and bankruptcy and (2) destruction of corporate audit records.
Real-time disclosure[edit]
Section 409 requires public companies to disclose information about material changes in their financial condition or operations on a rapid basis. Companies need to determine whether their existing financial systems, such as enterprise resource management applications are capable of providing data in real-time, or if the organization will need to add such capabilities or use special software to access the data. Companies must also account for changes that occur externally, such as changes by customers or business partners that could materially impact their own financial positioning (e.g. key customer/supplier bankruptcy and default).
To comply with Section 409, organizations should assess their technological capabilities in the following categories:
Availability of internal and external portals - Portals help route and identify reporting issues and requirements to investors and other relevant parties. These capabilities address the need for rapid disclosure.
Breadth and adequacy of financial triggers and alert - The organization sets the trip wires that will kick off a Section 409 disclosure event.
Adequacy of document repositories – Repositories play a critical role for event monitoring to assess disclosure needs and provide mechanism to audit disclosure adequacy.
Capacity to be an early adopter of Extensible Business Reporting Language (XBRL) – XBRL will be a key tool to integrate and interface transactional systems, reporting and analytical tools, portals and repositories.
See also[edit]
Continuous Auditing
Data governance
Information technology audit
IT risk
IT risk management
Public Company Accounting Oversight Board
References[edit]
^ COBIT 2019, Governance and Management objectives, p.9
^ PCAOB Auditing Standard No 5
^ SEC Interpretive Guidance
^ "AICPA Statement on Auditing Standards No. 109" (PDF). Archived from the original (PDF) on 2008-04-07. Retrieved 2007-09-01.
Coe, Martin J. "Trust services: a better way to evaluate I.T. controls: fulfilling the requirements of section 404." Journal of Accountancy 199.3 (2005): 69(7).
Chan, Sally, and Stan Lepeak. "IT and Sarbanes-Oxley." CMA Management 78.4 (2004): 33(4).
Goodwin, Bill. "IT should lead on Sarbanes-Oxley." Computer Weekly 27 April 2004: p5.
Gomolski, Barbara. "The top five issues for CIOs." Computerworld January 2004: 42(1).
Hagerty, John. "Sarbanes-Oxley Is Now a Fact of Business Life-Survey indicates SOX IT-compliance spending to rise through 2005." VARbusiness Nov. 15 2004: 88.
Altiris.com
"IT Control Objectives for Sarbanes Oxley: The Importance of IT in the Design, Implementation, and Sustainability of Internal Control over Disclosures and Financial Reporting." itgi.org. April 2004. IT Governance Institute. 12 May 2005
Johnston, Michelle. "Executing an IT Audit for Sarbanes-Oxley Compliance." informit.com. 17 September 2004
"Importance of Monitoring IT General Controls and IT Application Controls." [1]. 30 may 2022
Lurie, Barry N. "Information technology and Sarbanes-Oxley compliance: what the CFO must understand." Bank Accounting and Finance 17.6 (2004): 9 (5).
McCollum, Tim. "IIA Seminar Explores Sarbanes-Oxley IT Impact." IT Audit 6 (2003).
McConnell Jr., Donald K, and George Y. Banks. "How Sarbanes-Oxley Will Change the Audit Process." aicpa.org (2003).
Munter, Paul. "Evaluating Internal Controls and Auditor Independence under Sarbanes-Oxley." Financial Executive 19.7 (2003): 26 (2).
“Perspectives on Internal Control Reporting: A Resource for Financial Market Participants." Deloitte & Touche LLP, Ernst & Young LLP, KPMG LLP, PricewaterhouseCoopers LLP. December 2004.
Piazza, Peter. "IT security requirements of Sarbanes-Oxley." Security Management June 2004: 40(1).
"Sarbanes-Oxley Section 404: An overview of PCAOB's requirement." KPMG. April 2004.
"Sarbanes-Oxley Spending in 2004 More Than Expected: Spending for section 404 compliance averaged $4.4 million in 2004, a survey finds." InformationWeek March 22, 2005.
"The Impact of Sarbanes-Oxley on IT and Corporate Governance." serena.com 12 May. 2005
Five Steps to Success for Spreadsheet Compliance. Compliance Week, July 2006.
Pcaobus.org, PCAOB’s New Audit Standard for Internal Control Over Financial Reporting is Approved by the SEC.
Retrieved from "https://en.wikipedia.org/w/index.php?title=Information_technology_controls&oldid=1204275415"
Categories: PrivacyInformation technology governanceHidden categories: Articles with short descriptionShort description is different from Wikidata
This page was last edited on 6 February 2024, at 20:13 (UTC).
Text is available under the Creative Commons Attribution-ShareAlike License 4.0;
additional terms may apply. By using this site, you agree to the Terms of Use and Privacy Policy. Wikipedia® is a registered trademark of the Wikimedia Foundation, Inc., a non-profit organization.
