Attachment 1.xlsx
XLSX spreadsheet 275 KB Posted
- Attached to
- STC DIGITAL TRANSACTION MANAGEMENT State and local contract opportunity
- Solicitation number
- 5400020073
- Issued by
- South Carolina
About this file
This document is the SCDIS-200 Information Security and Privacy Standards (Version 1.5) established by the State of South Carolina Division of Information Security for all state agencies, institutions, departments, divisions, boards, commissions, and authorities. The standards provide a comprehensive framework of minimum security controls organized across 13 major categories including information security planning, access management, network security, identity management, authentication, audit and compliance, risk management, physical security, data protection, human resources, mobile device security, asset management, and system development. The document establishes requirements applicable to all persons managed by agencies (employees, contractors, and volunteers), all agency information systems regardless of location, and all information contained on agency systems regardless of format or medium. Implementation of all required controls was mandated by the effective date of July 1, 2016, with controls prioritized as P0 (highest priority), P1, P2, or P3 based on NIST 800-53 guidance. The standards include provisions for exceptions through a documented risk-based process requiring agency director approval, DIS consultation, and documented compensating controls.
The document includes supplemental sections addressing hosted services requirements, minimum acceptable security standards for contractors with sensitive data, and a gap analysis and remediation tracking tool for agencies to evaluate compliance and plan remediation efforts. Security controls are scoped based on data classification (Public/Internal versus Confidential/Restricted) with specific requirements for each level. The standards reference NIST SP 800-53 Revision 4 as the authoritative source and provide mappings to FedRAMP baselines and NIST 800-171 requirements for CUI data. Additional controls specific to HIPAA compliance are identified where applicable. The framework requires annual reviews and updates of security plans, continuous monitoring of controls, regular training and awareness programs, and comprehensive documentation of security measures. Agencies must designate information security liaisons, establish security governance committees, and implement processes for managing third-party service providers and contractor compliance with state security requirements.
View the file
Other files for this state and local contract opportunity
| File | Type | Posted |
|---|---|---|
| Cancellation Notice.pdf | ||
| Amendment 1.pdf | ||
| Solicitation.pdf | ||
| Attachment 2.pdf |
On GovTribe
Work with this file on GovTribe
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Standards Overview SCDIS-200 Information Security and Privacy Standards for all South Carolina state agencies version: 1.5 issued: 18-Sep-2015 effective: 01-Jul-2016 owner: Chief Information Security Officer / Division of Information Security / Division of Technology / State of South Carolina scope: Per South Carolina Provisos 117.113 (2014) and 101.32 (2014) and any successive statutes, these standards are to be implemented by all South Carolina state agencies, including institutions, departments, divisions, boards, commissions, and authorities. Exceptions are noted in the terms of the Provisos.
Within statutory scope, this policy applies to:
A. all persons managed by an agency, such as employees, contractors, and volunteers B. all agency information systems, regardless of location or service level agreement C. all information contained on any agency information system, regardless of format or medium D. all information otherwise under the control of any agency, regardless of format or medium Overview This document establishes the standards to be used by each state agency to incorporate information security and privacy protection controls into its business practices. These controls represent the same requirements enumerated in the published Information Security policies, but incorporate supplemental guidance (see "How To Use" section below).
Authoritative Documents If substantive differences are found to exist between this document and any of its superior documents, such as state policy, statute, or regulation, those superior documents must be considered authoritative, and their provisions must prevail.
How To Use These Standards These controls (see "Controls Matrix" tab) describe minimum standards for securing agency information.
Organization of Controls: The controls are listed by subject matter sections. Each section corresponds to the controls originally published within the information security policies on the DIS website in 2014. Some controls have been reworded to improve clarity. Some controls have additional guidance added to the control text. Substantially reworded controls are listed in red.
Scoping Implementation of Controls: Some controls are not required to be applied to some situations. Criteria for determining scope are supplied in the columns that correlate to data classification (Public/Internal, Confidential/Restricted). These criteria correlate to NIST 800-53 rev 4 guidance.
Priority for Implementing Controls: The purpose of prioritizing implementation is to apply controls to the areas of higher risk first. Regardless of the priority, all required controls are to be implemented by the effective date above. Guidance for prioritizing the implementation of controls is supplied in the Priority column, and correlates with NIST 800-53 rev 4 guidance.
Gap Analysis and Remediation: Gap analysis can be performed, and remediation progress can be tracked, using the "Gap and Remediation" tab. This replaces the gap analysis and implementation plan tools previously published on the DIS website.
Hosted Services: This tab establishes the minimum acceptable controls to be maintained by providers of hosted services.
Contractors with Data: This tab establishes the minimum acceptable controls to be maintained by contract service providers who will be given possession of sensitive data.
