Re: SSA Wants to Audit Our System

>

Last year we received a similar request from an audit company along with a z
 ip
file and installation instructions.

+++++++++++++++++++++++++++++

Please install and run the attached Audit software on the AS/400 processor(s
 )
where you are running PMT either in live / production, development, or test
modes.  Then start the AUDITRUN command.  It should finish in less than a
minute.  Finally, email the AUFILE(s) to xxxxxxxxxxxxxxxxx and copy me.

The audit process counts the number of different PMT user profiles across al
 l
PMT environments.  Only active profiles are counted and, if a particular use
 r
has the same profile in more than one PMT environment, that profile is count
 ed
only once.

When we receive your AUFILE(s), we will review it and submit a brief report 
 to
your SSA GT account manager, and then he or she will contact you to discuss 
 the
results.

++++++++++++++++++++++++++++++++++++++

It took ME about 15 minutes to do the whole thing, and as I recall it was ve
 ry
clear documentation and "painless".




>         To:     Midrange Systems Technical Discussion <midrange-l@midrange
 .com>
>         cc:
>         Subject:        Re: SSA Wants to Audit Our System (?)
>
> In our case, we believe that we paid for exactly those rights, and I
> understand we have the paperwork to prove it.
>
> But now I have a more general question: my boss says what they want to do
> is have us load some of their software on our system, using QSECOFR
> authority. It's then supposed to run for six weeks, collecting information
> in data files, which they will collect at the end.
>
> He seems to think we'd be crazy to let anyone do that, for any reason,
> because of security and data integrity issues. Is this standard procedure?
> Has anyone else experienced anything like this? I'm just curious. . .