Privacy policy
About Wikipedia
Disclaimers
Contact Wikipedia
Code of Conduct
Developers
Statistics
Cookie statement
Mobile view
Toggle limited content width
Understanding IT General Controls (ITGC) in Cybersecurity | HyperComply Blog
rstanding IT General Controls (ITGC) in Cybersecurity | HyperComply BlogProductProduct overviewGet a Trust PageShare Docs with Data RoomsRespond To QuestionnairesSend Out QuestionnairesPricingCompanyLearn moreBlogCase StudiesResourcesGet StartedSign InSign inGet StartedBlog/Understanding IT General Controls (ITGC) in CybersecurityUnderstanding IT General Controls (ITGC) in CybersecurityBy January 26, 2023In this article:To protect your assets and reputation from hackers and cybercriminals, you need to have the right processes and tools to keep your data secure — and alert you to any potential risks.One important way to establish security is through your IT department’s general controls, or ITGC. These controls are the specific processes and steps you have in place through your IT protocols to keep you compliant and help you reduce the risk of a cyber attack. In this article, we’ll explain why ITGC are so critical for your business and give you some actionable instructions to help you prepare for an ITGC audit and maintain long-term compliance.What are IT general controls (ITGC)?IT general controls, or ITGC, are a set of directives that determine how a business’s systems operate. They prevent data theft, unauthorized access, operational disruption, and data breaches. They influence every aspect of IT, from setting up new software to user account creation.ITGC also impacts vendor management, as new applications and procurement must also meet the standards set by the controls. Having ITGC in place ensures that your systems are protected, tested, and implemented correctly, and security and network updates happen at the right times.What is the difference between ITGC and SOX?SOX (Sarbanes-Oxley Act) is a compliance audit that protects shareholders in your organization by requiring yearly mandated assessments of how well you manage your IT controls. It also ensures your reporting and disclosures are accurate and reliable, which protects investors.SOX is not the same thing as ITGC. You use your ITGC to ensure that you remain compliant with the standards set by SOX. The two work together to help protect businesses, shareholders, and customers from data breaches and other cyberattacks.Why ITGC are importantITGC are incredibly important to the success of your business operations and the security of your data. These internal controls ensure that your IT environment and other business processes are protected and any vulnerabilities are addressed. Here are a few ways that ITGC protect you and your information systems from risks.Reputational risksYour business reputation is built on trust between customers and shareholders. You can have severe reputational risks if your company lacks the right cybersecurity or physical security to keep your data centers secure. This can hurt your industry standing, which can ultimately cause you to lose revenue. Operational risksITGC also protect your business operations. If your systems are damaged by a cyberattack or a lack of compliance, it can slow down or halt your entire operation and put you at risk of even more damage. The control objectives help to keep your organization running smoothly and ensure that your IT systems are up-to-date and delivering accurate information.Financial risksWhen your business suffers from reputational or operational risks, it trickles down to your finances. You can lose business, investors, and grants from non-compliance or data breaches. Your financial reporting can also suffer a hit if you cannot access the information you need to make a