Exceptions For any exceptions to these standards, agencies must follow this exception process:
A decision to not require a specific policy, standard, procedure, or control (collectively “policy framework components”) for a given scope can only be granted by an agency director or the agency director’s designated executive authority for that given scope, and in consultation with DIS. Such an exception must not be granted without first performing the following evaluations:
1. Determine the objective of the policy framework component, and consider whether this objective is meaningful in the given scope.
2. Consider the application of compensating controls to reduce the risk as consistent with the objective.
3. Analyze the residual risk, and document, including an executive level summary.
4. Consult with a DIS subject matter expert regarding the documented risk, and incorporate advice within the exception documentation.
5. Obtain documented executive endorsement for some treatment of the risk, such as:
a. Agreement that the objective of the policy framework component is not meaningful in the given scope.
b. Mitigation of the risk through compensating controls, and acceptance of the residual risk.
c. Acceptance of the full, unmitigated risk.
6. Centrally assemble and retain documentation for all exceptions.
7. Review all exceptions at least annually, to evaluate changes in requirements, risk factors, and effectiveness of any compensating controls.
8. Be prepared to produce all exception documentation during IT audits and assessments.
Example 1: An agency determines that it has no occasion to develop computer software, and therefore has no need to implement software development security controls. In this case the agency would document within its Information Security Plan or as a separate document that the objectives of these controls are unmeaningful within the agency, and an appropriate agency executive would then endorse the exception individually or along with endorsement of the agency's Information Security Plan.
Example 2: An agency determines that a particular information system it operates has no means to enforce state mandated password complexity requirements, and has verified this fact with the vendor. The agency determines that the control is intended to increase the amount of time needed for an attacker to guess a password. Instead, the agency increases the amount of time an account is automatically locked for an incorrect password entry, as a compensating control. Analysis of the selected compensating control indicates that it will give comparable protection. The agency documents this exception as in Example 1, along with the compensating control and the analysis, and an appropriate agency executive endorses the exception as in Example 1.
| History | ||
| Date | Version | Description |
| 18/Sep/2015 | 1.5 | Comprehensive reviewed published InfoSec policies, excerpted controls, reorganized, reworded, scoped, and clarified. Created linked gap and remediation tool. Created search/highlight function. Created mappings to FedRAMP and to NIST 800-171 (draft). |
Controls Matrix
Find Text: matches are highlighted
This is the DIS-assigned control ID. It uniquely identifies each control or objective statement within this document. Objectives are indicated for each Policy Section, to provide guidance in determining applicability and potential compensating controls. This is the name of the policy document containing the control, as associated with the Information Security Program version 1.2 Master Policy document. This is the name of the section within the policy document containing the control, as associated with the Information Security Program version 1.2 Master Policy document. This is the name of the subsection within the policy document containing the control, as associated with the Information Security Program version 1.2 Master Policy document. This is the control to be implemented.
See data classification columns at right, and consult NIST guidance to assist in determining applicability.
Where the Objective of the control is not readily apparent, note the control code (e.g. PM-1) in the "NIST Control ID" column. Consult NIST Special Publication 800-53, rev 4, and search for the control code in that publication. The auditing companion document, 800-53A, may also be useful for finding specific examples of compliant implementation of controls. NIST publications are available here: http://csrc.nist.gov/publications Revised controls are highlighted in red. This field refers to one or more controls in NIST Special Publication 800-53, rev 4. These are the reference controls used to create the state policy controls. This field indicates whether a given control is required for systems or processes involving information classified as "Public" or "Internal." An "X" indicates requirement. This field indicates whether a given control is required for systems or processes involving information classified as "Confidential" or "Restricted." An "X" indicates requirement. Indicates if required in scope of HIPAA. "X" = required by HIPAA, "XC" = required by state for Confidential / Restricted data. Priority Code correlates to NIST guidance for pioritizing implementation of each control.
