Executive Branch of

New Jersey State Government

Statewide Information Security Manual

Published By: NJ Office of Homeland Security and Preparedness Effective Date: February 6, 2024

STATE OF NEW JERSEY

STATEWIDE INFORMATION SECURITY MANUAL (2/6/2024)

TABLE OF CONTENTS

INFORMATION SECURITY AND PRIVACY PROGRAM (PM)

PM-01: STATEWIDE INFORMATION SECURITY MANUAL PURPOSE

PM-02: AUTHORITY

PM-03: SCOPE AND APPLICABILITY

PM-04: CYBERSECURITY AND PRIVACY BASELINE

PM-05: INFORMATION SECURITY AND PRIVACY RESOURCES

PM-06: ORGANIZATION OF THE STATEWIDE INFORMATION SECURITY MANUAL

PM-07: STATEWIDE INFORMATION SECURITY MANUAL CREATION AND MAINTENANCE

PM-08: POLICY AND STANDARDS DISTRIBUTION

PM-09: UPDATES

PM-10: SECURITY COMMUNICATION AND TRAINING

PM-11: ENFORCEMENT AND COMPLIANCE

PM-12: QUESTIONS

ORGANIZATIONAL SECURITY (OR)

OR-01: PURPOSE

OR-02: POLICY

OR-03: INFORMATION SECURITY AND PRIVACY MANAGEMENT ROLES AND RESPONSIBILITIES

OR-04: DIRECTOR, NEW JERSEY OFFICE OF HOMELAND SECURITY AND PREPAREDNESS

OR-05: STATE CHIEF TECHNOLOGY OFFICER (CTO)

OR-06: STATE CHIEF INFORMATION SECURITY OFFICER (CISO)

OR-07: DIRECTOR OF THE NEW JERSEY CYBERSECURITY COMMUNICATIONS AND INTEGRATION CELL

(NJCCIC)

OR-08: NEW JERSEY STATE PRIVACY OFFICER

OR-09: HEADS OF STATE AGENCIES (INCLUDES SECRETARIES, DIRECTORS, COMMISSIONERS,

CHAIRPERSONS, OR EQUIVALENT HEAD OF A STATE ENTITY WITHIN THE EXECUTIVE BRANCH OF STATE

GOVERNMENT)

OR-10: AGENCY CHIEF INFORMATION OFFICER (CIO)

OR-11: AGENCY CHIEF INFORMATION SECURITY OFFICER (CISO)

OR-12: AGENCY PRIVACY OFFICER

OR-13: FUNCTIONAL ROLES AND RESPONSIBILITIES

OR-14: INFORMATION SYSTEM OWNER

OR-15: INFORMATION OWNER

OR-16: ASSET CUSTODIAN

OR-17: AGENCY HUMAN RESOURCES (HR) PERSONNEL

OR-18: OFFICE OF THE ATTORENEY GENERAL PERSONNEL

OR-19: USER

OR-20: SEPARATION OF DUTIES

OR-21: CONTACTS WITH EXTERNAL ORGANIZATIONS

OR-22: INDEPENDENT REVIEW OF INFORMATION SECURITY PROGRAM

OR-23: REPORTING OF INCIDENTS

PERSONNEL SECURITY (PS)

PS-01: PURPOSE

PS-02: POLICY

PS-03: POSITION RISK DESIGNATION

PS-04: PERSONNEL SCREENING

PS-05: TRANSFERS AND PROMOTIONS

PS-06: PERSONNEL TERMINATION

PS-07: ACCESS AGREEMENTS

PS-08: THIRD-PARTY PERSONNEL SECURITY

PS-09: RULES OF BEHAVIOR

PS-10: AGENCY REQUIREMENTS

PS-11: USER REQUIREMENTS

PS-12: INCIDENTAL USE OF STATE OF NEW JERSEY INFORMATION ASSETS

PS-13: REPORTING OF INCIDENTS

PS-14: NO EXPECTATION OF PRIVACY

PS-15: SECURITY MONITORING

PS-16: PERSONNEL SANCTIONS

SECURITY AWARENESS AND TRAINING (AT)

