Search DGS

1721 - 1740 of 1850 Results

COMPLIANCE REPORTING

Chapter: 5300

Section: 5330.2

Policy: Each state entity shall comply with the following reporting requirements: Designation Letter (SIMM 5330-A) – Annual submissions are due to the Office of Information Security (OIS) on the last business day of the state entity’s scheduled reporting month, as outlined in the Infor ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5330-2
SECURITY SAFEGUARDS

Chapter: 5300

Section: 5310.7

Policy: Information asset owners shall apply all applicable statewide and state entity information security laws, policies, standards, and procedures in order to protect personal information under the information asset owner’s responsibility. Implementation Controls: Personally Identifiab ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5310-7
MEDIA PROTECTION

Chapter: 5300

Section: 5365.2

Policy: Each state entity shall safeguard media in digital and/or non-digital form from unauthorized access, use, modification or disposal, inside or outside of the state entity’s control areas whether in storage or transport. Implementation Controls: NIST SP 800-53: Media Protection (MP ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5365-2
ACCESS CONTROL FOR OUTPUT DEVICES

Chapter: 5300

Section: 5365.1

Policy: Each state entity shall control access to information system output devices, such as printers and facsimile devices, to prevent unauthorized individuals from obtaining the output. Implementation Controls: NIST SP 800-53: Physical and Environmental Protection (PE)

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5365-1
INFORMATION ASSET CONNECTIONS

Chapter: 5300

Section: 5315.8

Policy: Each state entity shall carefully consider the risks that may be introduced when information assets are connected to other systems with different security requirements and security controls, both within the state entity and external to the state entity. Each state entity shall identify and m ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5315-8
RISK MANAGEMENT

Chapter: 5300

Section: 5305.6

Policy: Each state entity shall create a state entity-wide information security, privacy and risk management strategy which includes a clear expression of risk tolerance for the organization, acceptable risk assessment methodologies, risk mitigation strategies, and a process for consistently evaluat ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5305-6
BUSINESS CONTINUITY WITH TECHNOLOGY RECOVERY

Chapter: 5300

Section: 5325

Introduction: Continuity planning establishes procedures to sustain business and mission-essential functions during and after a significant disruption or disaster. A Business Impact Analysis (BIA) is a critical input to effective continuity planning, providing the foundation for contingency s ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5325
ARRANGEMENT OF CHAPTER

Chapter: 5300

Section: 5300.1

This Chapter and its corresponding sections are organized as follows: Introduction: A brief description introducing the section, when necessary. Policy: A clear and unambiguous “Policy” statement which directs state entities at a high level as to required actions and outcomes. Governing ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5300-1
TECHNOLOGY RECOVERY PLAN

Chapter: 5300

Section: 5325.1

Introduction: As a sub-set of a state agency or entity’s Continuity Plan, the Technology Recovery Plan (TRP) is activated immediately after a significant disruption or disaster and focuses on priority recovery and restoration of systems, services, and data supporting mission and b ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5325-1
STATE ENTITY PRIVACY STATEMENT AND NOTICE ON COLLECTION

Chapter: 5300

Section: 5310.1

Policy: Information asset owners shall be open about state entity information handling practices, including the purposes for which the state entity collects, uses, and discloses personal information of individuals. Each state entity Privacy Program Coordinator shall prepare, publish, and maintain a ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5310-1
SECURITY ASSESSMENTS

Chapter: 5300

Section: 5330.1

Policy: Each state entity shall perform security assessments to determine whether the security controls selected by the state entity are implemented correctly and working as intended to mitigate risk. Security assessments conducted by the state entity shall include, but are not limited to, the follo ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5330-1
INFORMATION SECURITY INTEGRATION

Chapter: 5300

Section: 5315

Policy: Each state entity is responsible for the integration of information security and privacy within the organization. This includes, but is not limited to, the designing of appropriate security controls in new systems, or systems that are undergoing substantial redesign, including both in-house ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5315
SYSTEM AND SERVICES ACQUISITION

Chapter: 5300

Section: 5315.1

Policy: Each state entity shall determine the information security requirements (confidentiality, integrity, and availability) for its information assets in mission/business process planning; determine, document and allocate the resources required to protect the information assets as part of its cap ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5315-1
SECURITY AND PRIVACY AWARENESS

Chapter: 5300

Section: 5320.1

Policy: Each state entity shall provide basic security and privacy awareness training to all information asset users (all personnel, including managers and senior executives) as part of initial training for new users and annually thereafter. Each state entity shall determine the appropriate content ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5320-1
INCIDENT RESPONSE TESTING

Chapter: 5300

Section: 5340.2

Introduction: Incident response testing includes an assessment of the effects on state entity operations (e.g., reduction in mission capabilities), state entity assets, and individuals due to incident response, and involves the use of checklists, walk-through or tabletop exercises, and simulations t ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5340-2
PRIVACY THRESHOLD AND PRIVACY IMPACT ASSESSMENTS

Chapter: 5300

Section: 5310.8

Policy: Information asset owners shall apply all applicable statewide and state entity information privacy and security laws, policies, standards, and procedures in order to protect personal information under the information asset owner’s responsibility. This includes, but is not limited to co ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5310-8
INTRODUCTION

Chapter: 5300

Section: 5300

Information security refers to the protection of information, information systems, equipment, software, and people from a wide spectrum of threats and risks. Implementing appropriate security measures and controls to provide for the confidentiality, integrity, and availability of information, regard ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5300
OPERATIONAL SECURITY

Chapter: 5300

Section: 5350

Introduction: In order to mitigate against successful attacks, each state entity is responsible for separating and controlling access to various systems and networks with different threat levels and sets of users which may operate or interface within their technology environment. Policy: ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5350
CONFIGURATION MANAGEMENT

Chapter: 5300

Section: 5315.5

Policy: Each state entity shall establish a documented process regarding controlled modifications to hardware, firmware, and software to protect the information asset against improper modification before, during, and after system implementation. Implementation Controls: NIST SP 800-53: Configu ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5315-5
TECHNOLOGY RECOVERY TRAINING

Chapter: 5300

Section: 5325.2

Policy: Each state entity shall establish technology recovery training and exercises for personnel involved in technology recovery, to ensure availability of skilled staff. The training exercises shall include a crisis communication plan, event status reporting requirements, and focused role-based t ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5325-2