P0 & P1 - Higher Priority P2 & P3 - Lower Priority
| DIS | |||||||||||||
| Control ID | Section | ||||||||||||
| Objective | Policy Name (ver 1.2) | Policy Section | Policy Subsection | SC State Policy Control | NIST Control ID | ||||||||
| (NIST 800-53) | NIST Control Name | NIST Control Description | Public or | ||||||||||
| Internal | Confidential | ||||||||||||
| or Restricted | HIPAA | Priority Code | |||||||||||
| 1.100 | Information Security Plan: Each agency must formally authorize, document, prioritize, and provide resources for incorporating security and privacy controls into its business processes. | x | x | xc | P1 | ||||||||
| 1.101 | Information Security Program | 1.1 Information Security Program Planning | PM1.1 - Information Security Plan | Each agency must develop and communicate an information security plan that underlines security requirements, the security management controls, and common controls in place for meeting those requirements. | PM-1 | Information Security Program Plan | The organization: |
a. Develops and disseminates an organization-wide information security program plan that:
1. Provides an overview of the requirements for the security program and a description of the security program management controls and common controls in place or planned for meeting those requirements;
2. Includes the identification and assignment of roles, responsibilities, management commitment, coordination among organizational entities, and compliance;
3. Reflects coordination among organizational entities responsible for the different aspects of information security (i.e., technical, physical, personnel, cyber-physical); and
4. Is approved by a senior official with responsibility and accountability for the risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation;
b. Reviews the organization-wide information security program plan [Assignment: organization-defined frequency];
c. Updates the plan to address organizational changes and problems identified during plan implementation or security control assessments; and
| d. Protects the information security program plan from unauthorized disclosure and modification. | x | x | xc | P1 | |||||
| 1.102 | Information Security Program | 1.1 Information Security Program Planning | PM1.2 - Information Security Plan | Each agency’s security plan must identify and assign security program roles, responsibilities and management commitment, and ensure coordination among the agency’s business units, as well as compliance with the security plan | PM-1 | Information Security Program Plan | The organization: |
a. Develops and disseminates an organization-wide information security program plan that:
1. Provides an overview of the requirements for the security program and a description of the security program management controls and common controls in place or planned for meeting those requirements;
2. Includes the identification and assignment of roles, responsibilities, management commitment, coordination among organizational entities, and compliance;
3. Reflects coordination among organizational entities responsible for the different aspects of information security (i.e., technical, physical, personnel, cyber-physical); and
4. Is approved by a senior official with responsibility and accountability for the risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation;
b. Reviews the organization-wide information security program plan [Assignment: organization-defined frequency];
c. Updates the plan to address organizational changes and problems identified during plan implementation or security control assessments; and
| d. Protects the information security program plan from unauthorized disclosure and modification. | x | x | xc | P1 | |||||
| 1.103 | Information Security Program | 1.1 Information Security Program Planning | PM1.3 - Information Security Plan | Each agency must ensure coordination among the agency’s business units responsible for the different aspects of information security (i.e., technical, physical, personnel, etc.) | PM-1 | Information Security Program Plan | The organization: |
a. Develops and disseminates an organization-wide information security program plan that:
1. Provides an overview of the requirements for the security program and a description of the security program management controls and common controls in place or planned for meeting those requirements;
2. Includes the identification and assignment of roles, responsibilities, management commitment, coordination among organizational entities, and compliance;
3. Reflects coordination among organizational entities responsible for the different aspects of information security (i.e., technical, physical, personnel, cyber-physical); and
4. Is approved by a senior official with responsibility and accountability for the risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation;
b. Reviews the organization-wide information security program plan [Assignment: organization-defined frequency];
c. Updates the plan to address organizational changes and problems identified during plan implementation or security control assessments; and
| d. Protects the information security program plan from unauthorized disclosure and modification. | x | x | xc | P1 | |||||
| 1.104 | Information Security Program | 1.1 Information Security Program Planning | PM1.4 - Information Security Plan | Each agency must ensure that the security plan is approved by senior management | PM-1 | Information Security Program Plan | The organization: |
a. Develops and disseminates an organization-wide information security program plan that:
1. Provides an overview of the requirements for the security program and a description of the security program management controls and common controls in place or planned for meeting those requirements;
2. Includes the identification and assignment of roles, responsibilities, management commitment, coordination among organizational entities, and compliance;
3. Reflects coordination among organizational entities responsible for the different aspects of information security (i.e., technical, physical, personnel, cyber-physical); and
4. Is approved by a senior official with responsibility and accountability for the risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation;
b. Reviews the organization-wide information security program plan [Assignment: organization-defined frequency];
c. Updates the plan to address organizational changes and problems identified during plan implementation or security control assessments; and
| d. Protects the information security program plan from unauthorized disclosure and modification. | x | x | xc | P1 | |||||
| 1.105 | Information Security Program | 1.1 Information Security Program Planning | PM1.5 - Information Security Plan | Each agency must periodically review the information security plan, staging each full review cycle across no more than a 3-year period. | PM-1 | Information Security Program Plan | The organization: |
a. Develops and disseminates an organization-wide information security program plan that:
