SearchResult

1681 - 1700 of 1850 Results

INFORMATION SECURITY PROGRAM METRICS

Chapter: 5300

Section: 5305.9

Introduction: Performance with respect to security controls must be measured to determine whether the needs of the state entity are being met. Security metrics assist with adjustments to security controls in order to improve effectiveness. Policy: Each state entity shall establish outcome-ba ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5305-9
TECHNOLOGY RECOVERY TESTING

Chapter: 5300

Section: 5325.3

Policy: Each state entity shall test the TRP to determine its effectiveness and the state entity’s readiness to execute the TRP in the event of a disaster. Each state entity shall initiate corrective actions and improvements to the TRP based upon deficiencies identified during testing and exer ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5325-3
INFORMATION SECURITY COMPLIANCE

Chapter: 5300

Section: 5330

Policy: Each state entity shall validate compliance with statewide information security policy, standards, and procedures as set forth in this Chapter, and the state entity’s internal information security policies to verify that security measures are in place and functioning as intended. Each ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5330
INCIDENT HANDLING

Chapter: 5300

Section: 5340.3

Policy: Each state entity shall implement incident handling for information security and privacy incidents that includes preparation, detection and analysis, containment, eradication, and recovery. Incident handling shall coordinate with business continuity planning activities (SAM section 5325). In ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5340-3
LIMITING USE AND DISCLOSURE

Chapter: 5300

Section: 5310.3

Policy: Information asset owners, custodians and users shall not disclose, use, or make available personal information collected from individuals for purposes other than those for which it was originally collected, except in the following situations: The disclosure is made to the individual who is ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5310-3
INCIDENT RESPONSE TRAINING

Chapter: 5300

Section: 5340.1

Policy: Each state entity shall provide incident response training to information system users consistent with assigned roles and responsibilities. Incident response training shall be at an appropriate level for the assigned roles and responsibilities of state entity personnel. For example, regular ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5340-1
PERSONNEL MANAGEMENT

Chapter: 5300

Section: 5305.4

Policy: Each state entity must identify security and privacy roles and responsibilities for all personnel. This will ensure personnel are informed of their roles and responsibilities for using state entity information assets, to reduce the risk of inappropriate use, and a documented process to remov ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5305-4
SOFTWARE USAGE RESTRICTIONS

Chapter: 5300

Section: 5315.7

Policy: Each state entity shall ensure its Software Management Plan (SAM sections 4846.1 and 4846.2) addresses the following: Use of software and associated documentation in accordance with contract agreements and copyright laws; Enforcement of explicit rules governing the authorized installation ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5315-7
INFORMATION SECURITY PROGRAM

Chapter: 5300

Section: 5305

Policy: Each state entity is responsible for establishing an information security program. The program shall include planning, oversight, and coordination of its information security program activities to effectively manage risk, provide for the protection of information assets, and prevent illegal ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5305
GOVERNING PROVISIONS

Chapter: 5300

Section: 5300.2

Policy: As set forth in Government Code section 11549.3, state entities shall comply with the information security and privacy policies, standards and procedures issued by the California Information Security Office (CISO). In addition to compliance with the information security and privacy ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5300-2
SYSTEM DEVELOPMENT LIFECYCLE (SDLC)

Chapter: 5300

Section: 5315.2

Policy: Each state entity shall manage its information assets using adocumented SDLC methodologythat: Incorporates information security (data confidentiality, integrity and availability) including business impact analysis requirements and considerations. Incorporates information priva ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5315-2
INDIVIDUAL ACCESS TO PERSONAL INFORMATION

Chapter: 5300

Section: 5310.4

Policy: Each state entity shall ensure individuals are provided with information about their access rights and the procedures for exercising those rights. Individuals Right to Access Each state entity Privacy Program Coordinator shall publish procedures for individuals to follow in exercising their ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5310-4
VULNERABILITY AND THREAT MANAGEMENT

Chapter: 5300

Section: 5345

Introduction: Threats and vulnerabilities provide the primary inputs to the state entity’s risk assessment process. Policy: Each state entity shall continuously identify and remediate vulnerabilities before they can be exploited. Vulnerability and threat management include, but not limited to, ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5345
INFORMATION ASSET DOCUMENTATION

Chapter: 5300

Section: 5315.3

Policy: In conjunction with Records Management (SAM Chapter 1600) and Property Accounting (SAM Chapter 8600) requirements, each state entity shall ensure information security documentation is prepared and maintained as part of the overall documentation for all information assets. Documentation shall ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5315-3
IDENTITY AND ACCESS MANAGEMENT

Chapter: 5300

Section: 5360

Policy: Each state entity shall safeguard access to information assets by managing the identities of users and devices and controlling access to resources and data bases on a need to know basis throughout the identity lifecycle. Each state entity shall establish processes and procedures to ensure: ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5360
DATA RETENTION AND DESTRUCTION

Chapter: 5300

Section: 5310.6

Policy: Information asset owners shall retain and/or destroy records of personal information in accordance with the state entity’s record retention and destruction policy and the Privacy Individual Access Standard (SIMM 5310-B). Information asset owners shall take reasonable steps to keep pers ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5310-6
INFORMATION INTEGRITY

Chapter: 5300

Section: 5310.5

Policy: Information asset owners shall maintain all records with accuracy, relevance, timeliness, and completeness. Maintaining Record Integrity When an information asset owner uses a record to make a determination about an individual or transfers a record to another state or non-state entity, the o ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5310-5
SECURITY AND PRIVACY TRAINING

Chapter: 5300

Section: 5320.2

Policy: Each state entity shall determine the appropriate content of security and privacy training based on the assigned roles and responsibilities of individuals and the specific security requirements of the state entity and the information assets to which personnel have access. Privacy training co ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5320-2
INFORMATION SECURITY INCIDENT MANAGEMENT

Chapter: 5300

Section: 5340

Policy: Each state entity must promptly investigate incidents involving loss, theft, damage, misuse of information assets, or improper dissemination of information. All state entities are required to report information security incidents consistent with the security reporting requirements in this po ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5340
ENCRYPTION

Chapter: 5300

Section: 5350.1

Policy: End-to-end encryption or approved compensating security control(s) shall be used to protect confidential, sensitive, or personal information that is transmitted or accessed outside the secure internal network (e.g., email, remote access, file transfer, Internet/website communicat ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5350-1

Search DGS

1681 - 1700 of 1850 Results

INFORMATION SECURITY PROGRAM METRICS

TECHNOLOGY RECOVERY TESTING

INFORMATION SECURITY COMPLIANCE

INCIDENT HANDLING

LIMITING USE AND DISCLOSURE

INCIDENT RESPONSE TRAINING

PERSONNEL MANAGEMENT

SOFTWARE USAGE RESTRICTIONS

INFORMATION SECURITY PROGRAM

GOVERNING PROVISIONS

SYSTEM DEVELOPMENT LIFECYCLE (SDLC)

INDIVIDUAL ACCESS TO PERSONAL INFORMATION

VULNERABILITY AND THREAT MANAGEMENT

INFORMATION ASSET DOCUMENTATION

IDENTITY AND ACCESS MANAGEMENT

DATA RETENTION AND DESTRUCTION

INFORMATION INTEGRITY

SECURITY AND PRIVACY TRAINING

INFORMATION SECURITY INCIDENT MANAGEMENT

ENCRYPTION