Policy 7230A - Department of Administration

2.2.1.5 Establish Appropriate Security Baseline Requirements
As a rule, the NIST 800-53 Moderate Baseline is to be applied to all
State systems. Agencies may, at their discretion, determine that the
High Baseline is appropriate for given systems depending on system
and/or agency requirements:
• Review the system to determine if the Moderate Baseline is
not applicable based on system and/or agency requirements.
2.3. Maintain Records
Agencies should capture documentation appropriate to all assessment and planning
processes:
• Document and retain copies of the outcome of all Risk Assessments.
• Document and retain copies of all Security Plans.
5