AT-01: PURPOSE

AT-02: POLICY

AT-03: INFORMATION SECURITY AND PRIVACY AWARENESS PROGRAM

AT-04: INFORMATION SECURITY AND PRIVACY TRAINING

AT-05: ROLE-BASED SECURITY AND PRIVACY TRAINING

AT-06: PRACTICAL EXERCISES

AT-07: TRAINING RECORDS

AT-08: SECURITY ADVISORIES AND ALERTS

AT-09: INFORMATION SECURITY RESOURCES

RISK ASSESSMENT (RA)

RA-01: PURPOSE

RA-02: RISK ASSESSMENT POLICY

RA-03: SECURITY CATEGORIZATION

RA-04: DATA CLASSIFICATION

RA-05: DATA CLASSIFICATION AND SECURITY CATEGORIZATION CONSIDERATIONS

RA-06: ASSIGNING SECURITY CATEGORIZATIONS

RA-07: RISK ASSESSMENTS

RA-08: SUPPLY CHAIN RISK ASSESSMENTS

RA-09: RISK ASSESSMENT COMPONENTS

RA-10: RISK CONSIDERATIONS

RA-11: USE OF ALL-SOURCE INTELLIGENCE IN ASSESSING RISK

RA-12: VULNERABILITY MONITORING AND SCANNING

RA-13: VULNERABILITY AND PATCH MANAGEMENT

RA-14: VULNERABILITY SCANNING AND REMEDIATION

RA-15: SOFTWARE PATCHING AND CURRENCY

RA-16: RESPONSIBLE DISCLOSURE

RA-17: SECURITY TESTING AUTHORIZATION

RA-18: THREAT HUNTING

PERSONALLY IDENTIFIABLE INFORMATION PROCESSING AND TRANSPARENCY (PT)

PT-01: PURPOSE

PT-02: POLICY

PT-03: PRIVACY PROGRAM

PT-04: DISSEMINATION OF PRIVACY PROGRAM INFORMATION

PT-05: AUTHORITY TO PROCESS PERSONALLY IDENTIFIABLE INFORMATION

PT-06: PERSONALLY IDENTIFIABLE INFORMATION PROCESSING PURPOSES

PT-07: CONSENT

PT-08: MINIMIZATION OF PERSONALLY IDENTIFIABLE INFORMATION

PT-09: PRIVACY NOTICE

PT-10: SPECIFIC CATEGORIES OF PERSONALLY IDENTIFIABLE INFORMATION

PT-11: PERSONALLY IDENTIFIABLE INFORMATION QUALITY MANAGEMENT

MEDIA PROTECTION (MP)

MP-01: PURPOSE

MP-02: POLICY

MP-03: MEDIA ACCESS

MP-04: MEDIA MARKING

MP-05: MEDIA STORAGE

MP-06: MEDIA TRANSPORT

MP-07: MEDIA USE

MP-08: PORTABLE STORAGE DEVICES

MP-09: MEDIA SANITIZATION

MP-10: RECORDS RETENTION

CONFIGURATION MANAGEMENT (CM)

CM-01: PURPOSE

CM-02: POLICY

CM-03: BASELINE CONFIGURATIONS

CM-04: IMPLEMENTATION AND CONFIGURATION OF CYBERSECURITY TOOLS, TECHNOLOGIES, AND

SERVICES

CM-05: CONFIGURATION CHANGE CONTROL

CM-06: IMPACT ANALYSIS

CM-07: ACCESS RESTRICTIONS FOR CHANGE

CM-08: CONFIGURATION SETTINGS

CM-09: LEAST FUNCTIONALITY

CM-10: SYSTEM COMPONENT INVENTORY

CM-11: CONFIGURATION MANAGEMENT PLAN

CM-12: SOFTWARE USAGE RESTRICTIONS

CM-13: USER INSTALLED SOFTWARE

CM-14: INFORMATION LOCATION

ACCESS CONTROL (AC)