report. Even with disaster recovery plans, it might be too little or too late to save your bottom line.ComplianceCompliance requirements depend on internal audits, vendor checklists, remediation steps, and risk assessments. Without the right IT controls, you risk being non-compliant with SOX or other regulatory compliance objectives. This can result in massive fines, reputational damage, and other serious consequences.How ITGC audits are conductedYou need to conduct assessments and audits on your ITGC to understand whether your access controls are adequate and how to improve. An IT audit can help you authenticate your controls and the current security in place. Here are the typical steps you will see in an audit.Step 1: Determine audit scopeSet the scope of your audit and ensure you know the reliability required from each control to complete the tasks at hand.Step 2: Test with a consistent processUse the same process or similar test for all of your control audits so that you can follow the same process for change management.Step 3: Prioritize defective controlsIf the audit returns with defective controls, prioritize which ones are most important to your business operations and begin remediating those controls first.Step 4: Create a baselineCreate a baseline for your controls that helps you understand when they are not working as they should, so you can reduce the need to audit.Step 5: Continually test controlsTest controls continually to remain proactive with your cybersecurity and IT management.Areas of IT general controls: Types of ITGC to auditNow that you know why ITGC are important and what an audit of them typically looks like, let’s dive into the different types of ITGC you should be prepared to audit.Information security controlsYour information security controls are the specific measures to secure your data and prevent any theft or breaches. This is essential to protecting your business. An audit will likely run a scenario in which the auditing party attempts a data breach to see how your systems handle the false attack.Access to programs and dataYour access controls help you determine who should access different data and systems. This can help prevent unauthorized access and reduce the risk of a data breach. For example, password management and least-privilege access policies fall under this category. An audit might reevaluate your current access controls.Change management controlsYour IT environment will change over time, so you need to have change management controls in place to document and authorize changes. An audit will determine if your change management process is effective or if there is a vulnerability.System lifecycle controlsThese controls deal with the updates to your applications, systems, and networks. When programs aren’t updated, they can become at risk of vulnerability without patch management in place. An audit might look at your regular updating procedures and system monitoring.Computer operation controlsThis type of control examines how your computers are programmed to help you store, process, and access data from your network. It is important to ensure that your systems work as intended and your processes can operate smoothly. An audit will examine computer processes and storage to see if they are capable of running programs correctly.Incident management controlsWhen an incident occurs, it’s important to have a plan in place to record, recover, and process the incident so it doesn't happen again. An audit will examine the types of management you have in place for an incident and how you address the incident after the fact.Backup and recovery controlsCyberattacks, natural disasters, and accidents can all impact data, so you need to have a backup and recovery plan prepared to avoid significant losses or