Policy 7230A - Department of Administration

Appendix C – Supporting Document Cross Reference Grid
Mandatory
Non-Mandatory
Procedures Baselines Procedures Baselines
2. Assessment & Security Planning
2.1. Risk and Privacy Assessment
2.1.1. Perform Risk Assessment (7 sets) (3 sets)
2.1.2. Perform Privacy Assessment (7 sets) (3 sets)
2.2. Security Planning
2.2.1. Create a Security Plan (5 sets) (3 sets)
2.3. Maintain Records
3. Awareness & Training
3.1. Security Awareness Training
3.1.1. Design and Develop an Awareness Training Program (2 sets) (1 set)
3.1.2. Provide Awareness Training (2 sets) (1 set)
3.2. Security Operations Training
3.2.1. Design and Develop an Operations Training Program (2 sets) (1 set)
3.2.2. Provide Operations Training (3 sets) (2 sets)
3.3. Maintain Records
4. Access Control
4.1. Identification and Authentication
4.1.1. Manage Identification and Authentication (6 sets) (4 sets)
4.2. Account Management
4.2.1. Configure User Accounts (4 sets) (2 sets)
4.3. Session Management
4.3.1. Configure Systems for Secure Access (6 sets) (3 sets)
4.3.2. Configure Systems for Secure Communications (3 sets) (1 set)
4.4. Maintain Records
5. Systems Configuration
5.1. Configuration Management
5.1.1. Build and Maintain a Systems Inventory (3 sets) (4 sets)
5.1.2. Perform Systems and Data Classification (5 sets) (2 sets)
5.1.3. Follow Process by Change Control (6 sets) (2 sets)
5.2. Systems Protection
5.2.1. Create and Maintain Security Infrastructure (3 sets) (2 sets)
5.3. Data/Media Protection
5.3.1. Securely Handle Data and Media (2 sets) (3 sets) (5 sets) (2 sets)
5.4. Application Protection
5.4.1. Apply Security Principles to Code Development (4 sets) (4 sets)
5.5. Maintain Records
6. Systems Operation
6.1. Assessment Operations
6.1.1. Perform Security Assessment (7 sets) (3 sets)
6.1.2. Perform Security Self Assessment (4 sets) (2 sets)
6.2. Integrity Operations
6.2.1. Monitor System Security Controls (3 sets) (1 sets)
47