AC-01: PURPOSE

AC-02: POLICY

AC-03: ACCOUNT MANAGEMENT

AC-04: REQUIREMENTS FOR ACCOUNT REGISTRATION AND CREATION

AC-05: REQUIREMENTS FOR PRIVILEGED ACCESS

AC-06: REQUIREMENTS FOR TEMPORARY OR EMERGENCY ACCESS

AC-07: ACCESS ENFORCEMENT

AC-08: INFORMATION FLOW ENFORCEMENT

AC-09: SEPARATION OF DUTIES

AC-10: LEAST PRIVILEGE

AC-11: UNSUCCESSFUL LOGON ATTEMPTS

AC-12: HUMAN REVIEWS

AC-13: SYSTEM USE NOTIFICATION

AC-14: DEVICE LOCK

AC-15: SESSION TERMINATION

AC-16: PERMITTED ACTIONS WITHOUT IDENTIFICATION OR AUTHENTICATION

AC-17: REMOTE ACCESS

AC-17.1: CENTRALIZED MANAGEMENT OF REMOTE ACCESS INFRASTRUCTURE

AC-17.2: REMOTE ACCESSS SECURITY

AC-17.3: REMOTE ACCESS - AGENCY LEVEL AUTHORIZATION

AC-17.4: TRAINING OF REMOTE ACCESS USERS

AC-17.5: REMOTE ACCESS - USER RESPONSIBILITIES

AC-18: WIRELESS ACCESS

AC-19: USE OF EXTERNAL SYSTEMS

AC-20: MOBILE DEVICES

AC-20.1: AUTHORIZATION FOR USE OF MOBILE DEVICES

AC-20.2: MOBILE DEVICE RISK ASSESSMENT REQUIREMENT

AC-20.3: MOBILE DEVICE - BRING YOUR OWN DEVICE (BYOD)

AC-20.4: MOBILE DEVICE NETWORK ACCESS

AC-20.5: CENTRALIZED MANAGEMENT OF MOBILE DEVICES

AC-20.6: ELIGIBLE MOBILE DEVICES

AC-20.7: MOBILE DEVICE TECHNICAL SECURITY CONTROLS

AC-20.8: INVENTORY OF MOBILE DEVICES

AC-20.9: APPLICATION MANAGEMENT

AC-20.10: APPROVED CLOUD SERVICES

AC-20.11: BACKUP

AC-20.12: SAFETY AND COMPLIANCE

AC-20.13: TRAINING OF MOBILE DEVICE USERS

AC-21: INFORMATION SHARING

AC-22: PUBLICLY ACCESSIBLE CONTENT

IDENTITY AND AUTHENTICATION (IA)

IA-01: PURPOSE

IA-02: POLICY

IA-03: USER IDENTIFICATION AND AUTHENTICATION

IA-04: DEVICE IDENTIFICATION AND AUTHENTICATION

IA-05: IDENTIFIER MANAGEMENT

IA-06: AUTHENTICATOR MANAGEMENT

IA-07: PASSWORD-BASED AUTHENTICATION

IA-08: PASSWORD REQUIREMENTS FOR NON-PRIVILEGED USER ACCOUNTS

IA-09: PASSWORD REQUIREMENTS FOR PRIVILEGED USER ACCOUNTS

IA-10: PASSWORD REQUIREMENTS FOR SERVICE ACCOUNTS

IA-11: PUBLIC KEY-BASED AUTHENTICATION

IA-12: PROTECTION OF AUTHENTICATORS

IA-13: AUTHENTICATION FEEDBACK

IA-14: CRYPTOGRAPHIC MODULE AUTHENTICATION

IA-15: IDENTIFICATION AND AUTHENTICATION FOR EXTERNAL USERS

IA-16: RE-AUTHENTICATION

IA-17: IDENTITY PROOFING

SYSTEM AND INFORMATION INTEGRITY (SI)

SI-01: PURPOSE

SI-02: SYSTEM AND INFORMATION INTEGRITY POLICY

SI-03: FLAW REMEDIATION

SI-04: MALICIOUS CODE PROTECTION

SI-05: SYSTEM MONITORING

SI-06: SECURITY ALERTS, ADVISORIES AND DIRECTIVES

SI-07: SOFTWARE, FIRMWARE, AND INFORMATION INTEGRITY

SI-08: EMAIL AND WEB FILTERING PROTECTION

SI-09: INFORMATION INPUT VALIDATION

SI-10: ERROR HANDLING

SI-11: MEMORY PROTECTION

SI-12: INFORMATION MANAGEMENT AND RETENTION

SI-13: PERSONALLY IDENTIFIABLE INFORMATION

SYSTEM AND COMMUNICATIONS PROTECTION (SC)

