Policy 7230A - Department of Administration

Mandatory Baselines
2. Assessment & Security Planning
These Assessment and Planning Mandatory Baselines support the Enterprise Security Policy
(ITEC 7230 Rev 1).
Page 2 of 25
Mandatory
Non-Mandatory
Procedures Baselines Procedures Baselines
2. Assessment & Security Planning
2.1. Risk and Privacy Assessment
2.1.1. Perform Risk Assessment (7 sets) (3 sets)
2.1.2. Perform Privacy Assessment (7 sets) (3 sets)
2.2. Security Planning
2.2.1. Create a Security Plan (5 sets) (3 sets)
2.3. Maintain Records
2.1. Risk and Privacy Assessment
The following are the Mandatory Baselines that support the Risk and Privacy
Assessment section of the Default Security Requirements:
2.1.1. Perform Risk Assessment
No applicable Mandatory Baselines.
2.1.2. Perform Privacy Impact Assessment
Agencies must define specific and enhanced protection requirements for
Personally Identifying Information (PII):
2.1.2.a Information Considered Personally Identifying
• Name information (full name, maiden name, mother’s maiden
name, etc.).
• Personal identification numbers (social security number,
passport number, driver’s license number, credit card number,
etc.).
• Address information (both physical and electronic).
• Telephone numbers (personal, mobile, business).
• Personal characteristics (photographs, biometrics, medical
data).
• Information about personal property (title documents, etc.).
2.1.2.b Information Use
• The intended usage for PII must be defined and made publicly
available before any such information is collected.
• Once collected PII must only be used for the purposes for
which it was intended.
• Must the intended usage of the PII change, permission to use
the information in that manner must be explicitly sought.
• Must permission not be made expressly available, collected
information must not be used for revised/new purposes.