GP-018 Infrastructure and facilities

Procedure flowchart

Purpose

To define the methodology to establish the acquisition, maintenance and incident control activities on our facilities and devices, in accordance with the requirements previously established by the organization.

Scope

All of our facilities and devices.

Responsibilities

JD-001 and JD-003

• To approve the acquisition of new facilities and devices and their corresponding infrastructure control plan.

JD-004

• To ensure that the process of acquisition, risk definition and creation of the infrastructure plan is done according to the methodology established in the present procedure.
• To check that all maintenance activities are being carried out and recording all non-conformities related that may affect the proper functioning of the processes.

JD-005

• To coordinate the maintenance tasks of each infrastructure element and generate the corresponding records.
• To coordinate the correction and documentation of detected incidents according to the defined plan.

JD-007

• To perform the activities described in this procedure and record the corresponding evidence.

Inputs

• Requirements for the new infrastructure element.

Outputs

• The new physical device or AWS resource.
• T-018-001 Infrastructure list and control plan
• T-018-002 Infrastructure and facilities incidents log

Development

As it is defined and validated at the R-002-007 Process validation card 2023-005, the top management decided to implement remote work to all the employees. The infrastructure and facilities have been designed according to this type of work as explained in this document.

Infrastructure identification

The facilities and equipment are identified with an alpha-numerical code that is registered in the T-018-001 Infrastructure list and control plan, which in turn maintains a list of the infrastructure, which also includes its location and intended use in the activities of the established processes.

The company handle two different types of infrastructure elements:

• Physical devices, like laptops or mobile devices.
• Cloud resources provided by AWS.

Each of these resources is associated with its corresponding access control as well as the risk assessment and control plan, whose contents are detailed in this document.

Minimum requirements

Laptops

The laptops of the company staff that carry out remote work must have at least the following specifications:

Characteristic	Requirement
Microprocessor	Intel® Core™ i5
RAM	4 GB
Hard disk	256 GB (SSD)
Video graphics	Intel® UHD Graphics 620, Integrated
Display	13 inches display

Any equipment that does not meet these specifications must be validated for use by the JD-003.

Connectivity

The internet connection must be at least 50 Mb/sec being the responsibility of each remote worker their hiring and maintenance.

Infrastructure access control

The access to all company's resources has been defined under a minimum access policy that restricts a user to only the least amount of access to privileged resources and permissions that are needed to perform an authorized and assigned activity or activities. The process to grant and control the remote access to the resources is explained at the SP-018-001 Remote infrastructure control access policy.

Physical devices

Currently, each physical resource of the company is used by one single person, ie, there are not shared devices at this time. For managing and use purposes, each of these devices must have (if possible) two accounts created:

• The one belonging to the team member who has been assigned the resource. This account must have the minimum permissions necessary to use it.
• An administration account that allows the management of the device as well as the accounts created on it.

AWS Resources

The company uses different AWS resources for the development of its activities. Unlike physical devices, these resources are accessible to multiple team members.

The cloud resources used by the company fall into two categories.

Resources managed from the AWS console

Team members who require access to a resource that must be managed from the AWS console will have a user within the company's AWS account. Access must be through two-factor authentication.

Each of the users thus defined will belong to one of the following groups:

• "Administrators", with full access to all resources defined within the AWS account.
• "Developers", with access to a subset of resources needed for the tasks this group do.

Each account created in AWS has CloudTrail enabled by default. AWS CloudTrail is an AWS service that enable operational and risk auditing, governance, and compliance of each AWS account. Actions taken by a user, role, or an AWS service are recorded as events in CloudTrail. Events include actions taken in the AWS Management Console, AWS Command Line Interface, and AWS SDKs and APIs.

Resources managed through remote access to it

In this case, the process for granting access must follow the procedure described in SP-018-001 Remote infrastructure control access policy.

Each access to this kind of resources is logged in the corresponding file of the operating system. For example, for Linux instances, these logs can be found in the following file: /var/log/auth.log .