SC-01: PURPOSE

SC-02: POLICY

SC-03: ENTERPRISE NETWORK MANAGEMENT

SC-04: IDENTIFIED RESPONSIBILITY

SC-05: SEPARATION OF SYSTEM AND USER FUNCTIONALITY

SC-06: INFORMATION IN SHARED SYSTEM RESOURCES

SC-07: DENIAL-OF-SERVICE PROTECTION

SC-08: BOUNDARY PROTECTION

SC-08.1: ACCESS POINTS

SC-08.2: EXTERNAL TELECOMMUNICATIONS/DATA SERVICES

SC-08.3: DENY BY DEFAULT/ALLOW BY EXCEPTION

SC-08.4: SPLIT TUNNELING FOR REMOTE DEVICES

SC-08.5: PROXY SERVERS

SC-08.6: PREVENT EXFILTRATION/DATA LOSS PREVENTION

SC-08.7: HOST BASED PROTECTION

SC-09: TRANSMISSION CONFIDENTIALITY AND INTEGRITY

SC-10: NETWORK DISCONNECT

SC-11: CRYPTOGRAPHIC KEY ESTABLISHMENT AND MANAGEMENT

SC-12: CRYPTOGRAPHIC PROTECTION

SC-12.1: DATA AT REST

SC-12.2: DATA IN TRANSIT

SC-12.3: PUBLICLY ACCESSSIBLE WEBSITES AND SERVICES

SC-13: COLLABORATIVE COMPUTING DEVICES AND APPLICATIONS

SC-14: PUBLIC KEY INFRASTRUCTURE CERTIFICATES

SC-15: MOBILE CODE

SC-16: SECURE NAME/ADDRESS RESOLUTION SERVICE

SC-17: ARCHITECTURE AND PROVISIONING FOR NAME/ADDRESS RESOLUTION SERVICE

SC-18: SESSION AUTHENTICITY

SC-19: PROCESS ISOLATION

SC-20: USAGE RESTRICTIONS

SC-21: DETONATION CHAMBERS

SYSTEM AND SERVICES ACQUISTION (SA)

SA-01: PURPOSE

SA-02: POLICY

SA-03: ALLOCATION OF RESOURCES

SA-04: SYSTEM DEVELOPMENT LIFE CYCLE

SA-05: ACQUISITION PROCESS

SA-06: SYSTEM DOCUMENTATION

SA-07: SECURITY AND PRIVACY ENGINEERING PRINCIPLES

SA-08: EXTERNAL SYSTEM SERVICES

SA-09: DEVELOPER CONFIGURATION MANAGEMENT

SA-10: DEVELOPER TESTING AND EVALUATION

SA-11: DEVELOPMENT PROCESS, STANDARDS, AND TOOLS

SA-12: DEVELOPER-PROVIDED TRAINING

SA-13: DEVELOPER SCREENING

SA-14: UNSUPPORTED SYSTEM COMPONENTS

SUPPLY CHAIN RISK MANAGEMENT (SU)

SU-01: PURPOSE

SU-02: POLICY

SU-03: SUPPLY CHAIN RISK MANAGEMENT PLAN

SU-04: SUPPLY CHAIN CONTROLS AND PROCESSES

SU-05: ACQUISITION STRATEGIES, TOOLS, AND METHODS

SU-06: SUPPLIER ASSESSMENTS AND REVIEWS

SU-07: NOTIFICATION AGREEMENTS

SU-08: INSPECTION OF SYSTEMS OR COMPONENTS

SU-09: COMPONENT AUTHENTICITY

SU-10: COMPONENT DISPOSAL

ASSESSMENT, AUTHORIZATION, AND MONITORING (CA)

