Policy 7230A - Department of Administration
Policy 7230A - Department of Administration Policy 7230A - Department of Administration
6.2. Integrity Operations ................................................................................ 12 6.3. Maintenance Operations ........................................................................ 12 6.4. Maintain Records..................................................................................... 13 7. Systems Audit ....................................................................................... 14 8. Incident Response ................................................................................ 15 8.1. Incident Response ................................................................................... 15 8.1.1. Build a Team and Provide Training ....................................................... 15 8.1.2. Build an Incident Response Capability ................................................. 15 8.1.3. Test the Plan .......................................................................................... 15 8.1.4. Operate the Plan ................................................................................... 15 8.2. Maintain Records........................................ Error! Bookmark not defined. 9. Contingency Planning ........................................................................... 16 9.1. Contingency Plans ................................................................................... 16 9.1.1. Build a Plan ............................................................................................ 16 9.1.2. Test the Plan .......................................................................................... 17 9.2. Contingency Infrastructure ..................................................................... 17 9.2.1. Required Contingency Infrastructure ................................................... 17 9.3. Contingency Operations .......................................................................... 18 9.3.1. Build a Team and Provide Training ....................................................... 18 9.3.2. Backup Scheduling and Frequency ....................................................... 19 9.4. Maintain Records..................................................................................... 20 10. Physical Security ................................................................................... 21 11. Personnel Security ............................................................................... 22 11.1. Acceptable Usage .................................................................................... 22 11.1.1. Establish Acceptable Usage Baselines .................................................. 22 11.2. Personnel Operations .............................................................................. 23 11.3. Maintain Records..................................................................................... 23 12. Secure Purchasing/Acquisition ............................................................ 24 Mandatory Baselines
Introduction This Mandatory Baselines Document represents one component of the Kansas Default Security Requirements (ITEC 7230A) and is supported by a series of additional documents. In total, five distinct documents exist that form the full Kansas Default Security Requirements. These documents are: • Security Requirements Document • Kansas Mandatory Procedures • Kansas Mandatory Baselines (this document) • Kansas Non-Mandatory Procedures • Kansas Non-Mandatory Baselines The relationship between these various documents is shown in Diagram 1, below. This diagram not only indicates the relationship of the various documents but is color-coded to indicate to the reader at which layer of the overall taxonomy the document being read exists. Similar diagrams are provided in all documents that form the set. Diagram 1 – Kansas Default Security Requirements Document Taxonomy Kansas Security Requirements Document Security Self Assessment Tool Kansas Supporting Documents The Kansas Security Self Assessment Tool is supported by the combination of the Kansas Security Requirements Document (ITEC 7230A) plus all Supporting Documents. Kansas x000 Series Documents Kansas Mandatory Procedures Kansas Mandatory Baselines The primary portion of the Kansas Supporting documents is composed of Mandatory Procedures and Baselines. Both of these document sets are tied to existing Kansas x000 series Policies. NIST and other sources Kansas Non-Mandatory Procedures Kansas Non-Mandatory Baselines The secondary portion of the Kansas Supporting documents is composed of Non-Mandatory Procedures and Baselines. These documents are related to NIST 800 series documents among other sources.. Mandatory Baselines Page 1 of 25
- Page 39 and 40: copy of the signed document will be
- Page 41 and 42: 12 Secure Purchasing/Acquisition Se
- Page 43 and 44: CA-1 Certification, Accreditation,
- Page 45 and 46: PE-18 Location of Information Syste
- Page 47 and 48: Appendix B - Matrix of Responsibili
- Page 49 and 50: Part 2 - Non-IT Roles (See Page 3 f
- Page 51 and 52: Appendix C - Supporting Document Cr
- Page 53 and 54: Mandatory Non-Mandatory Procedures
- Page 55 and 56: Integrity The second of the three g
- Page 57 and 58: State of Kansas Mandatory Procedure
- Page 59 and 60: 6.2. Integrity Operations .........