1. Provides an overview of the requirements for the security program and a description of the security program management controls and common controls in place or planned for meeting those requirements;
2. Includes the identification and assignment of roles, responsibilities, management commitment, coordination among organizational entities, and compliance;
3. Reflects coordination among organizational entities responsible for the different aspects of information security (i.e., technical, physical, personnel, cyber-physical); and
4. Is approved by a senior official with responsibility and accountability for the risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation;
b. Reviews the organization-wide information security program plan [Assignment: organization-defined frequency];
c. Updates the plan to address organizational changes and problems identified during plan implementation or security control assessments; and
| d. Protects the information security program plan from unauthorized disclosure and modification. | x | x | xc | P1 | |||||
| 1.106 | Information Security Program | 1.1 Information Security Program Planning | PM1.6 - Information Security Plan | Each agency must update the security plan to address changes and problems identified during plan implementation or security control assessments. | PM-1 | Information Security Program Plan | The organization: |
a. Develops and disseminates an organization-wide information security program plan that:
1. Provides an overview of the requirements for the security program and a description of the security program management controls and common controls in place or planned for meeting those requirements;
2. Includes the identification and assignment of roles, responsibilities, management commitment, coordination among organizational entities, and compliance;
3. Reflects coordination among organizational entities responsible for the different aspects of information security (i.e., technical, physical, personnel, cyber-physical); and
4. Is approved by a senior official with responsibility and accountability for the risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation;
b. Reviews the organization-wide information security program plan [Assignment: organization-defined frequency];
c. Updates the plan to address organizational changes and problems identified during plan implementation or security control assessments; and
| d. Protects the information security program plan from unauthorized disclosure and modification. | x | x | xc | P1 | |||||
| 1.107 | Information Security Program | 1.1 Information Security Program Planning | PM1.7 - Information Security Plan | Each agency must protect the information security plan from unauthorized disclosure and modification. | PM-1 | Information Security Program Plan | The organization: |
a. Develops and disseminates an organization-wide information security program plan that:
1. Provides an overview of the requirements for the security program and a description of the security program management controls and common controls in place or planned for meeting those requirements;
2. Includes the identification and assignment of roles, responsibilities, management commitment, coordination among organizational entities, and compliance;
3. Reflects coordination among organizational entities responsible for the different aspects of information security (i.e., technical, physical, personnel, cyber-physical); and
4. Is approved by a senior official with responsibility and accountability for the risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation;
b. Reviews the organization-wide information security program plan [Assignment: organization-defined frequency];
c. Updates the plan to address organizational changes and problems identified during plan implementation or security control assessments; and
| d. Protects the information security program plan from unauthorized disclosure and modification. | x | x | xc | P1 | |||||
| 1.108 | Information Security Program | 1.1 Information Security Program Planning | PM 3 -Information Security Resources | Each agency must consider resources needed to implement and maintain the information security plan in capital planning and investment requests. | PM-1 | Information Security Program Plan | The organization: |
a. Develops and disseminates an organization-wide information security program plan that:
1. Provides an overview of the requirements for the security program and a description of the security program management controls and common controls in place or planned for meeting those requirements;
2. Includes the identification and assignment of roles, responsibilities, management commitment, coordination among organizational entities, and compliance;
3. Reflects coordination among organizational entities responsible for the different aspects of information security (i.e., technical, physical, personnel, cyber-physical); and
4. Is approved by a senior official with responsibility and accountability for the risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation;
b. Reviews the organization-wide information security program plan [Assignment: organization-defined frequency];
c. Updates the plan to address organizational changes and problems identified during plan implementation or security control assessments; and
| d. Protects the information security program plan from unauthorized disclosure and modification. | x | x | xc | P1 | |||||
| 1.109 | Information Security Program | 1.1 Information Security Program Planning | PM 4.1 - Plan of Action and Milestones Process | Each agency must follow a process for ensuring that an implementation plan is developed and executed to address identified security and privacy deficiencies. | PM-4 | Information Security Program Plan | (1) The organization: |
a. Implements a process for ensuring that plans of action and milestones for the security program and associated organizational information systems:
1. Are developed and maintained;
2. Document the remedial information security actions to adequately respond to risk to organizational operations and assets, individuals, other organizations, and the Nation; and
3. Are reported in accordance with OMB FISMA reporting requirements.
| b. Reviews plans of action and milestones for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions. | x | x | xc | P1 | |||||
| 1.110 | Information Security Program | 1.1 Information Security Program Planning | PM 4.2 - Plan of Action and Milestones Process | Each agency must review implementation plans for consistency with the agency’s risk management strategy and priorities for risk response actions. | PM-4 | Information Security Program Plan | (1) The organization: |
a. Implements a process for ensuring that plans of action and milestones for the security program and associated organizational information systems:
1. Are developed and maintained;
2. Document the remedial information security actions to adequately respond to risk to organizational operations and assets, individuals, other organizations, and the Nation; and
