Policy 7230A - Department of Administration
Policy 7230A - Department of Administration Policy 7230A - Department of Administration
9.2.1.a Required Contingency Infrastructure • The use of data backup and restoration is an appropriate contingency measure for circumstances where data may become corrupted but primary systems continue to be available. • The use of redundant systems in the primary location is an appropriate contingency measure for circumstances where primary systems may become unavailable but primary facilities continue to be available. • The use of redundant facilities in an alternate location is an appropriate contingency measure for circumstances where primary facilities may become unavailable. Primary and redundant facilities must be geographically disparate enough so as not to be affected by the same event. • The use of redundant power delivery systems is an appropriate contingency measure where power fluctuations may render primary or secondary processing facilities powerless. Uninterruptible power supplies must provide for at least 5 minutes of continuous operations and generators must be provided with sufficient fuel for at least 48 hours of continuous operations. • The use of redundant telecommunications links is an appropriate contingency measure for circumstances where primary links may be lost but where systems require continuous inbound and outbound network connectivity. 9.3. Contingency Operations The following are the Mandatory Procedures that support the Contingency Operations section of the Default Security Requirements: 9.3.1. Build a Team and Provide Training Contingency planning is a security control that requires specialized capabilities. Building a team ensures they are always appropriately provided for: 9.3.1.a Required Contingency Capabilities • Communications and coordination skills are required to manage the various team members and activities and to share information with employees of the organization outside of the contingency team. • Network management skills are required to ensure efficient and effective migration of communications functions during a disruption. Mandatory Baselines Page 18 of 25
Mandatory Baselines • Systems management skills are required to ensure efficient and effective migration of system functions during a disruption. • Security management skills are required to ensure efficient and effective migration of security infrastructure functions during a disruption. 9.3.1.b Required Contingency Roles • Contingency Team Managers must be assigned primary responsibilities of coordination and communication. Secondary responsibilities can extend into the various technical areas according to the skill set of the individual. • Contingency Network Leads must be assigned primary responsibilities of network migration. Secondary responsibilities can extend into any area according to the skill set of the individual but are likely to match best to security infrastructure management. • Contingency Systems Leads must be assigned primary responsibilities of specific system migration. Secondary responsibilities can extend into any area according to the skill set of the individual but are likely to match best to system management of alternate systems. • Contingency Security Leads must be assigned primary responsibilities of security infrastructure migration. Secondary responsibilities can extend into any area according to the skill set of the individual. 9.3.1.c Contingency Training Frequency and Scheduling • Contingency training shall be provided for all contingency team members within 90 days of initial assignment of the individual to the contingency team. • Contingency training shall be provided thereafter for all contingency team members on an at least annual basis. Where possible, team members will be trained together as a group. 9.3.2. Backup Scheduling and Frequency Systems and data backups are an important component of any contingency plan or contingency operations and so backups must be taken according to appropriate schedule: 9.3.2.a Required Backup Schedule • Those systems deemed as critical by the organization will be fully backed up on both a monthly and a weekly basis and incrementally or differentially backed up on a daily basis. Page 19 of 25
- Page 57 and 58: State of Kansas Mandatory Procedure
- Page 59 and 60: 6.2. Integrity Operations .........
- Page 61 and 62: 2. Assessment & Security Planning T
- Page 63 and 64: 2.2. Create a Security Plan No appl
- Page 65 and 66: 3.1.1.2 Create Training Materials O
- Page 67 and 68: Operations Training is defined as t
- Page 69 and 70: access individual system authentica
- Page 71 and 72: 5. Systems Configuration These Syst
- Page 73 and 74: 5.3.1.3 Restrict Access to Media No
- Page 75 and 76: • When no longer required, data s
- Page 77 and 78: 8. Incident Response These Incident
- Page 79 and 80: Capture documentation appropriate t
- Page 81 and 82: Different types of disruptions requ
- Page 83 and 84: 9.3.2.1 Perform System Backup Back
- Page 85 and 86: 11. Personnel Security These Person
- Page 87 and 88: 12. Secure Purchasing/Acquisition N
- Page 89 and 90: Table of Contents Introduction ....