CA-01: PURPOSE

CA-02: POLICY

CA-03: CONTROL ASSESSMENTS

CA-04: INFORMATION EXCHANGE

CA-05: PLAN OF ACTION AND MILESTONES

CA-06: AUTHORIZATION

CA-07: CONTINUOUS MONITORING

CA-08: PENETRATION TESTING AND RED TEAM EXERCISES

CA-09: INTERNAL SYSTEM CONNECTIONS

AUDIT AND ACCOUNTABILITY (AU)

AU-01: PURPOSE

AU-02: AUDIT AND ACCOUNTABILITY POLICY

AU-03: AUDIT EVENTS

AU-04: CONTENT OF AUDIT RECORDS

AU-05: PERSONALLY IDENTIFIABLE INFORMATION IN AUDIT LOGS

AU-06: AUDIT LOG STORAGE CAPACITY

AU-07: RESPONSE TO AUDIT LOGGING PROCESS FAILURES

AU-08: AUDIT RECORD REVIEW, ANALYSIS, AND REPORTING

AU-09: AUDIT REDUCTION AND REPORT GENERATION

AU-10: TIME STAMPS

AU-11: PROTECTION OF AUDIT RECORDS

MAINTENANCE (MA)

MA-01: PURPOSE

MA-02: MAINTENANCE POLICY

MA-03: CONTROLLED MAINTENANCE

MA-04: MAINTENANCE TOOLS

MA-05: NONLOCAL MAINTENANCE

MA-06: MAINTENANCE PERSONNEL

PLANNING (PL)

PL-01: PURPOSE

PL-02: POLICY

PL-03: SYSTEM SECURITY AND PRIVACY PLAN

PL-04: COMPLETION AND SUBMISSION OF THE SYSTEM SECURITY AND PRIVACY PLAN

PL-05: RULES OF BEHAVIOR

PL-05.1: AGENCY RESPONSIBILITIES

PL-05.2: USER REQUIREMENTS

PL-06: SECURITY AND PRIVACY ARCHITECTURE

PL-07: CENTRAL MANAGEMENT

PL-08: BASELINE SELECTION

PL-09: EXCEPTIONS TO BASELINE CONTROLS

PL-09.1: DOCUMENT EXCEPTION

PL-09.2: REQUEST APPROVAL

PL-09.3: PERIODIC REVIEW

PHYSICAL AND ENVIRONMENTAL SECURITY (PE)

PE-01: PURPOSE

PE-02: PHYSICAL AND ENVIRONMENTAL SECURITY POLICY

PE-03: PHYSICAL ACCESS SECURITY ZONES

PE-04: PHYSICAL ACCESS AUTHORIZATIONS

PE-05: VISITOR CONTROL

PE-06: LOST OR STOLEN ID BADGES

PE-07: PHYSICAL ACCESS CONTROLS

PE-08: SECURITY MONITORING AND AUDITING OF PHYSICAL ACCESS

PE-09: RETENTION OF SECURITY LOGS AND VIDEO

PE-10: CLEAN DESK/CLEAN SCREEN REQUIREMENTS

PE-11: POWER EQUIPMENT AND POWER CABLING

PE-12: EMERGENCY SHUTOFF

PE-13: EMERGENCY POWER

PE-14: EMERGENCY LIGHTING

PE-15: FIRE PROTECTION

PE-16: TEMPERATURE AND HUMIDITY CONTROLS

PE-17: WATER DAMAGE PROTECTION

PE-18: ALTERNATE WORK SITE

PE-19: DELIVERY AND REMOVAL OF INFORMATION ASSETS

PE-20: SECURING PORTABLE INFORMATION ASSETS

PE-21: DISPOSAL/TRANSFER OF INFORMATION ASSETS

CONTINGENCY PLANNING (CP)

CP-01: PURPOSE

CP-02: POLICY

CP-03: CONTINGENCY PLAN

CP-04: CONTINGENCY TRAINING

CP-05: CONTINGENCY PLAN TESTING

CP-06: ALTERNATE STORAGE SITE

CP-07: ALTERNATE PROCESSING SITE

CP-08: TELECOMMUNICATIONS SERVICES

CP-09: SYSTEM BACKUP

CP-10: SYSTEM RECOVERY AND RECONSTITUTION

INCIDENT RESPONSE (IR)