3. Are reported in accordance with OMB FISMA reporting requirements.
| b. Reviews plans of action and milestones for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions. | x | x | xc | P1 | |||||||||
| 1.111 | Information Security Program | 1.1 Information Security Program Planning | PM 6 - Information Security Measures of Performance | Each agency must develop, monitor, and report on the results of information security and privacy measures of performance, as directed by the SC Division of Information Security or the SC Enterprise Privacy Office. | PM-6 | Information Security Measures Of Performance | (1) The organization develops, monitors, and reports on the results of information security measures of performance. | x | x | xc | P1 |
| 1.200 | Information Security Roles and Responsibilities: Each agency must formally document authority for security and privacy responsibilities within its organization. | x | x | x | P1 | |||||||
| 1.201 | Information Security Program | 1.2 Security Organization (Roles and Responsibilities) | Information Security Authority | Each agency’s chief executive must ensure that the agency’s senior officials are given the necessary authority to secure the operations and assets under their control. | PM-2 | Senior Information Security Officer | (1) The organization appoints a senior information security officer with the mission and resources to coordinate, develop, implement, and maintain an organization-wide information security program. | x | x | x | P1 | |
| 1.202 | Information Security Program | 1.2 Security Organization (Roles and Responsibilities) | Information Security Liaison | Each agency must appoint an information security liaison with the mission and resources to: coordinate, develop, implement, and maintain an information security plan. | PM-2 | Senior Information Security Officer | (1) The organization appoints a senior information security officer with the mission and resources to coordinate, develop, implement, and maintain an organization-wide information security program. | x | x | x | P1 | |
| 1.203 | Information Security Program | 1.2 Security Organization (Roles and Responsibilities) | Information Security Workforce | Each agency must establish an information security workforce and professional development program appropriately sized to the agency’s information security needs. | PM-13 | Information Security Workforce | (1) The organization establishes an information security workforce development and improvement program. | x | x | x | P1 | |
| 1.204 | Information Security Program | 1.2 Security Organization (Roles and Responsibilities) | Role-based Security Training | Each agency must provide role-based security training to personnel with assigned security roles and responsibilities. | AT-3 | Role-Based Security Training | (1) The organization provides role-based security training to personnel with assigned security roles and responsibilities: |
a. Before authorizing access to the information system or performing assigned duties;
b. When required by information system changes; and
c. [Assignment: organization-defined frequency] thereafter. x x x P1
| 1.300 | Information Security Policy Management: Each agency must formally evaluate its business processes, and ensure that these processes are designed in compliance with the state Information Security Program. | x | x | x | P1 | |||||||
| 1.301 | Information Security Program | 1.3 Policy Management (Plan of Action) | Procedure Development | Each agency must adopt a risk-based approach to identify State and agency-specific information security and privacy objectives, and must develop information security procedures in alignment with the identified security objectives. | PM-9 | Risk Management Strategy | (1) The organization: |
a. Develops a comprehensive strategy to manage risk to organizational operations and assets, individuals, other organizations, and the Nation associated with the operation and use of information systems;
b. Implements the risk management strategy consistently across the organization; and
| c. Reviews and updates the risk management strategy [Assignment: organization-defined frequency] or as required, to address organizational changes. | x | x | xc | P1 | |||||
| 1.302 | Information Security Program | 1.3 Policy Management (Plan of Action) | Procedure Development | Each agency must allocate the appropriate subject matter experts to the development of State and agency-specific information security procedures. | PM-3 | Information Security Resources | (1) The organization: |
a. Ensures that all capital planning and investment requests include the resources needed to implement the information security program and documents all exceptions to this requirement;
b. Employs a business case/Exhibit 300/Exhibit 53 to record the resources required; and
| c. Ensures that information security resources are available for expenditure as planned. | x | x | xc | P1 | |||||
| 1.303 | Information Security Program | 1.3 Policy Management (Plan of Action) | Procedure Development | Each agency must approach independent external (third party) specialists to assist in the development of information security policies, procedures, or controls in cases where it is established that the required skills do not exist within the agency and are not available within any other state government agency. | PM-15 | Contacts With Security Groups And Associations | (1) The organization establishes and institutionalizes contact with selected groups and associations within the security community: |
a. To facilitate ongoing security education and training for organizational personnel;
b. To maintain currency with recommended security practices, techniques, and technologies; and
| c. To share current security-related information including threats, vulnerabilities, and incidents. | x | x | xc | P1 | |||||||||
| 1.304 | Information Security Program | 1.3 Policy Management (Plan of Action) | Procedure Development | Each agency must work in collaboration with other states, Federal government, and external special interest groups in cases where procedures directly or indirectly affect interfacing activities with them. | x | x | xc | P0 | |||||
| 1.305 | Information Security Program | 1.3 Policy Management (Plan of Action) | Procedure Development | Each agency should ensure that information security and privacy policies, standards, guidelines, and procedures that are developed at the agency should contain the following information, as appropriate: version, issued date, effective date, owner of document (identified by office or role), purpose, definitions, scope, directives, guidance, and revision history. | PL-1 | Security Planning Policy And Procedures | (1) The organization: |
a. Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:
1. A security planning policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
2. Procedures to facilitate the implementation of the security planning policy and associated security planning controls; and
b. Reviews and updates the current:
1. Security planning policy [Assignment: organization-defined frequency]; and
| 2. Security planning procedures [Assignment: organization-defined frequency]. | x | x | x | P1 | |||||||||
| 1.306 | Information Security Program | 1.3 Policy Management (Plan of Action) | Procedure Development | Each agency must review each draft procedure with stakeholders who must be impacted by the procedure, to ensure that the procedure is enforceable and effective. | x | x | xc | P0 | |||||
| 1.307 | Information Security Program | 1.3 Policy Management (Plan of Action) | Procedure Development | Each agency must identify gaps within the procedures that are not enforceable and effective, must document the gaps, and must assign the appropriate resources to remediate the gaps. | PM-4 | Plan Of Action And Milestones Process | (1) The organization: |
a. Implements a process for ensuring that plans of action and milestones for the security program and associated organizational information systems:
1. Are developed and maintained;
2. Document the remedial information security actions to adequately respond to risk to organizational operations and assets, individuals, other organizations, and the Nation; and