- Page 91 and 92: Introduction This Mandatory Baselin
- Page 93 and 94: 2.1.2.c Information Protection •
- Page 95 and 96: o Appropriate physical security mea
- Page 97 and 98: 4. Access Control These Assessment
- Page 99 and 100: 5. Systems Configuration These Syst
- Page 101 and 102: 5.3.1.c Media Disposal Methods •
- Page 103 and 104: 6.4. Maintain Records Agencies must
- Page 105 and 106: 8. Incident Response These Incident
- Page 107: 9.1.1.c Contingency Plan Update Fre
- Page 111 and 112: 10. Physical Security No applicable
- Page 113 and 114: • Data is to be used for its inte
- Page 115 and 116: State of Kansas Non-Mandatory Proce
- Page 117 and 118: 6.3. Maintenance Operations .......
- Page 119 and 120: Introduction This Non-Mandatory Pro
- Page 121 and 122: 2.1.1.4 Likelihood Determination Es
- Page 123 and 124: 2.2.1.5 Establish Appropriate Secur
- Page 125 and 126: 4. Access Control These Assessment
- Page 127 and 128: 4.3. Session Management The followi
- Page 129 and 130: 4.3.2.2 Restrict Intra and Inter-Sy
- Page 131 and 132: 5.1.1.3 Actively Maintain Inventory
- Page 133 and 134: 5.1.3.3 Provide Implementation Docu
- Page 135 and 136: • Place all media in a locked con
- Page 137 and 138: 6. Systems Operation These Systems
- Page 139 and 140: 6.2. Integrity Operations The follo
- Page 141 and 142: 6.3.2. Perform Patch and Vulnerabil
- Page 143 and 144: 6.4. Maintain Records Agencies shou
- Page 145 and 146: 7.1.1.3 Require Authenticated Acces
- Page 147 and 148: 8. Incident Response These Incident
- Page 149 and 150: 8.1.2.2 Develop Supporting Strategi
- Page 151 and 152: 9. Contingency Planning No applicab
- Page 153 and 154: 10.1.1.2 Implement Physical Access
- Page 155 and 156: 11. Personnel Security These Person
- Page 157 and 158: • Review created accounts and ass
Mandatory Baselines<br />
• Systems management skills are required to ensure efficient<br />
and effective migration <strong>of</strong> system functions during a<br />
disruption.<br />
• Security management skills are required to ensure efficient<br />
and effective migration <strong>of</strong> security infrastructure functions<br />
during a disruption.<br />
9.3.1.b Required Contingency Roles<br />
• Contingency Team Managers must be assigned primary<br />
responsibilities <strong>of</strong> coordination and communication.<br />
Secondary responsibilities can extend into the various<br />
technical areas according to the skill set <strong>of</strong> the individual.<br />
• Contingency Network Leads must be assigned primary<br />
responsibilities <strong>of</strong> network migration. Secondary<br />
responsibilities can extend into any area according to the skill<br />
set <strong>of</strong> the individual but are likely to match best to security<br />
infrastructure management.<br />
• Contingency Systems Leads must be assigned primary<br />
responsibilities <strong>of</strong> specific system migration. Secondary<br />
responsibilities can extend into any area according to the skill<br />
set <strong>of</strong> the individual but are likely to match best to system<br />
management <strong>of</strong> alternate systems.<br />
• Contingency Security Leads must be assigned primary<br />
responsibilities <strong>of</strong> security infrastructure migration. Secondary<br />
responsibilities can extend into any area according to the skill<br />
set <strong>of</strong> the individual.<br />
9.3.1.c Contingency Training Frequency and Scheduling<br />
• Contingency training shall be provided for all contingency<br />
team members within 90 days <strong>of</strong> initial assignment <strong>of</strong> the<br />
individual to the contingency team.<br />
• Contingency training shall be provided thereafter for all<br />
contingency team members on an at least annual basis.<br />
Where possible, team members will be trained together as a<br />
group.<br />
9.3.2. Backup Scheduling and Frequency<br />
Systems and data backups are an important component <strong>of</strong> any contingency<br />
plan or contingency operations and so backups must be taken according to<br />
appropriate schedule:<br />
9.3.2.a Required Backup Schedule<br />
• Those systems deemed as critical by the organization will be<br />
fully backed up on both a monthly and a weekly basis and<br />
incrementally or differentially backed up on a daily basis.<br />
Page 19 <strong>of</strong> 25
Change language