process slowdowns. An audit will examine what data protection features you have in place currently and their effectiveness.Physical data center security controlsNot all hackers work from behind a keyboard, so you need to have physical security measures in place to protect sensitive areas. An audit will examine physical access to see how a potential hacker can enter your buildings and secure rooms.How to maintain strong IT general controls: 3 crucial stepsMaintaining your IT controls depends on a few crucial steps. Here's how to ensure everyone in your organization is ready to step up and that your processes and tools will support your IT.1) Train employees and determine roles, responsibilities, and authorizationsThe first step is to ensure that your employees are trained on all ITGC regulations. You also need to make sure that roles are determined, responsibilities are assigned, and the right authorizations are put in place to ensure that every member of staff is aware of what they need to do in the case of a breach or a cyberattack. Security awareness training can come in the form of online webinars, in-person meetings, and special authorizations.2) Develop your control strategy and processesBeginning from the top with a control strategy and a clear vision of the process is another important step to ensuring that your controls are strong. This will allow you to develop a high-level plan for your IT controls, give you a solid foundation, and allow you to build up from there. Consider taking a step back and envisioning what you want your control process to look like. Then, you can develop strategies that help take you to the next level and cover all of your bases.3) Utilize the right tools and technology to mitigate riskTrying to manage your IT controls, stay on top of compliance, and protect your business is only possible with the right tools. Different technology and software can help you stay on top of mitigating risks and even notice potential issues before you can by manually looking at controls. The right tool will also help you be better than you were before you used the tool. For example, at HyperComply, we use AI technology to help accelerate security reviews and keep your business processes flowing (learn more about how we do it here).Establish top-notch cybersecurity practices with HyperComplyCybersecurity is one of the most important components of running a modern business. Without the right protocols, tools, controls, and processes, you leave your business vulnerable to attack and the serious damages that can occur if cybercriminals and hackers target you. Having IT controls and an audit process to monitor them is a powerful way to reduce risks and protect your business.At HyperComply, we understand the value of top-notch cybersecurity practices. That’s why we’ve created tools that make auditing and staying compliant easier for your business. To learn more about what we can do for you, get started with us and discover what HyperComply can offer.Newsletter SignupStay up to date on the latest from HyperComplyThank you!Oops! Please enter a valid business email.Share
https://www.hypercomply.com//blog/itgcExplore more postsBest PracticesHyperComply's Guide to Sharing SOC2 Reports: Making Compliance Easy and SecureBy Emma HorsfieldJanuary 5, 2024Best PracticesUsing Security to Unblock Sales: Collaboration techniques for sales and securityBy Amar ChahalOctober 30, 2023Explore All Blog PostsLegalPrivacy PolicyTrust PageContactEmail usSupportAboutCompany
-1.7%����
1 0 obj
<>/Metadata 678 0 R/ViewerPreferences 679 0 R>>
endobj
2 0 obj
<>
endobj
3 0 obj
<>/Font<>/ProcSet[/PDF/Text/ImageB/ImageC/ImageI] >>/Annots[ 13 0 R 14 0 R 15 0 R 16 0 R 17 0 R] /MediaBox[ 0 0 595.32 841.92] /Contents 4 0 R/Group<>/Tabs/S/StructParents 0>>
