Policy 7230A - Department of Administration

2.2 Security Plan
The State of Kansas requires the development and implementation of a security plan
that includes provisions for each information systems. This plan will indicate the
current security stance of each information system, the intended security stance of
each information system, and the steps that need to be taken to achieve this intent.
Security plans allow organizations to establish their intent regarding the on-going
maintenance and/or improvement of security controls to ensure that security is
always given appropriate credence in overall planning exercises. Without security
plans the potential exists that security controls are not kept current with the
protection requirements of the organization.
Security plans shall address the modification/update to the controls that are already in
place as well the implementation of additional controls that are to be put in place.
Further it shall identify the planning process to be used, the individuals charged with
the responsibility of the planning process (including contact information) and the
rationale for the planned security controls. Security plans shall be reviewed and,
where required, updated on at least an annual basis.
As an addendum, where security vulnerability analyses (see section 6.1) determine
that deficiencies or other flaws exist in the security configuration of any information
system, the security plan shall be updated immediately to include provisions for
correcting these flaws and the plan shall be reviewed and, where required, updated
on at least a quarterly basis until remediated or resolved.
8