IR-01: PURPOSE

IR-02: POLICY

IR-03: REPORTING INFORMATION SECURITY AND PRIVACY INCIDENTS

IR-04: INCIDENT RESPONSE PLANNING

IR-05: INCIDENT RESPONSE TRAINING

IR-06: INCIDENT RESPONSE TESTING

IR-07: INCIDENT RESPONSE TEAM

IR-08: SIGNIFICANT CYBERSECURITY INCIDENTS

IR-09: INCIDENT CATEGORIZATION

IR-10: INCIDENT SEVERITY AND PRIORITIZATION

IR-11: INCIDENT TRACKING, DOCUMENTATION, AND REPORTS

INTERNATIONAL TRAVEL SAFETY AND SECURITY (TR)

TR-01: PURPOSE

TR-02: SCOPE

TR-01: POLICY

TR-02: TRAVELER RESPONSIBILITIES

TR-03: AGENCY RESPONSIBILITIES

TR-04: TRAVEL TO OR THROUGH HIGH-RISK DESTINATIONS

TR-05: PERSONAL DEVICES - TRAVEL TO OR THROUGH HIGH-RISK DESTINATIONS

TR-06: SUPPLEMENTAL INTERNATIONAL TRAVEL GUIDANCE

APPENDIX A – GLOSSARY OF KEY TERMS

APPENDIX B – RECORD OF CHANGES

STATE OF NEW JERSEY INFORMATION SECURITY AND PRIVACY PROGRAM (PM)

STATEWIDE INFORMATION SECURITY MANUAL (2/6/2024) PAGE 10 OF 305

INFORMATION SECURITY AND PRIVACY PROGRAM (PM)

The State of New Jersey affirms the fundamental significance of information security by delineating a set of policies and standards to securely protect the Executive Branch of New Jersey State Government information and information systems, while maintaining compliance with State and federal laws, executive orders, regulatory, contractual, and other policy requirements pertaining to confidentiality, integrity, availability, privacy, and safety. New Jersey State Government departments and agencies act as the custodians of extensive information holdings and rely upon information systems for fiscal, policy, and program delivery initiatives.

Consequently, security and privacy measures must be implemented to guard against unauthorized access to, alteration, disclosure, or destruction of information and information systems, and safeguards must be implemented to offset possible threats.

The information security Policies, Standards, Processes, and Supplemental Guidance contained in the Statewide Information Security Manual are key components of the State’s information security program. Five information security objectives: Confidentiality, Integrity, Availability, Privacy, and Safety comprise its foundation.

• Confidentiality - The property that sensitive information is not disclosed to unauthorized individuals, entities, or processes.

• Integrity - The property that sensitive information is not been modified or deleted in an unauthorized and undetected manner.

• Availability - The property that information or an information system is accessible and usable upon demand by an authorized entity.

• Privacy - The freedom from unauthorized intrusion or disclosure of information about an individual.

• Safety - The condition of being protected from harm or other non-desirable outcomes.

STATEWIDE INFORMATION SECURITY MANUAL (2/6/2024) PAGE 11 OF 305

These information security objectives can only be achieved if organizations embed them into their people, processes, and technology.

• People - Security is implemented and practiced by people. People design and implement processes and technology, as well as follow processes and use technology to enable business.

• Processes – Include formal and informal mechanisms (large and small, simple and complex) to accomplish objectives. Processes identify, measure, manage, and control risks to confidentiality, integrity, availability, privacy, and safety, and they also ensure accountability.

• Technology - Composed of the tools, applications, and infrastructure that make processes more efficient. Technology implemented by people following processes allows for the State to meet its information security objectives.

PM-01: STATEWIDE INFORMATION SECURITY MANUAL PURPOSE

The purpose of the Executive Branch of New Jersey State Government’s Statewide Information Security Manual, hereinafter referred to as the Manual, is to assist New Jersey State Government organizations in applying a risk-based approach to information security while establishing the

Figure 1 - Cybersecurity Objectives

STATEWIDE INFORMATION SECURITY MANUAL (2/6/2024) PAGE 12 OF 305

required behaviors and controls necessary to protect information technology resources, secure personal information, safeguard privacy, and maintain the physical safety of individuals.