endobj
4 0 obj
<>
stream
x��]�s۸����U��A�_��;����^�r������%�s����ﻻ� )�"��M"F"���o�����^�z�ar�������� {y�9a�������QI.X��g"A�1y$�fv|4���{�a�X�M\���0�y�q��H�8b��A��������\�|���� ��gY��,e7�:d ̉���}���ſ����[~;>ڛ�o�t���xi�F��"b\���!b�b�P쟏O���X�pq6�^��/��8��h��Z�����/�K��7�Q�s�;�ރA�`�9��B���l|��(E�O�=��1-v�a�E[i��&���T�GA���}=>�F� `�����Ə���? �fx�Y��1Z���lt��\�_Ֆ�B�o��<����y�(:��@��%ŵ�D�pˀ���ytqP� M\�(��
t��j�F>��� ����8�{��J���KzA�Ɯ�q� �,�i�9 �N���?�2��y����k O|h��n�'���V�
'b�an��H�خޞ�8-� ��s~��O;J�xcs�> �T5���V3DgM���E��F�_�� �v)z "B&�/�8��5z��Q9��2�p`C�Nj�3��19&�
�Ac0YM�=�حzK^a`;Õ�
�U%�ч�y`�`�$n��)<��ty�_:t�*�ͨi ʣ V���������F�p3V�X�rv?Fm��+y;f{��2)G���|��XU��ш^��r��$�T;v�l�d��-��gq�ݬ��-�7�Vk��D�-�J��
=�7���rt����1"p�l��Ɇ��Q��$]�G���̮Pz�T�u3���{CC\�H�[�a���3#x�x�bq$�K�Y�68>bv���m�2~d�ɏ��mȋ.#��f��>K���3����&��Xi�p*Fբ4���4���!�$H`/�=G���D'.b��r�xӞ� ������L�p4���DDc���T)��50�I� #w�Aޤ��lL1��I�@�e~G���3�U4+����j��B��g��
p}9~����4b�<��c�'�@Hy�� �,|ie��0vM�o�,ub��Ϯ,��m�y�iς4{z�i��'J��V�����U�
8d<�����!7�h��{���{:J r:��������!�G�/Hޟď���?���ӕ=�9D�Y�ez0Pspp�}]��C�Ho��x\�-�-G�/6S��Oe��1"Hu[_�ߊ �%�K��5�6Ȯ�}�|+[�O���g�ƕ�Jio�dЙ�t��}B��SU��9VD�zv�ko� �T �hKtw?���T+���Q���j�R���5A��ޑNa\M���Pj�tY��0�M�Y-b�k타0*�2���DV��S�}`"���0���
�=+FXP`'�6�z�� �����tu�a�
��/�Nyh�}f�y�M�'E�
����
I��I�ڼ�k�2e�Q��˙��#���p� �����
V��%��A��������ւ\%%�}g8�E����n a�=7Y�"NKe����l�B�^�5�>e��[���@<Η�V�4�)45�G{-��
��sZ.1eXm�=P^ᮟLx6yF��C L�ҡ�I���'�:�3v��Ȑ��,v��Z6F%'<��<�$rq�5�����+(/~@�/.W6��N~�<>�}��V�Q��?`f��>���pT{P�s��I��o��+2�q��7�:�5z��1ּ�+U��s;w�1d���=5
=�s�A3E�-C�p����ָq����Lo���{N��&�c����f:�h�}s��d�qð���E:�_�}X�����0�Ν�וJ���jrDQ�L�f��x'1ZFng�2��o�g�V��!%�j:Ndr�����wS�T��f�?�TGɚeB��sR�N�k�+�۠��&�Q600(�kzfeV��M�pMj�X�W!��'1~�G]���0L2���gq���o �ޛཀྵ�'��::=I�{��4��^����n�������$����6�kb-{%������
OO�J�7-�d
���+"bJ�_�����S�a/�������ޒ��h"I�z~�{��f0$�фތ�EB_�%���= �P��ٗ����3�T8'J^�3 �I`E���
)��y ��&��$�-�`c�LY�V�~��R�{
U̔��$U3��,���ҁ�2@SZ���"�� k��K��]��e>�: O8l�<�?�_�Ar�Z�a�E�{z?�k'F��E������M�]N��6](6-#r��z4v����J:�Nf��B��F� ���%���`_��pW8ρl�E�'��?����Z���o�7���~*e���%�l�4��ʺ����T�@JFt�m`�ԠS.iT�d����K=�Z�lJf^���M&���� �q��|�ax`S��<���C��Jo(ډMJ�����4yS� �b7w�۶�]���q#�;����(��>Zlp�%�->܀h��
-vb�����[W���7�nR�A�wm�-P7f�� lIGç[U�^u����5�}�Vta(�,�0�� �!�'?��B玐��^�'���ݣ�Q�u+��M\��'*�d�A�c��nWn8Β@|?��.j�F�q����J�
�m�2���������bm"Ov�spjK�����[�;X��Re�*�2�8�x�S�s�g.�����̩k.E���*ˇ1WVzC�+;1�X�Nu:�3iA��d}S��/�]���� 68��*3,��+Yr�\�>c E/���[�����S=�(�m�P�a�7�z؉}���zA;dK �j!�&���>I�-'�U� L|���fx���Y��̡ i�7$����2�K+���Վf�
�� $�c�Yi'v F�?r���
;vb�� �G���k]oU�/P �F<"��+f[�'�@�����i�9�<x=Vx��N����f[���;mx�; T��< ���l��Y�4=�U-�6V;[�p+D��J�5�1�6�I��V;җ�joNX��
����$cvoP��*O��/�C�E?%��A��D4�U�wY�1�R ����.:�Vі�� �������M�����5}ԭ>ߦ}u.�v��2��!-K�Q�����������(є;$kZ�ZuI١�;CE{l���v��i�g5;X�jn�\�<���hF�4�^� 3�yj+�����:�����}��SK�Q=v����p`&��s�7����ƿ��3�N̅)��a�Nl �ى}�-�R�O�v��>����BG7^�ZnJ�IQ����=�q`����K�(`8� ��gbQ����x�Ͼ���@&��O�K��]*����X"s�)K�_�������:��yn"�
:����L��*���r�F�N�%j�p������IbfS����b���}�u`i�i���v��@&�Nl �e'.��~�������7ɤMO�no@� �Ŷ�n��+ 3Ӫ)�du�t��:i�7s��9���T��N����J�y�]E8���]���rG(�����n6��.6n�Dq���p�bc����,2��b�c�x�J� ���=�xK����it�VJ���6�%��I��DEۮ���-�1�����S�گ 1O��R� �4֙� �Y�@:�S'3�W:�{�=p�8�5� n���F�W�s D�=b���|��8�*s����Yk0�d���g!�^ml��F\�|!��a�7o���'u�� �#�����x&�c|�P c��k��J�L��P�5��S0L��pc'��D��PW��(�x�j��ޱ�4;q��Ⱥ� ͆���A����[��p_�;8ߧ�'Ā�yXhWG��g�ɫO{3�X�� ����m�j)`�l��|4K
endstream
endobj
5 0 obj
<>
endobj
6 0 obj
<>
endobj
7 0 obj
<>
endobj
8 0 obj
<>
endobj
9 0 obj
<>
endobj
10 0 obj
<>
endobj
11 0 obj
<>
endobj
12 0 obj
<>
endobj
13 0 obj
<>/F 4/A<>/StructParent 1>>
endobj
14 0 obj
<>/F 4/A<>/StructParent 2>>
endobj
15 0 obj
<>/F 4/A<>/StructParent 3>>
endobj
16 0 obj
<>/F 4/A<>/StructParent 4>>
endobj
17 0 obj
<>/F 4/A<>/StructParent 5>>
endobj
18 0 obj
<>
endobj
19 0 obj
[ 20 0 R]