3. Are reported in accordance with OMB FISMA reporting requirements.
| b. Reviews plans of action and milestones for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions. | x | x | xc | P1 | |||||
| 1.308 | Information Security Program | 1.3 Policy Management (Plan of Action) | Procedure Development | Each agency must develop and implement a communication plan to disseminate new procedures or changes to existing procedures. | PL-1 | Security Planning Policy And Procedures | (1) The organization: |
a. Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:
1. A security planning policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
2. Procedures to facilitate the implementation of the security planning policy and associated security planning controls; and
b. Reviews and updates the current:
1. Security planning policy [Assignment: organization-defined frequency]; and
| 2. Security planning procedures [Assignment: organization-defined frequency]. | x | x | x | P1 | |||||
| 1.309 | Information Security Program | 1.3 Policy Management (Plan of Action) | Procedure Review and Approval | Each agency may establish a procedure governance committee for the purpose of review and approval of procedures. | PL-1 | Security Planning Policy And Procedures | (1) The organization: |
a. Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:
1. A security planning policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
2. Procedures to facilitate the implementation of the security planning policy and associated security planning controls; and
b. Reviews and updates the current:
1. Security planning policy [Assignment: organization-defined frequency]; and
| 2. Security planning procedures [Assignment: organization-defined frequency]. | x | x | x | P1 | |||||
| 1.310 | Information Security Program | 1.3 Policy Management (Plan of Action) | Procedure Implementation | Each agency must implement mechanisms to help ensure that information security procedures will be available to the agency’s personnel on a continuous basis and whenever required. | PL-1 | Security Planning Policy And Procedures | (1) The organization: |
a. Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:
1. A security planning policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
2. Procedures to facilitate the implementation of the security planning policy and associated security planning controls; and
b. Reviews and updates the current:
1. Security planning policy [Assignment: organization-defined frequency]; and
| 2. Security planning procedures [Assignment: organization-defined frequency]. | x | x | x | P1 | |||||
| 1.311 | Information Security Program | 1.3 Policy Management (Plan of Action) | Procedure Implementation | Each agency must require employees to review and acknowledge understanding of information security procedures prior to allowing access to sensitive data or information systems. | PL-4 | Rules Of Behavior | (1) The organization: |
a. Establishes and makes readily available to individuals requiring access to the information system, the rules that describe their responsibilities and expected behavior with regard to information and information system usage;
b. Receives a signed acknowledgment from such individuals, indicating that they have read, understand, and agree to abide by the rules of behavior, before authorizing access to information and the information system;
c. Reviews and updates the rules of behavior [Assignment: organization-defined frequency]; and
d. Requires individuals who have signed a previous version of the rules of behavior to read and resign when the rules of behavior are revised/updated. x x xc P2
| 1.400 | Information Security Controls: Each agency must ensure that security and privacy controls are implemented in compliance with the state Information Security Program. | x | x | x | P1 | |||||||
| 1.401 | Information Security Program | 1.4 Information Security Controls Deployment | Controls Deployment | Each agency must adopt a risk-based approach to prioritize deployment of controls. | CA-2 | Security Assessments | (1) The organization: |
a. Develops a security assessment plan that describes the scope of the assessment including:
1. Security controls and control enhancements under assessment;
2. Assessment procedures to be used to determine security control effectiveness; and
3. Assessment environment, assessment team, and assessment roles and responsibilities;
b. Assesses the security controls in the information system and its environment of operation [Assignment: organization-defined frequency] to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security requirements;
c. Produces a security assessment report that documents the results of the assessment; and
| d. Provides the results of the security control assessment to [Assignment: organization-defined individuals or roles]. | x | x | x | P2 | |||||
| 1.402 | Information Security Program | 1.4 Information Security Controls Deployment | Controls Deployment | Each agency must allocate the appropriate subject matter experts to the deployment of State and agency-specific information security controls. | PM-3 | Information Security Resources | (1) The organization: |
a. Ensures that all capital planning and investment requests include the resources needed to implement the information security program and documents all exceptions to this requirement;
b. Employs a business case/Exhibit 300/Exhibit 53 to record the resources required; and
| c. Ensures that information security resources are available for expenditure as planned. | x | x | xc | P1 | |||||
| 1.403 | Information Security Program | 1.4 Information Security Controls Deployment | Controls Deployment | Each agency must approach independent external (third party) specialists to assist in the deployment of information security controls in cases where it is established that the required skills do not exist within the agency and are not available within any other state government agency. | PM-15 | Contacts With Security Groups And Associations | The organization establishes and institutionalizes contact with selected groups and associations within the security community: |
