Policy 7230A - Department of Administration

o Penetration testing.
o Password cracking.
o Social engineering.
o Permission elevation.
6.1.1.b Security Assessment Scheduling and Frequency
• External vulnerability assessments should be performed on an
at least annual basis.
• Internal vulnerability assessments should be performed on an
at least bi-annual basis.
• Complete security assessments should be performed on an at
least tri-annual basis.
6.1.1.c Security Assessment Data Management
• Security assessment reports should include the following
information:
o The nature of the findings.
o Any increased risk as a result of the findings.
o The adjustments that must be made to system risk
impact if no remediation is performed.
o The appropriate risk mitigation techniques that could
be adopted and the adjustments these will have to
system risk.
o The projected cost of proposed risk mitigation
strategies.
• Security assessment data should be treated as Very High risk
and all systems that store such data should also be considered
Very High risk. Both data and systems should be afforded
appropriate protection based on this risk classification.
• Assessment data should be retained according to the
following schedule:
o Raw assessment data should be retained for a period
of no greater than six months or until all discovered
security problems have been demonstrably resolved,
whichever comes last.
o Assessment reports should be retained for the
equivalent of two full subsequent assessment periods.
Reports associated with annually conducted
assessments should be retained two years, reports
associated with bi-annually conducted assessments
should be retained four years, etc.
6.1.2. Perform Security Self Assessment
No applicable Non-Mandatory Baselines.
17