Search DGS

521 - 540 of 1849 Results

DEFINITIONS

Chapter: 5300

Section: 5300.4

Policy: Each state entity shall use the information security and privacy definitions issued by the CISO in implementing information security and privacy policy in their daily operations. The definitions are located on the CISO website at Security Technical Definitions

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5300-4
INFORMATION SYSTEM BACKUPS

Chapter: 5300

Section: 5325.6

Policy: Each state entity shall perform regularly scheduled backups of system and user-level information. Backups shall be: Conducted at the operating system, application, and user level; Conducted of information system documentation including security-related documentation; Stored in a protecte ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5325-6
MINIMUM SECURITY CONTROLS

Chapter: 5300

Section: 5300.5

Policy: California has adopted the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 as minimum information security control requirements to support implementation and compliance with the Federal Information Processing Standards (FIPS). Each state entity shall use ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5300-5
PERSONNEL SECURITY

Chapter: 5300

Section: 5320.4

Policy: Each state entity shall establish processes and procedures to ensure that individual access to information assets is commensurate with job-related responsibilities, and individuals requiring access to information assets sign appropriate user agreements prior to being granted access. Access a ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5320-4
INFORMATION ASSET MANAGEMENT

Chapter: 5300

Section: 5305.5

Introduction: Information Asset Management (IAM) is a collection of knowledge or data that is organized, managed, and valuable. It involves safeguarding sensitive data ensuring that information is readily available to support decision-making, innovation, and operational efficiency. Policy: ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5305-5
PROVISIONS FOR AGREEMENTS WITH STATE AND NON-STATE ENTITIES

Chapter: 5300

Section: 5305.8

Introduction: State entities are required to enter into written agreements with state and non-state entities when they engage such entities in the development, use, or maintenance of information systems, products, solutions, or services. Policy: Each state entity shall ensure agreements with stat ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5305-8
TRAINING AND AWARENESS FOR INFORMATION SECURITY AND PRIVACY

Chapter: 5300

Section: 5320

Policy: Each state entity must establish and maintain an information security and privacy training and awareness program. State entity personnel must possess the knowledge and skills necessary to use information technology to the best advantage for the state. Each state entity must regularly assess ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5320
INFORMATION SECURITY PROGRAM MANAGEMENT

Chapter: 5300

Section: 5305.1

Policy: Each state entity must provide for the proper use and protection of its information assets. Accordingly each state entity shall: Develop, implement, and maintain a state entity-wide Information Security Program Plan. Ensure the plan documentation provides the following: an over ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5305-1
INCIDENT REPORTING

Chapter: 5300

Section: 5340.4

Policy: Each state entity shall follow the incident reporting procedures as described in SIMM 5340-A. Implementation Controls: NIST SP 800-53: Incident Response (IR); SIMM 5340-A

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5340-4
AUDITABLE EVENTS

Chapter: 5300

Section: 5335.2

Introduction: Audit records can be generated at various levels of abstraction, including at the packet level as information traverses the network. Selecting the right level of abstraction is a critical aspect of an audit capability and can facilitate the identification of root causes to events. Each ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5335-2
SYSTEM DEVELOPER SECURITY TESTING

Chapter: 5300

Section: 5315.4

Policy: Each state entity shall require that system developers create and implement a security test and evaluation plan as part of the system design and build. When a contract is required, it shall specify the acceptance criteria for security test and evaluation plans and vulnerability remediation p ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5315-4
WIRELESS ACCESS

Chapter: 5300

Section: 5360.2

Policy: Each state entity shall establish appropriate restrictions and implementation instructions for wireless access, and enforce requirements for wireless connections to information systems. Each state entity shall also proactively search for unauthorized wireless connections including scans for ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5360-2
RISK ASSESSMENT

Chapter: 5300

Section: 5305.7

Policy: Each state entity shall conduct an assessment of risk, including the likelihood and magnitude of harm from the unauthorized access, use, disclosure, disruption, modification, or destruction of the information system/asset and the information it processes, stores, or transmits. Each state ent ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5305-7
MALICIOUS CODE PROTECTION

Chapter: 5300

Section: 5355.1

Policy: Each state entity shall employ malicious code protection mechanisms at information asset entry and exit points and at workstations, servers, or mobile computing devices on the network to detect and eradicate malicious code. Malicious code protection mechanisms may not always detect malicious ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5355-1
LIMITING COLLECTION

Chapter: 5300

Section: 5310.2

Policy: Information asset owners shall collect the least amount of personal information that is required to fulfill the purposes for which it is being collected. Information asset owners shall obtain personal information only through lawful means and shall collect personal information to the greates ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5310-2
ACTIVATE ONLY ESSENTIAL FUNCTIONALITY

Chapter: 5300

Section: 5315.6

Policy: Each state entity shall configure information assets to provide only essential capabilities and functionality, and shall adhere to the principle of least privilege and restrict the use of unnecessary ports, protocols, and/or services to minimize the state entity’s risk. Implementation ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5315-6
COMPLIANCE REPORTING

Chapter: 5300

Section: 5330.2

Policy: Each state entity shall comply with the following reporting requirements: Designation Letter (SIMM 5330-A) – Annual submissions are due to the Office of Information Security (OIS) on the last business day of the state entity’s scheduled reporting month, as outlined in the Infor ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5330-2
SECURITY SAFEGUARDS

Chapter: 5300

Section: 5310.7

Policy: Information asset owners shall apply all applicable statewide and state entity information security laws, policies, standards, and procedures in order to protect personal information under the information asset owner’s responsibility. Implementation Controls: Personally Identifiab ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5310-7
MEDIA PROTECTION

Chapter: 5300

Section: 5365.2

Policy: Each state entity shall safeguard media in digital and/or non-digital form from unauthorized access, use, modification or disposal, inside or outside of the state entity’s control areas whether in storage or transport. Implementation Controls: NIST SP 800-53: Media Protection (MP ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5365-2
ACCESS CONTROL FOR OUTPUT DEVICES

Chapter: 5300

Section: 5365.1

Policy: Each state entity shall control access to information system output devices, such as printers and facsimile devices, to prevent unauthorized individuals from obtaining the output. Implementation Controls: NIST SP 800-53: Physical and Environmental Protection (PE)

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5365-1