Policy 7230A - Department of Administration
Policy 7230A - Department of Administration Policy 7230A - Department of Administration
Incident Response – Eradication Phase The process of removing the results of the incident. Eradication also involves determining how the incident occurred and implementing corrective controls to ensure that it cannot re-occur. Incident Response – Recovery Phase The process of restoring the affected information system back to production. Recovery involves the testing of operations as well as period of heightened monitoring to ensure all negative results of the incident have been caught and corrected. Security Incident Any occurrence that actually, or potentially, jeopardizes the confidentiality, integrity and/or availability of an information system and/or the information that it houses. Further, any occurrence that contravenes or otherwise constitutes a violation of the established security policies, standards, baselines, guidelines and/or procedures. Risk Assessment The process of identifying the risks to operations, assets, or individuals arising through the operation of an information system. Privacy Assessment The process of identifying how information is handled to ensure that the handling conforms with existing regulation, to determine the risks of collecting, storing and disseminating identifiable information in an information system, and to evaluate protection mechanisms and processes to mitigate that risk. Security Assessment The process of determining the extent to which changes to an information system have affected the security stance of that system. Vulnerability Assessment The process of determining the presence of system vulnerabilities that could be used as a launch point for exploits to breach the information system. Personally Identifiable Information (PII) Information that can be used to uniquely identify, contact, or locate a single person or can be used with other sources to uniquely identify a single individual. Examples of PII include, but are not limited to, name, address, phone number and/or e-mail address, especially when in connection to or combination with an individual’s Social Security Number (SSN). 52
State of Kansas Mandatory Procedures Documentation State of Kansas January 11, 2010
- Page 5 and 6: Introduction This Security Requirem
- Page 7 and 8: • It will ensure that privileged
- Page 9 and 10: G. Security Administrators Security
- Page 11 and 12: 2 Assessment & Security Planning Se
- Page 13 and 14: 3 Awareness & Training Section 3.1
- Page 15 and 16: 4 Access Control Sections 4.1, 4.2,
- Page 17 and 18: potential exists that legitimate us
- Page 19 and 20: 5 Systems Configuration Sections 5.
- Page 21 and 22: Collaborative computing infrastruct
- Page 23 and 24: Where data requires encryption, tha
- Page 25 and 26: 6 Systems Operation Sections 6.1, 6
- Page 27 and 28: Only pre-approved maintenance tools
- Page 29 and 30: ecorded logs. In the event of other
- Page 31 and 32: event that an incident occurs, the
- Page 33 and 34: 9.2 Contingency Infrastructure The
- Page 35 and 36: 10 Physical Security Sections 10.1
- Page 37 and 38: automatically shall notify appropri
- Page 39 and 40: copy of the signed document will be
- Page 41 and 42: 12 Secure Purchasing/Acquisition Se
- Page 43 and 44: CA-1 Certification, Accreditation,
- Page 45 and 46: PE-18 Location of Information Syste
- Page 47 and 48: Appendix B - Matrix of Responsibili
- Page 49 and 50: Part 2 - Non-IT Roles (See Page 3 f
- Page 51 and 52: Appendix C - Supporting Document Cr
- Page 53 and 54: Mandatory Non-Mandatory Procedures
- Page 55: Integrity The second of the three g
- Page 59 and 60: 6.2. Integrity Operations .........
- Page 61 and 62: 2. Assessment & Security Planning T
- Page 63 and 64: 2.2. Create a Security Plan No appl
- Page 65 and 66: 3.1.1.2 Create Training Materials O
- Page 67 and 68: Operations Training is defined as t
- Page 69 and 70: access individual system authentica
- Page 71 and 72: 5. Systems Configuration These Syst
- Page 73 and 74: 5.3.1.3 Restrict Access to Media No
- Page 75 and 76: • When no longer required, data s
- Page 77 and 78: 8. Incident Response These Incident
- Page 79 and 80: Capture documentation appropriate t
- Page 81 and 82: Different types of disruptions requ
- Page 83 and 84: 9.3.2.1 Perform System Backup Back
- Page 85 and 86: 11. Personnel Security These Person
- Page 87 and 88: 12. Secure Purchasing/Acquisition N
- Page 89 and 90: Table of Contents Introduction ....
- Page 91 and 92: Introduction This Mandatory Baselin
- Page 93 and 94: 2.1.2.c Information Protection •
- Page 95 and 96: o Appropriate physical security mea
- Page 97 and 98: 4. Access Control These Assessment
- Page 99 and 100: 5. Systems Configuration These Syst
- Page 101 and 102: 5.3.1.c Media Disposal Methods •
- Page 103 and 104: 6.4. Maintain Records Agencies must
- Page 105 and 106: 8. Incident Response These Incident
State <strong>of</strong> Kansas<br />
Mandatory Procedures Documentation<br />
State <strong>of</strong> Kansas<br />
January 11, 2010
Change language