Policy 7230A - Department of Administration
Policy 7230A - Department of Administration Policy 7230A - Department of Administration
Mandatory Non-Mandatory Procedures Baselines Procedures Baselines 6.3. Maintenance Operations 6.3.1. Plan for, and Provide Notice of, Security Operations (4 sets) (1 sets) 6.3.2. Perform Patch and Vulnerability Management (5 sets) (3 sets) 6.3.3. Securely Maintain Systems (2 sets) (2 sets) 6.4. Maintain Records 7. Systems Audit 7.1. Systems Audit 7.1.1. Configure Auditing Capabilities (4 sets) (3 sets) 7.1.2. Test Auditing Capabilities (3 sets) (2 sets) 7.1.3. Operate Auditing Capabilities (5 sets) (3 sets) 7.2. Maintain Records 8. Incident Response 8.1. Incident Response 8.1.1. Build a Team and Provide Training (4 sets) (4 sets) 8.1.2. Build an Incident Response Capability (4 sets) (5 sets) 8.1.3. Test the Plan (3 sets) (2 sets) 8.1.4. Operate the Plan (5 sets) (3 sets) 8.2. Maintain Records 9. Contingency Planning 9.1. Contingency Plans 9.1.1. Build a Plan (5 sets) (3 sets) 9.1.2. Test the Plan (3 sets) (2 sets) 9.2. Contingency Infrastructure 9.2.1. Required Contingency Infrastructure (1 set) 9.3. Contingency Operations 9.3.1. Build a Team and Provide Training (4 sets) (3 sets) 9.3.2. Backup Scheduling and Frequency (1 sets) 10. Physical Security 10.1. Physical Access Control 10.1.1. Control Physical Access (5 sets) (4 sets) 10.2. Physical Environmental Control 10.2.1. Provide Environmental Controls (5 sets) (5 sets) 10.3. Maintain Records 11. Personnel Security 11.1. Acceptable Usage 11.1.1. Establish Acceptable Usage Baselines (6 sets) (6 sets) 11.2. Personnel Operations 11.2.1. Establish Pre-Hiring Procedures (4 sets) (3 sets) 11.2.2. Hire Employees in a Structured Fashion (3 sets) (1 set) 11.2.3. Transfer Employees in a Structure Fashion (4 sets) (2 sets) 11.2.4. Terminate Employees in a Structured Fashion (3 sets) (1 set) 11.3. Maintain Records 48
Mandatory Non-Mandatory Procedures Baselines Procedures Baselines 12. Secure Purchasing/Acquisition 12.1. Secure Purchasing 12.1.1. Include Security Requirements in Solicitation Documents (4 sets) 12.1.2. Ensure Responses Include Security Requirements (4 sets) 12.2. Maintain Records 49
- Page 1 and 2: State of Kansas Kansas Information
- Page 3 and 4: Table of Contents Introduction ....
- Page 5 and 6: Introduction This Security Requirem
- Page 7 and 8: • It will ensure that privileged
- Page 9 and 10: G. Security Administrators Security
- Page 11 and 12: 2 Assessment & Security Planning Se
- Page 13 and 14: 3 Awareness & Training Section 3.1
- Page 15 and 16: 4 Access Control Sections 4.1, 4.2,
- Page 17 and 18: potential exists that legitimate us
- Page 19 and 20: 5 Systems Configuration Sections 5.
- Page 21 and 22: Collaborative computing infrastruct
- Page 23 and 24: Where data requires encryption, tha
- Page 25 and 26: 6 Systems Operation Sections 6.1, 6
- Page 27 and 28: Only pre-approved maintenance tools
- Page 29 and 30: ecorded logs. In the event of other
- Page 31 and 32: event that an incident occurs, the
- Page 33 and 34: 9.2 Contingency Infrastructure The
- Page 35 and 36: 10 Physical Security Sections 10.1
- Page 37 and 38: automatically shall notify appropri
- Page 39 and 40: copy of the signed document will be
- Page 41 and 42: 12 Secure Purchasing/Acquisition Se
- Page 43 and 44: CA-1 Certification, Accreditation,
- Page 45 and 46: PE-18 Location of Information Syste
- Page 47 and 48: Appendix B - Matrix of Responsibili
- Page 49 and 50: Part 2 - Non-IT Roles (See Page 3 f
- Page 51: Appendix C - Supporting Document Cr
- Page 55 and 56: Integrity The second of the three g
- Page 57 and 58: State of Kansas Mandatory Procedure
- Page 59 and 60: 6.2. Integrity Operations .........
- Page 61 and 62: 2. Assessment & Security Planning T
- Page 63 and 64: 2.2. Create a Security Plan No appl
- Page 65 and 66: 3.1.1.2 Create Training Materials O
- Page 67 and 68: Operations Training is defined as t
- Page 69 and 70: access individual system authentica
- Page 71 and 72: 5. Systems Configuration These Syst
- Page 73 and 74: 5.3.1.3 Restrict Access to Media No
- Page 75 and 76: • When no longer required, data s
- Page 77 and 78: 8. Incident Response These Incident
- Page 79 and 80: Capture documentation appropriate t
- Page 81 and 82: Different types of disruptions requ
- Page 83 and 84: 9.3.2.1 Perform System Backup Back
- Page 85 and 86: 11. Personnel Security These Person
- Page 87 and 88: 12. Secure Purchasing/Acquisition N
- Page 89 and 90: Table of Contents Introduction ....
- Page 91 and 92: Introduction This Mandatory Baselin
- Page 93 and 94: 2.1.2.c Information Protection •
- Page 95 and 96: o Appropriate physical security mea
- Page 97 and 98: 4. Access Control These Assessment
- Page 99 and 100: 5. Systems Configuration These Syst
- Page 101 and 102: 5.3.1.c Media Disposal Methods •
Mandatory<br />
Non-Mandatory<br />
Procedures Baselines Procedures Baselines<br />
12. Secure Purchasing/Acquisition <br />
12.1. Secure Purchasing<br />
12.1.1. Include Security Requirements in Solicitation Documents (4 sets)<br />
12.1.2. Ensure Responses Include Security Requirements (4 sets)<br />
12.2. Maintain Records <br />
49
Change language