Infrastructure risk analysis

The JD-005 is in charge of creating an analysis of the criticality of a failure mode of each resource in the infrastructure. The risk analysis is based on the procedure GP-013 Risk management.

In the case of the infrastructure, the probability values are taken as the probability that the equipment or infrastructure may be out of control if the control actions are not carried out and the severity is understood as the severity of the results in the final product. According to the risk that is established in the T-013-002 Risk Management Record a more or less severe type of control is applied.

Regardless of the level of risk that has been assigned to an infrastructure, the analysis included in the T-013-002 Risk Management Record should be updated if the specifications initially evaluated change.

Infrastructure control plan

From the T-018-001 Infrastructure list and control plan, it is possible to obtain information about the maintenance and incident control tasks planned. In the same way, when corrective maintenance actions are taken, their status in the list is updated, keeping the evidence that can be applied in the appropriate location (delivery notes, contracts, parts of intervention, invoices, etc.). In case of obtaining unsatisfactory results, it will be registered in accordance with what it is established in the procedure GP-006 Non-conformity. Corrective and preventive actions.

The infrastructure plan contains the maintenance plan, listing all the maintenance tasks related to the resource.

Maintenance plan

The maintenance plan for each resource list in the T-018-001 Infrastructure list and control plan must include the following items:

• The access control for that resource, specifying the users or groups that will have access to it or who owns the device in case it is a physical device.
• The location for the access records generated for that resource. This location must be a file inside the own resource or a S3 bucket. Only admins will have access to this audit logs.
• A set of records with each of the maintenance tasks carried out on the device. Each entry must show the type of the action and the finished date.

Maintenance tasks for physical devices

Task	Code	Max periodicity
Installation of security updates	PD-MT-001	1 month
Execution of Clean My Mac (only MacOS devices)	PD-MT-002	1 month
Execution of Windows Defender Scan (only Windows devices)	PD-MT-003	1 month
Review of the installed applications	PD-MT-004	6 months
Check disk encryption is enabled	PD-MT-005	1 year
Hardware check / Memory RAM / Free Space available	PD-MT-006	6 monts

Maintenance tasks for cloud instances

Task	Code	Max periodicity
Installation of security updates	CI-MT-001	1 month
Hardware check / Memory RAM / Free Space available	CI-MT-002	1 monts
Manual review of the access logs	CI-MT-003	1 month
Manual review of performance metrics	CI-MT-004	1 month

Maintenance tasks for self managed resources

Task	Code	Max periodicity
Manual review of the access logs	SMR-MT-001	1 month
Manual review of performance metrics	SMR-MT-002	1 month

According to what is established in the T-013-002 Risk Management Record, the JD-004 is responsible for checking that all maintenance activities are being carried out and recording all non-conformities related that may affect the proper functioning of the processes.

Incidents control plan

The incident plan is a document made up of the list of possible incidents related to the device and the record of all those that have occurred.

Each incident must display the following information:

• Code, with the format I-XXXX, where XXXX is an incremental numeric identifier starting from I-0001.
• The date and person reporting the incident
• Description of the incident.
• Record of the actions necessary to solve it
• The date the incident is solved

The incident log will display the following information:

Incident code	Reported by	Description	Actions required	Reported date	Solved at
I-XXXX

Associated Records

• GP-006 Non-conformity. Corrective and preventive actions
• GP-013 Risk management
• R-002-007 Process validation card 2023-005
• SP-018-001 Remote infrastructure control access policy
• T-013-002 Risk Management Record
• T-018-001 Infrastructure list and control plan
• T-018-002 Infrastructure and facilities incidents log

Signature meaning

The signatures for the approval process of this document can be found in the verified commits at the repository for the QMS. As a reference, the team members who are expected to participate in this document and their roles in the approval process, as defined in Annex I Responsibility Matrix of the GP-001, are:

• Author: Team members involved
• Reviewer: JD-003, JD-004
• Approver: JD-001