Policy 7230A - Department of Administration

5.1.1.c System and Component Documentation
• Inventories should include the following documentation
information:
o Implementation documentation.
o Configuration documentation.
o Operations documentation.
o Test and assessment documentation.
5.1.1.d Inventory Update Scheduling and Frequency
• The system inventory should be reviewed and updated on an
at least annual basis.
5.1.2. Perform Systems and Data Classification
In order to most efficiently protect information systems and the information
they store and/or process, Agencies should perform security categorization:
5.1.2.a Security Impact Level Scheme
• High impact indicates significant loss of assets or resources,
significant damage to the organizational mission, or serious
human injury or death.
• Medium impact indicates moderate loss of assets or
resources, moderate damage to the organizational mission, or
human injury.
• Low impact indicates minimal loss of assets or resources, or
minimal damage to the organizational mission.
5.1.2.b Security Categorization Scheme
• Assign a High categorization where at least one of
confidentiality, integrity or availability is assessed an impact
level of high.
• Assign a Moderate categorization where at least one of
confidentiality, integrity or availability is assessed an impact
level of moderate and none are assessed an impact level of
high.
• Assign a Low categorization where confidentiality, integrity
and availability are all assigned an impact level of low.
5.1.3. Follow Process for Change Control
To ensure that the security that is engineered into systems and system
components is maintained long term, organization should perform changes to
those systems and components in a controlled manner:
11