endobj
20 0 obj
<>
endobj
21 0 obj
<>
endobj
22 0 obj
<>
endobj
23 0 obj
<>
endobj
24 0 obj
[ 25 0 R]
endobj
25 0 obj
<>
endobj
26 0 obj
<>
endobj
27 0 obj
<>
endobj
28 0 obj
<>
endobj
29 0 obj
[ 30 0 R]
endobj
30 0 obj
<>
endobj
31 0 obj
<>
endobj
32 0 obj
<>
endobj
33 0 obj
<>
endobj
34 0 obj
<>
endobj
35 0 obj
<>
endobj
36 0 obj
<>
endobj
37 0 obj
<>
endobj
38 0 obj
[ 39 0 R]
endobj
39 0 obj
<>
endobj
40 0 obj
<>
endobj
41 0 obj
<>
endobj
42 0 obj
<>/ExtGState<>/ProcSet[/PDF/Text/ImageB/ImageC/ImageI] >>/MediaBox[ 0 0 595.32 841.92] /Contents 43 0 R/Group<>/Tabs/S/StructParents 6>>
endobj
43 0 obj
<>
stream
x��]YsG�~W��C?mf���c�፵ƣ��NĬ�Y���>P $ "��~�*MPP�/��LTWf֑�W�`���O�����˫7,����z����-/��v���O|U��勪��mLQ���E�M��b={���?˗/~�z���?�������ش*L�ز��hB[־���^� Ň�->�
������u�/ng�K{�,��%�ϋ��Xᢘ�דKw��f>1�Ŧxs5��.�ד�b�_,�����v�?_�&��z^�=��o��+���募A��z��kmt�*��F2M,*��?��UQl��a����{_����o���~y�~���9��ڿ���{��w<�w8��&^���)���U�a��:k��^����Y���E_<�a1,�Q���"��lq�4wK>N.�OQ�)/?�ߕ�*6�y�K���},�1��7�-Vj6�E�Ȥ�W����6Mi�G�7~���|{O�*�l朆�fA_�7c�yֿ �7i4��G�UR,"Mwqcs�7WŤ���o�c* nA�S0`�Q~R;N�g r,�~Y�t�+u1�~���e*W��Yx�Fh���MxX_B��T�Y�V�D��Y��-�k`/�x̗@��d�{ y���q�\���fˤ�y,G$ׂGh��jΜaf˸
x��� )�9 �E�[~�e�W�Y�f�ve�/u�|O�c\�mS�vP����ϝ�Շ��q�2�.M;�Ե��%o�Z3 �b˅~�Ձ>3���M�] ��. �]�}�Ŋ��#��4J��5��vD;%F��w[[y�5�3�~��/X�z��Y�\4Gɇ�TУM�す/?��^�/����`
�ט���R��!u��H�3&Rum%R��*�S+�J8�cS���P��l��>�pl�N������u�0�´�'�nH��W9
�w�~_����.X�!�i��!�ZS���Ci��ACO�"�O�����u.��9���㾫;�Wp�P�{s��U�cŹe���1K��p� ���e�w��1dX��=-*�N��5tK9�f�N64���7���� �$-�и��7M0m�6C�D�W�Ѳ�n��O��Q�]�9$PBg�)F����|Z�'XW�����G�ߒ�Π
�j�<%im���z$�f�-�nȼgx�朞��O�J���йCQ���<�6�Y)�C{�� �جP����a�k��,Y^��� ���C#:�m˦��#ڝq�Cӕ�; f�T���֯8=���Ebi����e��| ��IG�!��v�۵�>���fDZ]_�3�l/�ސ"�f�����/03?\k<9�w ��a������Ag؍�w���b� m@�p�Xګ�:f�r�⁻����߳c�i�]]�ײi)YE,Ub% d@Ǯ����~da�{BX9���4C�δ澰7KJ�p/}Wn~���y6��f�����;�c)}�����9l����_l����X{A�p��g�n8�{7�]�V�`ȩHUϩB
va�MD& ��L�ue�?��I���ly��m,�$�82J���j �E{�0�g�F� �)}�<�����5C�fE
V�B�2M���h~z^������k�H����̛�+�#����tS�����~2?�\+�� ��Y�U��0����zTĕ��ʔ���*��i�A����:�3���T�2�cX�j:��r-���:��x�6:^{yа���Ԯ���HM�<^L��M����?��۔ACvа���K�P}��* �^bJ1���/ gR�|�n�A{�~�py�Ԑ�����Y6���C5!�����zL�h
K|YmY��+}>��̺=T���ہhq3r� 5��C��NI`�6퐰i�v[���,��{y�GM��r����QGn�WP�R��I�����]���#�3��s� د(��;,����ﴺ��蟇6R��y�G�#�t�;�})�����28}�b�ZP� �$1bR�R���?˕�E҅R�.@�Ggz����Q�@�|�m�Q����wq�|����?�C1;2+��T��ؒ��[�?�`;��pU̐�c�D��fpH�n�T�&gw3ϲ����3�� 5�x����]�cl���2�U��X7�pi�exv�nb�ǞS&Z3d���V�� {\Q�<����E��ɼ�-m��ApA��g�H�g �U't;�R��^o���c��r�=����6�
����kvSH�g�~W��W1t����S{��j>�z��ܐh�܌�HKc�V��?,;��>r$����;lV��Ð�{z����C�sЗ�i���8$�F�Z��e����A�w0�ݻ��Ϩn@����Y]�<z��:���r�+�����-����o_������Ϲ�s���\���S�:��b� �|],�'�Ɯ���{�L�+�~��W�w
E���-�I��˛�$���lW��3��d+���b1��e�i�����U���<�+�f�;�|-������#�����]Y�_�Ew,�b5ƺ�*j���羰��ш��>��Cϐ���ri�Х:H3l}O�^ ݔ���4ep��ʦ�rS�k~4ve��i�}�uBK�D��vB��]�_��S�D�h�T�P+���&.�\�o��-�uY��K��*0× l(*A-��D�-�=`[��
9����b�^����Q��Ɯ��B��HPױd~�C�a���bU�ء*���n�9�P��c���) ��C��M��2_�����.q�zMK�*;���m!��M���U �~d��;ր}u��{WC/F)�
���b�o#�(g�1�W�HԔ2�)��ՁXo]Wh_��rPQL�Ӫ3�iՕj��������/9[<����a|-��oŷ<�o|_w�j��|����w�)*|9ǡ�2�a@��A�)�!�������Ʃ����� � �R ���s��z��-�����_n���^����\����`�rs�#Ɛ��� ���c�p ���3�٢).!�i�ʺ��Z|eq�����Fm��vGT��
��\ӠO琕ueP�Z�� ���;�6��
m�8i ^���0��N�y?�#�þ���.��j
B�/��)�8G:K�_bx�@U�3 �!��� ��+��1[V�� ��H��`�G]�$O�d8Y�)�ӻ.t�|L���pp�:��A�o��%�㕁�j�;e���e�1Ţhn�^�:~�FV6��ⵊb
#�(��+3��K)�bʗy����xbʬӝ��[�&�;������r3���,�9܁�t�+S�n��1����Ѹ-�=]�|=�ӳ��@ �2)���5�h����������H��U ��Z�^BCJ�O�)[�@x2RU ����$┍_c�ѩ˺�t 3�AF��0����oQA�"D�PY%a��~� �,�n�l�#[�^���`[���B�+�����؏�+��<,Q5�_!d�Ti�Q
��5�[�X~ZXV ���uNuR��0��� �mV�\H�*�����l��!�=i;� O�!�NdPU�7X�X��~T1V8I�
'��b� ��X�DJ+e�
G\�h_\���X�2��Q]����})u�h5��#:�ǯ��QhO���"={(&������/H�on�����`�\�b�Ԃ�Xҙ���G�E��5ހ�#�#�h�(x��a�3Ԓ�Z2-�$�%
t�PK�9���j\�S�3 �l��]
