Search DGS

1501 - 1520 of 1848 Results

ENCRYPTION

Chapter: 5300

Section: 5350.1

Policy: End-to-end encryption or approved compensating security control(s) shall be used to protect confidential, sensitive, or personal information that is transmitted or accessed outside the secure internal network (e.g., email, remote access, file transfer, Internet/website communication tools) o ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5350-1
POLICY, PROCEDURE AND STANDARDS MANAGEMENT

Chapter: 5300

Section: 5305.2

Policy: Each state entity must provide for the protection of its information assets by establishing appropriate administrative, operational and technical policies, standards, and procedures to ensure its operations conform with business requirements, laws, and administrative policies, and personnel ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5305-2
ALTERNATE STORAGE AND PROCESSING SITE

Chapter: 5300

Section: 5325.4

Policy: Each state entity shall establish an alternate storage site, including the necessary agreements to permit the storage and recovery of backup information. Each state entity shall ensure that the alternate storage site provides information security safeguards equivalent to that of the primary ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5325-4
SECURITY ALERTS, ADVISORIES, AND DIRECTIVES

Chapter: 5300

Section: 5355.2

Policy: Each state entity shall receive information asset security alerts, advisories, and directives from various legitimate external sources and shall act on those to mitigate state entity risk, including generating internal security alerts, advisories, and directives as deemed necessary. Implemen ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5355-2
DEFINITIONS

Chapter: 5300

Section: 5300.4

Policy: Each state entity shall use the information security and privacy definitions issued by the CISO in implementing information security and privacy policy in their daily operations. The definitions are located on the CISO website at Security Technical Definitions

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5300-4
INFORMATION SYSTEM BACKUPS

Chapter: 5300

Section: 5325.6

Policy: Each state entity shall perform regularly scheduled backups of system and user-level information. Backups shall be: Conducted at the operating system, application, and user level; Conducted of information system documentation including security-related documentation; Stored in a protecte ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5325-6
MINIMUM SECURITY CONTROLS

Chapter: 5300

Section: 5300.5

Policy: California has adopted the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 as minimum information security control requirements to support implementation and compliance with the Federal Information Processing Standards (FIPS). Each state entity shall use ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5300-5
PERSONNEL SECURITY

Chapter: 5300

Section: 5320.4

Policy: Each state entity shall establish processes and procedures to ensure that individual access to information assets is commensurate with job-related responsibilities, and individuals requiring access to information assets sign appropriate user agreements prior to being granted access. Access a ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5320-4
IDENTITY AND ACCESS MANAGEMENT

Chapter: 5300

Section: 5360

Policy: Each state entity shall safeguard access to information assets by managing the identities of users and devices and controlling access to resources and data bases on a need to know basis throughout the identity lifecycle. Each state entity shall establish processes and procedures to ensure: ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5360
PROVISIONS FOR AGREEMENTS WITH STATE AND NON-STATE ENTITIES

Chapter: 5300

Section: 5305.8

Introduction: State entities are required to enter into written agreements with state and non-state entities when they engage such entities in the development, use, or maintenance of information systems, products, solutions, or services. Policy: Each state entity shall ensure agreements with stat ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5305-8
TRAINING AND AWARENESS FOR INFORMATION SECURITY AND PRIVACY

Chapter: 5300

Section: 5320

Policy: Each state entity must establish and maintain an information security and privacy training and awareness program. State entity personnel must possess the knowledge and skills necessary to use information technology to the best advantage for the state. Each state entity must regularly assess ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5320
INFORMATION SECURITY PROGRAM MANAGEMENT

Chapter: 5300

Section: 5305.1

Policy: Each state entity must provide for the proper use and protection of its information assets. Accordingly each state entity shall: Develop, implement, and maintain a state entity-wide Information Security Program Plan. Ensure the plan documentation provides the following: an over ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5305-1
APPLICABILITY

Chapter: 5300

Section: 5300.3

Policy: SAM Chapter 5300 shall apply to the following: All state entities unless otherwise specifically exempted by law or state policy. All categories of automated and paper information, including, but not limited to, records, files, and databases. Information technology facilities, softw ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5300-3
INFORMATION ASSET MANAGEMENT

Chapter: 5300

Section: 5305.5

Introduction: Information Asset Management (IAM) is a collection of knowledge or data that is organized, managed, and valuable. It involves safeguarding sensitive data ensuring that information is readily available to support decision-making, innovation, and operational efficiency. Policy: ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5305-5
AUDITABLE EVENTS

Chapter: 5300

Section: 5335.2

Introduction: Audit records can be generated at various levels of abstraction, including at the packet level as information traverses the network. Selecting the right level of abstraction is a critical aspect of an audit capability and can facilitate the identification of root causes to events. Each ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5335-2
SYSTEM DEVELOPER SECURITY TESTING

Chapter: 5300

Section: 5315.4

Policy: Each state entity shall require that system developers create and implement a security test and evaluation plan as part of the system design and build. When a contract is required, it shall specify the acceptance criteria for security test and evaluation plans and vulnerability remediation p ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5315-4
WIRELESS ACCESS

Chapter: 5300

Section: 5360.2

Policy: Each state entity shall establish appropriate restrictions and implementation instructions for wireless access, and enforce requirements for wireless connections to information systems. Each state entity shall also proactively search for unauthorized wireless connections including scans for ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5360-2
RISK ASSESSMENT

Chapter: 5300

Section: 5305.7

Policy: Each state entity shall conduct an assessment of risk, including the likelihood and magnitude of harm from the unauthorized access, use, disclosure, disruption, modification, or destruction of the information system/asset and the information it processes, stores, or transmits. Each state ent ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5305-7
MALICIOUS CODE PROTECTION

Chapter: 5300

Section: 5355.1

Policy: Each state entity shall employ malicious code protection mechanisms at information asset entry and exit points and at workstations, servers, or mobile computing devices on the network to detect and eradicate malicious code. Malicious code protection mechanisms may not always detect malicious ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5355-1
LIMITING COLLECTION

Chapter: 5300

Section: 5310.2

Policy: Information asset owners shall collect the least amount of personal information that is required to fulfill the purposes for which it is being collected. Information asset owners shall obtain personal information only through lawful means and shall collect personal information to the greates ...

https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5310-2