a. To facilitate ongoing security education and training for organizational personnel;
b. To maintain currency with recommended security practices, techniques, and technologies; and
| c. To share current security-related information including threats, vulnerabilities, and incidents. | x | x | xc | P1 | |||||||||
| 1.404 | Information Security Program | 1.4 Information Security Controls Deployment | Controls Deployment | Each agency must ensure that controls which cannot be implemented due to the agency’s resource or other constraints must be reported as directed by the SC Division of Information Security or SC Enterprise Privacy Office. | PM-2 | Senior Information Security Officer | (1) The organization appoints a senior information security officer with the mission and resources to coordinate, develop, implement, and maintain an organization-wide information security program. | x | x | xc | P1 | ||
| 1.405 | Information Security Program | 1.4 Information Security Controls Deployment | Controls Deployment | Each agency must review each control with stakeholders who must be impacted, to ensure that the control is enforceable and effective. | x | x | xc | P0 | |||||
| 1.406 | Information Security Program | 1.4 Information Security Controls Deployment | Controls Deployment | Each agency must develop and implement a communication plan to disseminate new controls or changes to existing controls. | PL-1 | Security Planning Policy And Procedures | The organization: |
a. Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:
1. A security planning policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
2. Procedures to facilitate the implementation of the security planning policy and associated security planning controls; and
b. Reviews and updates the current:
1. Security planning policy [Assignment: organization-defined frequency]; and
| 2. Security planning procedures [Assignment: organization-defined frequency]. | x | x | x | P1 | |||||
| 1.407 | Information Security Program | 1.4 Information Security Controls Deployment | Controls Deployment | Each agency must periodically review information security controls, staging each full review cycle across no more than a 3-year period. | PL-1 | Security Planning Policy And Procedures | The organization: |
a. Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:
1. A security planning policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
2. Procedures to facilitate the implementation of the security planning policy and associated security planning controls; and
b. Reviews and updates the current:
1. Security planning policy [Assignment: organization-defined frequency]; and
2. Security planning procedures [Assignment: organization-defined frequency]. x x x P1
| 2.100 | Access Management: Each agency must ensure the management of information systems and user accounts, to appropriately secure legitimate user and system access. | x | x | x | P1 | |||||||
| 2.101 | Information Security Policy – Access Control | 1.1 Access Management | Access Control Policy And Procedures | Each agency must establish or update formal, documented procedures for secure and compliant management of information systems, user accounts, and networks. | AC-1 | Access Control Policy And Procedures | (1) The organization: |
a. Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:
1. An access control policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
2. Procedures to facilitate the implementation of the access control policy and associated access controls; and
b. Reviews and updates the current:
1. Access control policy [Assignment: organization-defined frequency]; and
| 2. Access control procedures [Assignment: organization-defined frequency]. | x | x | x | P1 | |||||
| 2.102 | Information Security Policy – Access Control | 1.1 Access Management | Account Management | Each agency must identify account types (e.g., individual, group, system, application, guest/anonymous, and temporary) and establish conditions for group membership. | AC-2 | Account Management | (1) The organization: |
a. Identifies and selects the following types of information system accounts to support organizational missions/business functions: [Assignment: organization-defined information system account types];
b. Assigns account managers for information system accounts;
c. Establishes conditions for group and role membership;
d. Specifies authorized users of the information system, group and role membership, and access authorizations (i.e., privileges) and other attributes (as required) for each account;
e. Requires approvals by [Assignment: organization-defined personnel or roles] for requests to create information system accounts;
f. Creates, enables, modifies, disables, and removes information system accounts in accordance with [Assignment: organization-defined procedures or conditions];
g. Monitors the use of information system accounts;
h. Notifies account managers:
1. When accounts are no longer required;
2. When users are terminated or transferred; and
3. When individual information system usage or need-to-know changes;
i. Authorizes access to the information system based on:
1. A valid access authorization;
2. Intended system usage; and
3. Other attributes as required by the organization or associated missions/business functions;
j. Reviews accounts for compliance with account management requirements [Assignment: organization-defined frequency]; and
| k. Establishes a process for reissuing shared/group account credentials (if deployed) when individuals are removed from the group. | x | x | x | P1 | |||||
| 2.103 | Information Security Policy – Access Control | 1.1 Access Management | Account Management | Each agency must identify authorized users of information systems and specify access rights. | AC-2 | Account Management | (1) The organization: |
a. Identifies and selects the following types of information system accounts to support organizational missions/business functions: [Assignment: organization-defined information system account types];
