Policy 7230A - Department of Administration

6 Systems Operation
Sections 6.1, 6.2, and 6.3 constitute the State of Kansas’ System Operations Policy. This
policy is accompanied by defined System Operations Mandatory and Non-Mandatory
Procedures and Baselines that are distributed in a companion document.
21
Mandatory
Non-Mandatory
Procedures Baselines Procedures Baselines
6. Systems Operation
6.1. Assessment Operations
6.1.1. Perform Security Assessment (7 sets) (3 sets)
6.1.2. Perform Security Self Assessment (4 sets) (2 sets)
6.2. Integrity Operations
6.2.1. Monitor System Security Controls (3 sets) (1 sets)
6.3. Maintenance Operations
6.3.1. Plan for, and Provide Notice of, Security Operations (4 sets) (1 sets)
6.3.2. Perform Patch and Vulnerability Management (5 sets) (3 sets)
6.3.3. Securely Maintain Systems (2 sets) (2 sets)
6.1 Assessment Operations
The State of Kansas requires that security assessments be performed against all
information systems. Additionally, vulnerability assessments shall be performed
against all information systems. Security assessments are to be performed on at least
a 3 year time period and vulnerability assessments are to be performed on at least an
annual basis.
Security and vulnerability assessments differ from each other in their focus. The focus
of a security assessment is determining the degree to which information system
security controls are correctly implemented, operating as intended and producing the
desired level of security. The focus of a vulnerability assessment is determining the
weaknesses inherent in the information systems that could be exploited leading to
information system breach.
It is recommended that both security assessments and vulnerability assessments be
performed by independent and impartial third parties on a periodic basis.
In the event that the security or vulnerability assessment discovers issues that must be
corrected the security plan (see section 2.2) shall be immediately updated with the
remedial actions required to address the discovered issues. Further, the security plan
shall be reviewed on an at least quarterly basis to ensure appropriate corrective
actions have been taken.
6.2 Integrity Operations
The State of Kansas requires information systems to be actively monitored for
integrity purposes. Integrity monitoring will be performed according to set processes.
System integrity monitoring serves as an oversight process of normal operational and
maintenance processes. Without integrity monitoring, the potential exists that where