Search DGS

1521 - 1540 of 1848 Results

ACTIVATE ONLY ESSENTIAL FUNCTIONALITY

Chapter: 5300

Section: 5315.6

Policy: Each state entity shall configure information assets to provide only essential capabilities and functionality, and shall adhere to the principle of least privilege and restrict the use of unnecessary ports, protocols, and/or services to minimize the state entity’s risk. Implementation ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5315-6
INCIDENT RESPONSE TRAINING

Chapter: 5300

Section: 5340.1

Policy: Each state entity shall provide incident response training to information system users consistent with assigned roles and responsibilities. Incident response training shall be at an appropriate level for the assigned roles and responsibilities of state entity personnel. For example, regular ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5340-1
SECURITY SAFEGUARDS

Chapter: 5300

Section: 5310.7

Policy: Information asset owners shall apply all applicable statewide and state entity information security laws, policies, standards, and procedures in order to protect personal information under the information asset owner’s responsibility. Implementation Controls: Personally Identifiab ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5310-7
MEDIA PROTECTION

Chapter: 5300

Section: 5365.2

Policy: Each state entity shall safeguard media in digital and/or non-digital form from unauthorized access, use, modification or disposal, inside or outside of the state entity’s control areas whether in storage or transport. Implementation Controls: NIST SP 800-53: Media Protection (MP ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5365-2
INCIDENT REPORTING

Chapter: 5300

Section: 5340.4

Policy: Each state entity shall follow the incident reporting procedures as described in SIMM 5340-A. Implementation Controls: NIST SP 800-53: Incident Response (IR); SIMM 5340-A

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5340-4
INFORMATION ASSET CONNECTIONS

Chapter: 5300

Section: 5315.8

Policy: Each state entity shall carefully consider the risks that may be introduced when information assets are connected to other systems with different security requirements and security controls, both within the state entity and external to the state entity. Each state entity shall identify and m ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5315-8
RISK MANAGEMENT

Chapter: 5300

Section: 5305.6

Policy: Each state entity shall create a state entity-wide information security, privacy and risk management strategy which includes a clear expression of risk tolerance for the organization, acceptable risk assessment methodologies, risk mitigation strategies, and a process for consistently evaluat ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5305-6
BUSINESS CONTINUITY WITH TECHNOLOGY RECOVERY

Chapter: 5300

Section: 5325

Introduction: The entire concept of business continuity is based on the identification of all business functions and critical infrastructure within a state entity in order to assign a level of importance to each business function and infrastructure (including critical infrastructure). A business imp ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5325
ARRANGEMENT OF CHAPTER

Chapter: 5300

Section: 5300.1

This Chapter and its corresponding sections are organized as follows: Introduction: A brief description introducing the section, when necessary. Policy: A clear and unambiguous “Policy” statement which directs state entities at a high level as to required actions and outcomes. Governing ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5300-1
TECHNOLOGY RECOVERY PLAN

Chapter: 5300

Section: 5325.1

Introduction: The Technology Recovery Plan (TRP) is a sub-set of the Agency/state entity’s Business Continuity Plan. The TRP is activated immediately after a disaster strikes and focuses on getting critical systems back online. Policy: Each Agency/state entity shall develop a ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5325-1
STATE ENTITY PRIVACY STATEMENT AND NOTICE ON COLLECTION

Chapter: 5300

Section: 5310.1

Policy: Information asset owners shall be open about state entity information handling practices, including the purposes for which the state entity collects, uses, and discloses personal information of individuals. Each state entity Privacy Program Coordinator shall prepare, publish, and maintain a ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5310-1
SECURITY ASSESSMENTS

Chapter: 5300

Section: 5330.1

Policy: Each state entity shall perform security assessments to determine whether the security controls selected by the state entity are implemented correctly and working as intended to mitigate risk. Security assessments conducted by the state entity shall include, but are not limited to, the follo ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5330-1
COMPLIANCE REPORTING

Chapter: 5300

Section: 5330.2

Policy: Each state entity shall comply with the following reporting requirements: Designation Letter (SIMM 5330-A) – Annual submissions are due to the Office of Information Security (OIS) on the last business day of the state entity’s scheduled reporting month, as outlined in the Infor ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5330-2
SYSTEM AND SERVICES ACQUISITION

Chapter: 5300

Section: 5315.1

Policy: Each state entity shall determine the information security requirements (confidentiality, integrity, and availability) for its information assets in mission/business process planning; determine, document and allocate the resources required to protect the information assets as part of its cap ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5315-1
SECURITY AND PRIVACY AWARENESS

Chapter: 5300

Section: 5320.1

Policy: Each state entity shall provide basic security and privacy awareness training to all information asset users (all personnel, including managers and senior executives) as part of initial training for new users and annually thereafter. Each state entity shall determine the appropriate content ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5320-1
INCIDENT RESPONSE TESTING

Chapter: 5300

Section: 5340.2

Introduction: Incident response testing includes an assessment of the effects on state entity operations (e.g., reduction in mission capabilities), state entity assets, and individuals due to incident response, and involves the use of checklists, walk-through or tabletop exercises, and simulations t ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5340-2
PRIVACY THRESHOLD AND PRIVACY IMPACT ASSESSMENTS

Chapter: 5300

Section: 5310.8

Policy: Information asset owners shall apply all applicable statewide and state entity information privacy and security laws, policies, standards, and procedures in order to protect personal information under the information asset owner’s responsibility. This includes, but is not limited to co ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5310-8
INTRODUCTION

Chapter: 5300

Section: 5300

Information security refers to the protection of information, information systems, equipment, software, and people from a wide spectrum of threats and risks. Implementing appropriate security measures and controls to provide for the confidentiality, integrity, and availability of information, regard ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5300
OPERATIONAL SECURITY

Chapter: 5300

Section: 5350

Introduction: In order to mitigate against successful attacks, each state entity is responsible for separating and controlling access to various systems and networks with different threat levels and sets of users which may operate or interface within their technology environment. Policy: Each state ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5350
CONFIGURATION MANAGEMENT

Chapter: 5300

Section: 5315.5

Policy: Each state entity shall establish a documented process regarding controlled modifications to hardware, firmware, and software to protect the information asset against improper modification before, during, and after system implementation. Implementation Controls: NIST SP 800-53: Configu ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5315-5