C�IL�|$X^�.Y��κ��t�.m]cљ���iH�^"�6^RZl�ڬ��Kdt^�K ]���)m���8:�f�%難���x�j��"�Q+xi�m��k.V�.(zi�s��a�Cn�tP ��&��l�4<ʶ�K(p�P ;F�΄!X����Jؙ�tE1aghM�3��>(v&T�΄��3a�ܗR,*E�g���� �=��F� ���kס��r��*�o7���o�� ����b�];8��]N�]t����kfNJ�.Rv�M�"�n$��a�3�1�Mq=@(�d�u�/6.E"��{k�D�;��]]�A����+Y_����b�X���
1����6(Ĉgl��1Ҕ�aPW芳@y���]�lMѡb��k��^AƎ���g���\d�` �*�kڽ���U7T��-�,����'bE= 3�
]��ٖ�%cM��l���P F�ń!8����J���R��3\����6�*.&T�ń�p1a�ܗR,*Ŋo�������X�`(0���죡���I+xC�^�E+�+~եG3���P�ë��p�}ǀ3l%Ȍ2L�p�W�e�=&�C�l2�V���؝2���"ūv��a�x
\���cJ�*T��}�5'do�U�Z�'ë�r�^%-^e����
�fK�*��N�*k ��
)���.�xK.D�*���� ����RQ�WeZ0^�J2^�l�����ծ��U��kJ�����7�T�!��ei���W�R�G�*�K�R*��ʈi�28uվ8�UQ1 Veb��J{���Rj�N���?���\�h��e aE5cE�9�D�EoG�ɻ�*
���H<;Zx���n��� 8FB��!��i) Ȩ�e�V�m~� �vu�3����#��#a:�"*�Sm~�MT��.�bM���(w����i�8t� ?2�-;���K��A� |��xh>2��N�#�:��G8@���#ҷ��"��5��ol��:�n$D�j�����٪�~�s{X��~ ?2i:�G->�#U�y�Le�32t��vp_B�����WF�}*]�@��H*�#�H��0�,�K)�E�o���1a�k�'�`z���W_��P#:F?�6x\�N��>�b\��g��Jw1�^o������ˀ�\����ܜ��7g��cx�>� ��u�J�]1ndh!�D����2�+EMe� ��d�vW`��RdTN�.��Yw�ΐ�5�%�=!]�Li�ʷԅ��Q�K���I�5ԅ�zgk�dx��8.mvk�l���B�u�GZ'�� E@\�
ua �{w��Z�X2��ݿ�扸� `]�o�˱��c��'�:��2�����n�/�DT�z��r���@�]�B_��z�JX�0�#5��R�E�c]ߢ��b[�0��>iZ�{�ڀ�]\�_B�g�^.�с�}j�tC`��O�7r��V�~������ؤl�y����;i��y���1ӊ9�aZP3C�m�K���)�0ep�$]I^%�R&��>
endobj
45 0 obj
<>
endobj
46 0 obj
<>/ExtGState<>/ProcSet[/PDF/Text/ImageB/ImageC/ImageI] >>/MediaBox[ 0 0 595.32 841.92] /Contents 47 0 R/Group<>/Tabs/S/StructParents 7>>
endobj
47 0 obj
<>
stream
x��][o�ƒ~70��O�`L�}�e�[r�� 9�9���>h$�V"[>eg���W�ݤD��ؔ�� �M������u�]�����/~�%�������9K��E�FIdKk&�K��o�~�[t�����7g?�(Uї�7gx4��(Wq�L��"�L���鳍�7�ot�W�����ٿF���j4����z��D~���(�u|nF��5��z4����y6�D�.���f�'�ȷ+��?ї�zs���Ǜ��
�t��)��؏v��0Yl�(�e��(��Į���,��ˇ(j�~:��k�Wf�� ��9Z/�4�F7�74�2x���q����flhN�^��ͼuz����dԞ�nb�*~����#a���nѲ��ƃD�^��n���!���ՂY
o�є% �qM����j��4���9���U$C���KLFs���n<[����Z.��b���h��`�c1�S�]��2ƸE�W3���b�eg����˲C���t���� W�� ~s��S��!�3[`�����%���k(w��T���f.I�gk����z�#�0��;\ô�r�'wu��I�E�p1��d"���q�0H/<�13�-�#C�^{��}�Q!����*���^-��u�V1���iF4+l��u|֖���'ne$W�i���֓�OH� 0��<�gAv1�^�VN�h����C��n�����#�ԭb�ؽ�ݵ�Y���4g��h���a֔�AT���M`˝�a�IF.L�@�wH��T3z����Y�i0�h�mQ�y/��S�v44x���.7o�g֞$�#'pp��w0��ˊX����5(�6p���� ���/bѴ��Hb�1G?$���rX},�8�:Fc`�bʄ��E�q~"�e4�.R�
s&���Wv`�o��/��3�|�ٹ��[~�~3��h)a4h=���:��.69M\9p.��1߷�С[<�0#��=ɠ�<�;fk�
��4X �&a ���bC�VtA��p,5ݺ�"A�! |X��v��l߉l�uB�H;�:K�X�:�������+�d;�R��F4��h�㊵g ��.~��4�v��|�u4eZ�]��zu��1�]��1����E���!,�'��b�:y�B?ܙ���j��<�dm2�!��cl����tN ����A>hS��N:�I���ju#fqK�e�v�MB#��������E\��~
�V��ݸ�+Δ?,flx�QȦ�jz��.��p���w}k��[����\o*N Ck����O�H�U�us0�]Pq�s���`/&�v}�P��Ǩ�L�\��r(}2�IE㵸�� ;���}�}�+,�s~�c�O����yW3�x�~���ڔ���ڊ��:����� ��kP�:���AfJ�������˼C���q�;�-�U�*;�8����gz���i }� N����HC4���{�u�ҜD��}#"|�� }�N��� �֣��W;|��[����^Ƈ[٨a�����v�!���j�I�ȍ���78�����P�s���p룠��;+2!����x��I=���>���-�*L���������$�՝�8�:X�4��ɵll(-����ŝ�s��.�>k_حZ�)��XB���@r�m�j�\���^�*��l?��v7϶����^�[\�DE_�k�����\�������x�ܔ�6��n)�a��V����~ϸ�4ivnѓt��������W����n�f/�vx"a��=7� �'o&�8�[Yh�,��g�3y�ɥ� Bz�|מ �I��e(1>�?p��.��ZG���0N�����lO �1�$�I m52����Y i�CHR�������-+�7n\�"� ����n��۰���m�vYs<�b��T�?!����f�|y������/z�~Y�$Ө�8�ɸ�'��<�E)�R>�˸c���1_u�����C ������� %jr(u4æ��rd�T��b��@Z�[�C?��-�|`�Z?]�j1P�@���w1P�@��EX�?����HbM��6���ܤ���͙��QK��q[7���$#iPηP|�aI�x鯦o�P4�V6Nr������k�SԛܫW4zvW��#�o;���]����Ǡ�G��
�����>w�j� �*�\��OLK��4���0�SK�_L�}$u5�����P��eľ�Yu�C�׳��Fu��x晳EM>?Hx�ό�5�-���`�Qi<^S�Q�� 64ȱ����I��q�K�2��i�hޡ��9�QH(��f���زcK�,)GUͱ�n %,�U��j48�&�Y�hЉ��e�� BeP�9r&ؘ�NJ[�H��h^y��᠈�+c$�E��qՙNj�rH��5�F?�E!�:��f�P^�da���r0���mǐ����0�q��iw�{�m✈f�1l� ̼a�mL���n��u��0�#�F�{.�����8�՞p�Ҥ�g�,��qP��D�0�&�e��0����`�]X���P����Nw�A�S�jS쌴Jc�o�) � ou �:!}H3�s��%��@�*���\z,�V:&�6����Ј�*�Y A��+,w��%.��֚�q�����%׀���ʈ�tWJ�u�%E��Э\�aG��v�Wkn��eO��O�ѻ�S���'c��V����ϕ�bK��_��.�~����AӋR��j�/�8���a�����T���&a�j�{H?�zX�K28�L��5v���5���`/3�fkpbŊ��ѫP��=����N�h:��j��A��\?qC��L �T��e(Ex�]��#y�#Lz����u��~��vZi�.cm_ ��oPݐRN�7l�����"
