Policy 7230A - Department of Administration

6. Systems Operation
These Systems Operations Mandatory Baselines support the Enterprise Security Policy (ITEC
7230 Rev 1), and the IT Security Self Assessment Policy (ITEC 7310).
Mandatory
Non-Mandatory
Procedures Baselines Procedures Baselines
6. Systems Operation
6.1. Assessment Operations
6.1.1. Perform Security Assessment (7 sets) (3 sets)
6.1.2. Perform Security Self Assessment (4 sets) (2 sets)
6.2. Integrity Operations
6.2.1. Monitor System Security Controls (3 sets) (1 sets)
6.3. Maintenance Operations
6.3.1. Plan for, and Provide Notice of, Security Operations (4 sets) (1 sets)
6.3.2. Perform Patch and Vulnerability Management (5 sets) (3 sets)
6.3.3. Securely Maintain Systems (2 sets) (2 sets)
6.4. Maintain Records
6.1. Assessment Operations
The following are the Mandatory Baselines that support the Assessment Operations
section of the Default Security Requirements:
6.1.1. Perform Security Assessments
No applicable Mandatory Baselines.
6.1.2. Perform Security Self Assessment
To ensure compliance with Kansas Policies and Procedures, all Agencies must
perform a Security Self Assessment:
6.1.2.a Security Assessment Scheduling and Frequency
• Security self assessments must be performed on an annual
basis.
6.1.2.b Security Assessment Data Management
• Security self assessment data must be treated as Very High
risk and all systems that store such data must also be
considered Very High risk. Both data and systems must be
afforded appropriate protection based on this risk
classification.
• Self assessment reports must be retained for two years.
6.2. Integrity Operations
No applicable Mandatory Baselines.
6.3. Maintenance Operations
No applicable Mandatory Baselines.
Mandatory Baselines
Page 12 of 25