Policy 7230A - Department of Administration

Table of Contents
Introduction ................................................................................................. 1
2. Assessment & Security Planning ............................................................ 2
2.1. Risk and Privacy Assessment .................................................................... 2
2.1.1. Perform Risk Assessment ........................................................................ 2
2.1.2. Perform Privacy Assessment .................................................................. 2
2.2. Security Planning ....................................................................................... 3
2.3. Maintain Records....................................................................................... 3
3. Awareness & Operations Training ......................................................... 4
3.1. Security Awareness Training ..................................................................... 4
3.1.1. Design and Develop an Awareness Training Program ........................... 4
3.1.2. Provide Security Awareness Training ..................................................... 5
3.2. Security Operations Training .................................................................... 5
3.2.1. Design and Develop an Operations Training Program........................... 5
3.2.2. Provide Security Operations Training ..................................................... 5
3.3. Maintain Records....................................................................................... 6
4. Access Control ........................................................................................ 7
4.1. Identification and Authentication ............................................................ 7
4.1.1. Manage Identification and Authentication ............................................ 7
4.2. Account Management ............................................................................... 8
4.3. Session Management ................................................................................ 8
4.4. Maintain Records....................................................................................... 8
5. Systems Configuration ........................................................................... 9
5.1. Configuration Management ...................................................................... 9
5.2. Systems Protection .................................................................................... 9
5.2.1. Create and Maintain Security Infrastructure ......................................... 9
5.3. Data/Media Protection ........................................................................... 10
5.3.1. Securely Handle Data and Media ......................................................... 10
5.4. Applications Protection ........................................................................... 11
5.5. Maintain Records..................................................................................... 11
6. Systems Operation ............................................................................... 12
6.1. Assessment Operations ........................................................................... 12
6.1.1. Perform Security Assessments ............................................................. 12
6.1.2. Perform Security Self Assessment ........................................................ 12
Mandatory Baselines