b. Assigns account managers for information system accounts;
c. Establishes conditions for group and role membership;
d. Specifies authorized users of the information system, group and role membership, and access authorizations (i.e., privileges) and other attributes (as required) for each account;
e. Requires approvals by [Assignment: organization-defined personnel or roles] for requests to create information system accounts;
f. Creates, enables, modifies, disables, and removes information system accounts in accordance with [Assignment: organization-defined procedures or conditions];
g. Monitors the use of information system accounts;
h. Notifies account managers:
1. When accounts are no longer required;
2. When users are terminated or transferred; and
3. When individual information system usage or need-to-know changes;
i. Authorizes access to the information system based on:
1. A valid access authorization;
2. Intended system usage; and
3. Other attributes as required by the organization or associated missions/business functions;
j. Reviews accounts for compliance with account management requirements [Assignment: organization-defined frequency]; and
| k. Establishes a process for reissuing shared/group account credentials (if deployed) when individuals are removed from the group. | x | x | x | P1 | |||||
| 2.104 | Information Security Policy – Access Control | 1.1 Access Management | Account Management | Each agency must establish a process to enforce access requests to be approved by a business or data owner (or delegate) prior to provisioning user accounts. | AC-2 | Account Management | (1) The organization: |
a. Identifies and selects the following types of information system accounts to support organizational missions/business functions: [Assignment: organization-defined information system account types];
b. Assigns account managers for information system accounts;
c. Establishes conditions for group and role membership;
d. Specifies authorized users of the information system, group and role membership, and access authorizations (i.e., privileges) and other attributes (as required) for each account;
e. Requires approvals by [Assignment: organization-defined personnel or roles] for requests to create information system accounts;
f. Creates, enables, modifies, disables, and removes information system accounts in accordance with [Assignment: organization-defined procedures or conditions];
g. Monitors the use of information system accounts;
h. Notifies account managers:
1. When accounts are no longer required;
2. When users are terminated or transferred; and
3. When individual information system usage or need-to-know changes;
i. Authorizes access to the information system based on:
1. A valid access authorization;
2. Intended system usage; and
3. Other attributes as required by the organization or associated missions/business functions;
j. Reviews accounts for compliance with account management requirements [Assignment: organization-defined frequency]; and
| k. Establishes a process for reissuing shared/group account credentials (if deployed) when individuals are removed from the group. | x | x | x | P1 | |||||
| 2.105 | Information Security Policy – Access Control | 1.1 Access Management | Account Management | Each agency must authorize and monitor the use of guest/anonymous and temporary accounts, and notify relevant personnel (e.g., account managers) when temporary accounts are no longer required. | AC-2 | Account Management | (1) The organization: |
a. Identifies and selects the following types of information system accounts to support organizational missions/business functions: [Assignment: organization-defined information system account types];
b. Assigns account managers for information system accounts;
c. Establishes conditions for group and role membership;
d. Specifies authorized users of the information system, group and role membership, and access authorizations (i.e., privileges) and other attributes (as required) for each account;
e. Requires approvals by [Assignment: organization-defined personnel or roles] for requests to create information system accounts;
f. Creates, enables, modifies, disables, and removes information system accounts in accordance with [Assignment: organization-defined procedures or conditions];
g. Monitors the use of information system accounts;
h. Notifies account managers:
1. When accounts are no longer required;
2. When users are terminated or transferred; and
3. When individual information system usage or need-to-know changes;
i. Authorizes access to the information system based on:
1. A valid access authorization;
2. Intended system usage; and
3. Other attributes as required by the organization or associated missions/business functions;
j. Reviews accounts for compliance with account management requirements [Assignment: organization-defined frequency]; and
| k. Establishes a process for reissuing shared/group account credentials (if deployed) when individuals are removed from the group. | x | x | x | P1 | |||||
| 2.106 | Information Security Policy – Access Control | 1.1 Access Management | Account Management | Each agency must establish a process to notify relevant personnel (e.g., account managers, system administrators) to remove or deactivate access rights when users are terminated, transferred, or access rights requirements change. | AC-2 | Account Management | (1) The organization: |
a. Identifies and selects the following types of information system accounts to support organizational missions/business functions: [Assignment: organization-defined information system account types];
b. Assigns account managers for information system accounts;
c. Establishes conditions for group and role membership;
d. Specifies authorized users of the information system, group and role membership, and access authorizations (i.e., privileges) and other attributes (as required) for each account;
e. Requires approvals by [Assignment:…
This is the start of the file's text. The full file is on GovTribe.
File details come from the government source that posted it. Updated .