This Manual includes a set of Policies and Standards that sets a clear direction for information security and its role in supporting Executive Branch departments and agencies in their efforts to carry out their respective missions and to achieve their business goals and objectives, while effectively managing risk and ensuring the confidentiality, integrity, and availability of their information and information systems. This Manual provides direction to the State workforce regarding their roles and responsibilities with respect to the security of State information assets.

The implementation of consistent security controls across the Executive Branch of New Jersey State Government will help departments and agencies comply with current and future legal obligations to ensure due diligence in protecting the confidentiality, integrity, availability, privacy, and safety of State information and information systems.

The Executive Branch of New Jersey State Government’s Statewide Information Security Manual has been derived from applicable State and federal laws; industry best practices, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework for Improving Critical Infrastructure, NIST Special Publication 800-53 Revision 5, Security and Privacy Controls for Information Systems and Organizations, NIST Special Publication 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations;

lessons learned; and other New Jersey State Government business and technology related considerations.

This Manual is intended to provide State Agencies with a means to tailor cost-effective security controls necessary to protect the confidentiality, integrity, availability, and privacy of State information and information systems commensurate with their sensitivity and criticality, while also maintaining and ensuring compliance with all legal requirements.

PM-02: AUTHORITY

The Policies, Standards, and Guidelines included in the Executive Branch of New Jersey State Government’s Statewide Information Security Manual are established under the authority of:

• New Jersey Executive Order No. 5 creating the Office of Homeland Security and Preparedness (OHSP) (Corzine, 3/6/2006);

• New Jersey Executive Order No. 178 creating the New Jersey Cybersecurity and Communications Integration Cell (“NJCCIC”) (Christie, 5/20/2015);

• Domestic Security Preparedness Act, P.L. 2001, C.246;

• Reporting of Cybersecurity Incidents, P.L.2023, c.19 (C.52-17B-193.2),

• The Critical Infrastructure Information Act of 2002, 6 U.S.C. § 133 et seq.; and

• N.J.S.A., Sections C.52:18A-224 through C.52:18A-234, The Office of Information Technology Reorganization Act.

The Information Security Policies and Standards are supported at the highest levels of the Executive Branch of New Jersey State Government.

https://pub.njleg.state.nj.us/Bills/2022/PL23/19_.PDF

STATEWIDE INFORMATION SECURITY MANUAL (2/6/2024) PAGE 13 OF 305

PM-03: SCOPE AND APPLICABILITY

The Policies, Standards, Procedures, and Guidelines included in the Statewide Information Security Manual apply to all Departments, Agencies, Commissions, Boards, Bodies, or other instrumentalities of the Executive Branch of New Jersey State Government, hereinafter referred to as: agencies, the Executive Branch, the SoNJ, or the State. All Executive Branch full-time and part-time employees, temporary workers, volunteers, interns, contractors, and those employed by contracted entities - collectively referred to as users - are governed by and responsible for complying with the Policies and Standards regardless of Agency, location, or role.

This Manual applies to all information assets owned, leased, licensed, managed, or used by Executive Branch agencies, their business partners, contractors, and other authorized third parties on behalf of the State of New Jersey. information assets include, but are not limited to, all information, data, devices, hardware (e.g. servers, laptop and desktop computers, tablets, phones, switches, etc.), software (e.g. commercial off-the-shelf and custom developed applications and support systems), services, or other components of information or communications systems.

The Policies, Standards, Procedures, and Guidelines included in this Manual supersede any previous Executive Branch Statewide information security Policies, Standards, Procedures, and Guidelines issued prior to February 6, 2024, the effective date. These Policies, Standards, Procedures, and Guidelines have been written in conformance with and do not supersede any applicable State or federal laws, executive orders, circulars, or existing contracts, memorandums of understanding, or labor management agreements in effect as of the effective date of the Statewide Information Security Manual.

