SearchResult

321 - 340 of 1848 Results

SYSTEM DEVELOPMENT LIFECYCLE

Chapter: 5300

Section: 5315.2

Policy: Each state entity shall manage its information assets using a documented SDLC methodology that: Incorporates information security (data confidentiality, integrity and availability) including business impact assessment requirements and considerations; Incorporates information privacy prote ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5315-2
INDIVIDUAL ACCESS TO PERSONAL INFORMATION

Chapter: 5300

Section: 5310.4

Policy: Each state entity shall ensure individuals are provided with information about their access rights and the procedures for exercising those rights. Individuals Right to Access Each state entity Privacy Program Coordinator shall publish procedures for individuals to follow in exercising their ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5310-4
VULNERABILITY AND THREAT MANAGEMENT

Chapter: 5300

Section: 5345

Introduction: Threats and vulnerabilities provide the primary inputs to the state entity’s risk assessment process. Policy: Each state entity shall continuously identify and remediate vulnerabilities before they can be exploited. Vulnerability and threat management include, but not limited to, ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5345
INFORMATION ASSET DOCUMENTATION

Chapter: 5300

Section: 5315.3

Policy: In conjunction with Records Management (SAM Chapter 1600) and Property Accounting (SAM Chapter 8600) requirements, each state entity shall ensure information security documentation is prepared and maintained as part of the overall documentation for all information assets. Documentation shall ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5315-3
TECHNOLOGY RECOVERY TESTING

Chapter: 5300

Section: 5325.3

Policy: Each state entity shall test the TRP to determine its effectiveness and the state entity’s readiness to execute the TRP in the event of a disaster. Each state entity shall initiate corrective actions and improvements to the TRP based upon deficiencies identified during testing and exer ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5325-3
DATA RETENTION AND DESTRUCTION

Chapter: 5300

Section: 5310.6

Policy: Information asset owners shall retain and/or destroy records of personal information in accordance with the state entity’s record retention and destruction policy and the Privacy Individual Access Standard (SIMM 5310-B). Information asset owners shall take reasonable steps to keep pers ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5310-6
INFORMATION INTEGRITY

Chapter: 5300

Section: 5310.5

Policy: Information asset owners shall maintain all records with accuracy, relevance, timeliness, and completeness. Maintaining Record Integrity When an information asset owner uses a record to make a determination about an individual or transfers a record to another state or non-state entity, the o ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5310-5
SECURITY AND PRIVACY TRAINING

Chapter: 5300

Section: 5320.2

Policy: Each state entity shall determine the appropriate content of security and privacy training based on the assigned roles and responsibilities of individuals and the specific security requirements of the state entity and the information assets to which personnel have access. Privacy training co ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5320-2
INFORMATION SECURITY INCIDENT MANAGEMENT

Chapter: 5300

Section: 5340

Policy: Each state entity must promptly investigate incidents involving loss, theft, damage, misuse of information assets, or improper dissemination of information. All state entities are required to report information security incidents consistent with the security reporting requirements in this po ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5340
ENCRYPTION

Chapter: 5300

Section: 5350.1

Policy: End-to-end encryption or approved compensating security control(s) shall be used to protect confidential, sensitive, or personal information that is transmitted or accessed outside the secure internal network (e.g., email, remote access, file transfer, Internet/website communication tools) o ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5350-1
POLICY, PROCEDURE AND STANDARDS MANAGEMENT

Chapter: 5300

Section: 5305.2

Policy: Each state entity must provide for the protection of its information assets by establishing appropriate administrative, operational and technical policies, standards, and procedures to ensure its operations conform with business requirements, laws, and administrative policies, and personnel ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5305-2
ALTERNATE STORAGE AND PROCESSING SITE

Chapter: 5300

Section: 5325.4

Policy: Each state entity shall establish an alternate storage site, including the necessary agreements to permit the storage and recovery of backup information. Each state entity shall ensure that the alternate storage site provides information security safeguards equivalent to that of the primary ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5325-4
SECURITY ALERTS, ADVISORIES, AND DIRECTIVES

Chapter: 5300

Section: 5355.2

Policy: Each state entity shall receive information asset security alerts, advisories, and directives from various legitimate external sources and shall act on those to mitigate state entity risk, including generating internal security alerts, advisories, and directives as deemed necessary. Implemen ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5355-2
DEFINITIONS

Chapter: 5300

Section: 5300.4

Policy: Each state entity shall use the information security and privacy definitions issued by the CISO in implementing information security and privacy policy in their daily operations. The definitions are located on the CISO website at Security Technical Definitions

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5300-4
INFORMATION SYSTEM BACKUPS

Chapter: 5300

Section: 5325.6

Policy: Each state entity shall perform regularly scheduled backups of system and user-level information. Backups shall be: Conducted at the operating system, application, and user level; Conducted of information system documentation including security-related documentation; Stored in a protecte ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5325-6
MINIMUM SECURITY CONTROLS

Chapter: 5300

Section: 5300.5

Policy: California has adopted the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 as minimum information security control requirements to support implementation and compliance with the Federal Information Processing Standards (FIPS). Each state entity shall use ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5300-5
PERSONNEL SECURITY

Chapter: 5300

Section: 5320.4

Policy: Each state entity shall establish processes and procedures to ensure that individual access to information assets is commensurate with job-related responsibilities, and individuals requiring access to information assets sign appropriate user agreements prior to being granted access. Access a ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5320-4
IDENTITY AND ACCESS MANAGEMENT

Chapter: 5300

Section: 5360

Policy: Each state entity shall safeguard access to information assets by managing the identities of users and devices and controlling access to resources and data bases on a need to know basis throughout the identity lifecycle. Each state entity shall establish processes and procedures to ensure: ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5360
PROVISIONS FOR AGREEMENTS WITH STATE AND NON-STATE ENTITIES

Chapter: 5300

Section: 5305.8

Introduction: State entities are required to enter into written agreements with state and non-state entities when they engage such entities in the development, use, or maintenance of information systems, products, solutions, or services. Policy: Each state entity shall ensure agreements with stat ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5305-8
TRAINING AND AWARENESS FOR INFORMATION SECURITY AND PRIVACY

Chapter: 5300

Section: 5320

Policy: Each state entity must establish and maintain an information security and privacy training and awareness program. State entity personnel must possess the knowledge and skills necessary to use information technology to the best advantage for the state. Each state entity must regularly assess ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5320

Search DGS

321 - 340 of 1848 Results

SYSTEM DEVELOPMENT LIFECYCLE

INDIVIDUAL ACCESS TO PERSONAL INFORMATION

VULNERABILITY AND THREAT MANAGEMENT

INFORMATION ASSET DOCUMENTATION

TECHNOLOGY RECOVERY TESTING

DATA RETENTION AND DESTRUCTION

INFORMATION INTEGRITY

SECURITY AND PRIVACY TRAINING

INFORMATION SECURITY INCIDENT MANAGEMENT

ENCRYPTION

POLICY, PROCEDURE AND STANDARDS MANAGEMENT

ALTERNATE STORAGE AND PROCESSING SITE

SECURITY ALERTS, ADVISORIES, AND DIRECTIVES

DEFINITIONS

INFORMATION SYSTEM BACKUPS

MINIMUM SECURITY CONTROLS

PERSONNEL SECURITY

IDENTITY AND ACCESS MANAGEMENT

PROVISIONS FOR AGREEMENTS WITH STATE AND NON-STATE ENTITIES

TRAINING AND AWARENESS FOR INFORMATION SECURITY AND PRIVACY