Policy 7230A - Department of Administration

6. Systems Operation
These Systems Operation Mandatory Procedures support the Enterprise Security Policy
(ITEC 7230 Rev 1), and the IT Security Self Assessment Policy (ITEC 7310).
15
Mandatory
Non-Mandatory
Procedures Baselines Procedures Baselines
6. Systems Operation
6.1. Assessment Operations
6.1.1. Perform Security Assessment (7 sets) (3 sets)
6.1.2. Perform Security Self Assessment (4 sets) (2 sets)
6.2. Integrity Operations
6.2.1. Monitor System Security Controls (3 sets) (1 sets)
6.3. Maintenance Operations
6.3.1. Plan for, and Provide Notice of, Security Operations (4 sets) (1 sets)
6.3.2. Perform Patch and Vulnerability Management (5 sets) (3 sets)
6.3.3. Securely Maintain Systems (2 sets) (2 sets)
6.4. Maintain Records
6.1. Assessment Operations
The following are the Mandatory Procedures that support the Assessment Operations
section of the Default Security Requirements:
6.1.1. Perform Security Assessments
No applicable Mandatory Procedures.
6.1.2. Perform Security Self Assessment
To ensure compliance with Kansas Policies and Procedures, all Agencies must
perform a Security Self Assessment.
6.1.2.1 Identify the Target System
Collect and document the information that defines the system.
6.1.2.2 Execute the Plan
Apply the established Security Self Assessment plan to the targeted
system to determine and validate the existence of security
compromises.
6.1.2.3 Securely Manage Assessment Data
Security self assessment data contains information that, if it fell into
inappropriate hands, could be used to breach the security of the
system and so must be protected as critical information:
• Collect data into a central repository to allow for better
analysis as well as greater control of the data.
• Establish defined data storage parameters, controlling access
and distribution of assessment data.
• Where collected assessment data must be electronically
transmitted, ensure the confidentiality and integrity of the
data by password protecting with a strong password.