- Page 61 and 62: 2. Assessment & Security Planning T
- Page 63 and 64: 2.2. Create a Security Plan No appl
- Page 65 and 66: 3.1.1.2 Create Training Materials O
- Page 67 and 68: Operations Training is defined as t
- Page 69 and 70: access individual system authentica
- Page 71 and 72: 5. Systems Configuration These Syst
- Page 73 and 74: 5.3.1.3 Restrict Access to Media No
- Page 75 and 76: • When no longer required, data s
- Page 77 and 78: 8. Incident Response These Incident
- Page 79 and 80: Capture documentation appropriate t
- Page 81 and 82: Different types of disruptions requ
- Page 83 and 84: 9.3.2.1 Perform System Backup Back
- Page 85 and 86: 11. Personnel Security These Person
- Page 87 and 88: 12. Secure Purchasing/Acquisition N
- Page 89: Table of Contents Introduction ....
- Page 93 and 94: 2.1.2.c Information Protection •
- Page 95 and 96: o Appropriate physical security mea
- Page 97 and 98: 4. Access Control These Assessment
- Page 99 and 100: 5. Systems Configuration These Syst
- Page 101 and 102: 5.3.1.c Media Disposal Methods •
- Page 103 and 104: 6.4. Maintain Records Agencies must
- Page 105 and 106: 8. Incident Response These Incident
- Page 107 and 108: 9.1.1.c Contingency Plan Update Fre
- Page 109 and 110: Mandatory Baselines • Systems man
- Page 111 and 112: 10. Physical Security No applicable
- Page 113 and 114: • Data is to be used for its inte
- Page 115 and 116: State of Kansas Non-Mandatory Proce
- Page 117 and 118: 6.3. Maintenance Operations .......
- Page 119 and 120: Introduction This Non-Mandatory Pro
- Page 121 and 122: 2.1.1.4 Likelihood Determination Es
- Page 123 and 124: 2.2.1.5 Establish Appropriate Secur
- Page 125 and 126: 4. Access Control These Assessment
- Page 127 and 128: 4.3. Session Management The followi
- Page 129 and 130: 4.3.2.2 Restrict Intra and Inter-Sy
- Page 131 and 132: 5.1.1.3 Actively Maintain Inventory
- Page 133 and 134: 5.1.3.3 Provide Implementation Docu
- Page 135 and 136: • Place all media in a locked con
- Page 137 and 138: 6. Systems Operation These Systems
- Page 139 and 140: 6.2. Integrity Operations The follo
6.2. Integrity Operations ................................................................................ 12<br />
6.3. Maintenance Operations ........................................................................ 12<br />
6.4. Maintain Records..................................................................................... 13<br />
7. Systems Audit ....................................................................................... 14<br />
8. Incident Response ................................................................................ 15<br />
8.1. Incident Response ................................................................................... 15<br />
8.1.1. Build a Team and Provide Training ....................................................... 15<br />
8.1.2. Build an Incident Response Capability ................................................. 15<br />
8.1.3. Test the Plan .......................................................................................... 15<br />
8.1.4. Operate the Plan ................................................................................... 15<br />
8.2. Maintain Records........................................ Error! Bookmark not defined.<br />
9. Contingency Planning ........................................................................... 16<br />
9.1. Contingency Plans ................................................................................... 16<br />
9.1.1. Build a Plan ............................................................................................ 16<br />
9.1.2. Test the Plan .......................................................................................... 17<br />
9.2. Contingency Infrastructure ..................................................................... 17<br />
9.2.1. Required Contingency Infrastructure ................................................... 17<br />
9.3. Contingency Operations .......................................................................... 18<br />
9.3.1. Build a Team and Provide Training ....................................................... 18<br />
9.3.2. Backup Scheduling and Frequency ....................................................... 19<br />
9.4. Maintain Records..................................................................................... 20<br />
10. Physical Security ................................................................................... 21<br />
11. Personnel Security ............................................................................... 22<br />
11.1. Acceptable Usage .................................................................................... 22<br />
11.1.1. Establish Acceptable Usage Baselines .................................................. 22<br />
11.2. Personnel Operations .............................................................................. 23<br />
11.3. Maintain Records..................................................................................... 23<br />
12. Secure Purchasing/Acquisition ............................................................ 24<br />
Mandatory Baselines
Change language