ظ��/�> ���Z��c"ԤA� 0��P�e""Dd� ��`6�0�r�5����kD�P.XU�`G
��PV�}(t��uC��$M ���J8���W������ҿ�.B��%���Il� ���* �#yu��'�9h�'-�`(�~V��+�k�h �@�����@�ޓ�\\4����%�����A��L�y��33b���j����!��V�:U�UA��j������H��䜾��e(2)gQ4>��y� ��%. (.K.e)�� ŕ�\��0O\��E)�Ex��S�+)6��w�B�R�a�S)�G(���9��oʅ��܅T��KR��}�"�') �y��j�!1�sT�_?�H��ŧ�9]�/�j!;7,'��ۇ�\H��Q=�<�l_�nǏ��\-B��>�I������Q�r�S|!��ޥ@FZpY��i&�s�V�s���CP����Ss��5G[�ݯ�9��N�9�Ġ9��s��q&��wԶ�dEA�m7�,�:�˿�,:C�����T�|`e��$|����I�T��M���h����p��Vf�r�"{-�-/�;Y���j֮��T�ҲD��W�:NoxaG@ү4�*���#�F�r�s����B�a�U;s�V��0 RՑ�0c�̒s�{�ί�9�y�_#��Ob�'��!���Y���c��"�
�������]���[T�� K�!C4�ݦ�.������g%��H[�o����{�y� ����R%Šm���M|�������c�$�#�s*�uNyNQ�+F2��N�z�}��>��K����;w���|9�m��j;�6�}G1M���2�}OS�e�3+*��b�s1t��W|Z�o&�4 �f�<�;��~~��m�~ Gd��l-Vl܇�`�,��ב���VX,E����w"[�C��1'�d*
h}ѱ� �B�=�f�:�3i�)U勞�͟N� o��e��r!�j�9T��|ڈ?��N�PJ��=0�P"�bYl_"1��X���b��!_�V2_���~\�cw��-2:��B�6=��v�:�5��?�Ja+<Ǽۋ|��nZ����<����n{���u��h�Rv8t�B���B��70���Rސp��X�^}�H�~�#�P(��O"L�8�t?u�o��`������."}��?&v_�K�S�K�r��^"D��a�;�yј
���c6���W�{��W��Qn/¼��M�'�H�$�-i��O���C�u, �؝����-������6�{O��?X�vz�A�4eW=Z\����`��^����q��־\�.��B��N8�X����"�\ҭ��4��Jx�cz5���Ʊ#�q>��N�E��P+�p�ėF�hƍ����,���X�1&C�����=�4�٦L�y��4�"���(!�����8�u���v��9���=$b^���Y��G7fQ�+*�{����mhd�T�%�AL�1M?�]ӝ�N�,��N�~�Y�z�q�@� ����י#٠�>b�P��Z�;MaX�,����Dn���F�<��3;�
����<,�}7�y�B�l-㓠X!�]hB�2�UG����Njs�8�?Q�V�^f2�AM����k��m3G=��K�D#Ȉٮ����.D�����|������ۈ���2�Hw�MȡcZ��\-����_:�@��ǘ>9H;��̉�� d7��R�O�%�]`�yj�kј5��{^8�u��+�l�d�Z�������t�ж5*V��űK)ChT7�iT��������� _f�i��c��=��P�/�ϖګz��}��O7��g�Ș^bV���D�?�»��.ӫx�j���:㬨����Ű@̴�������i���>�t� �q� �C���������x��;���)�3Ƹsw�a9K8�Hр��N0�±�܁�C�f�;79��xew֯��l��a�Ⱥ���@Tz+m�b��M�2�����Ļ ���Y�/��!�ÇY�q����/�T����§��&I��K��g=4KZ;!�|�}�Z��&8� ���C ���.�i/�#1��6�/���V���w�ܳD}�]m�Ʈ͚�'���e~����\h�3Qݷ�k�^�zO�Q{���w�����ز����Q���߾kB��Ẉ
endstream
endobj
48 0 obj
<>
endobj
49 0 obj
<>
endobj
50 0 obj
<>
endobj
51 0 obj
[ 52 0 R]
endobj
52 0 obj
<>
endobj
53 0 obj
<>
endobj
54 0 obj
<>
endobj
55 0 obj
<>
endobj
56 0 obj
<>
endobj
57 0 obj
<>/ExtGState<>/ProcSet[/PDF/Text/ImageB/ImageC/ImageI] >>/MediaBox[ 0 0 595.32 841.92] /Contents 58 0 R/Group<>/Tabs/S/StructParents 8>>
endobj
58 0 obj
<>
stream
x��]�o�6�7��AO��E����a``�3�ۻ ����{p�݉�=�n{������(R��c��p�lܢ�d��~UŢ�T��T�y���W{_5��ջ�W��gM����5�j*�T-xe%�����z:?{�����D�x����I��U�� ��Q�ֲ�� ���OU�o`�Ɪl�����/���|�^�������g`���}-���̘��Ô��1[_�����BϪ�l�����������
��������_�,��q�y.}�E췝v \7�eck����V+z]K]1kkc+D�dw9?�>�xUU����.xm����T�r#<^��-�o��ܮ�g��=x�!߶W/s��_��������
�uݼ�>Í��c n�I3�UTҦT�5P�m�������'2�"���_[�V���W���O�����ˢ��6���������d��6���H��.�w�C�= =��Ku��~ ���� �8�m + _G��CmK��r�~�@�4w!hMϞ�����'����`&4�m�Os�����vu�7�v%��s�m��B��P}��E�f�A!#U"��z��t�dO^j�(���7տg�{�^W���]?�L�B6-��/�JE �rRY�,�=�Vs�Ż��3
�U�#bGm�ѕ��f�˕��v���.��6�HV�
-n<`^ZF[C^E�t�B+�
� ��5Z�ƻ(�G=K ����'̀Ɲ��Dmhr�7���z6�e9>����y���� I�;Z��#ȷ�!�3�b� c�d�uל���Vį��'��Mt�),l��s��u�yN*�*X +�'�����S�b+�$����_Z�Z���@�k�} yG�ݜ��0���zH�D7���e�!Hä4UᗓJ����|�6���p�䴂j���x���V��i�*�F������&��It*L�dO��Z�`���F��]��+��v��E�<`�P��fU �$�A���*7��zb���\������i�Y�X�3��?���e��T�{�_#0����7���ۘR�����G�A#�a�[ԍ���1Q��v�c�1��Rڥ&1����5XjK2���L��=�A��༶��Q����C�<{�
;.
����m�}�!ݘڼ��u���ij1[;10�ԫ� �Ъ��[�nbL+�[�Sy�`ob� P�l��{x���;�j?�31��� ��HUsvnbl �!��K�� ������0��_�� rsS����{Pr�&�ή�?�p�sS�V����̪������2���R���f yJT�Q��+�!C��n��R�� ����]��c�����R�Z�8r����v`*t�x�_���H��[��fm���H���,ַ,�z�^qLy����n�a�y��
�\q����67���N��� ������������W;����3FW����{��m@��^Cm��C\YSk�gF<� [ �i�
W�-�:c�C�����v���"����k�`\�U;=�@�<�P�H�|Mi�ZZ�$��t�3��^�j�ihq��N�t5�^V�
�����@�A4�3�W~`D^h�]��
��*�/x~�p7�zf��ܗ���=���\n�R�g�R��`�h&���������3����s�J��W����8��=���]u�N��� Cэ��8+�`���2kn@�=|�p�8n�ToZ�#
X rA�'�����9l�M�.����فˍ���5���PH`��p���, �>��y���бa�0�O®F@l`�
��7�m����~\$��x�7C�v/��t��Iב�/�v<