PM-04: CYBERSECURITY AND PRIVACY BASELINE

Individual agencies have various legal, regulatory, and contractual compliance requirements based on their business services and operations, and the information they collect, store, process, and transmit. Some commonly applicable statutory and regulatory requirements include IRS Publication 1075, Safeguards for Protecting Federal Tax Returns and Return Information, Health Insurance Portability and Accountability Act (HIPAA), Minimum Acceptable Risk Standards for Exchanges, version 2.0 (MARS-E), Family Education Rights Privacy Act (FERPA), Payment Card Industry- Data Security Standards (PCI-DSS), Criminal Justice Information Services (CJIS), European Union General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), Children’s Online Privacy Protection Act (COPPA), and others. In order to satisfy the control objectives for the above statutory and regulatory requirements and to provide a uniform baseline, all State-owned, leased, licensed, or managed information systems, system components, and system services are required to, at a minimum, implement Moderate level controls as defined by NIST Special Publication 800-53 Revision 5, Security and Privacy Controls for Information Systems and Organizations.

Agencies may develop and implement more restrictive sets of information security policies and standards for specific information systems, programs, or requirements. Agency-developed https://www.irs.gov/pub/irs-pdf/p1075.pdf https://www.irs.gov/pub/irs-pdf/p1075.pdf https://www.hhs.gov/hipaa/index.html https://www.hhs.gov/hipaa/index.html https://www.cms.gov/CCIIO/Resources/Regulations-and-Guidance/Downloads/2-MARS-E-v2-0-Minimum-Acceptable-Risk-Standards-for-Exchanges-11102015.pdf https://www.cms.gov/CCIIO/Resources/Regulations-and-Guidance/Downloads/2-MARS-E-v2-0-Minimum-Acceptable-Risk-Standards-for-Exchanges-11102015.pdf https://www2.ed.gov/policy/gen/guid/fpco/ferpa/index.html https://www.pcisecuritystandards.org/pci_security/maintaining_payment_security https://www.pcisecuritystandards.org/pci_security/maintaining_payment_security https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center https://ec.europa.eu/info/law/law-topic/data-protection_en https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180SB1121 https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180SB1121 https://uscode.house.gov/view.xhtml?req=granuleid%3AUSC-prelim-title15-chapter91&edition=prelim https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final

STATEWIDE INFORMATION SECURITY MANUAL (2/6/2024) PAGE 14 OF 305

information security policies and standards can exceed, but must not conflict with, the baseline established by this Manual.

The Executive Branch of New Jersey State Government’s Statewide Information Security Manual does not apply to independent State entities that are not subject to the policy supervision and control of the Governor. Examples of independent State entities include the New Jersey Transit Authority, the New Jersey Turnpike Authority, etc.

PM-05: INFORMATION SECURITY AND PRIVACY RESOURCES

In order to ensure the resources necessary to appropriately manage information security and privacy risks in accordance with the Policies, Standards, Procedures, and Guidelines included in this manual, agencies are required to:

(a) Include the resources needed to implement the information security and privacy programs in capital planning and investment requests and document all exceptions to this requirement;

(b) Prepare documentation required for addressing information security and privacy programs in capital planning and investment requests in accordance with applicable laws, executive orders, circulars, directives, policies, regulations, and standards; and

(c) Make available for expenditure, the planned information security and privacy resources.

Supplemental Guidance: In addition to individual agencies budgeting and allocating information security and privacy resources, the New Jersey Cybersecurity and Communications Integration Cell (NJCCIC) and the New Jersey Office of Information Technology (NJOIT) also plan, budget for, and provide resources to all agencies in the Executive Branch of New Jersey State Government.

Agencies are encouraged to contact both the NJCCIC and NJOIT for more information about available resources.

PM-06: ORGANIZATION OF THE STATEWIDE INFORMATION SECURITY

MANUAL

The individual information security Policies, Standards, Procedures, and Guidelines, along with their supporting references and forms, have been compiled and organized into the Executive Branch of New Jersey State Government’s Statewide Information Security Manual as each Policy, Standard, and Guideline presented has key dependencies with others. The collection of Policies, Standards, Procedures, and Guidelines organized within this Manual provides context, consistency, and clarity, whereas separate policies and standards may lead to gaps, inconsistencies, and conflicts.

The sections of this Manual are organized to generally align with the control families that can be found in NIST Special Publication 800-53 Revision 5. The controls included in this Manual are tailored to New Jersey State Government to allow for continuous business and service enablement through intelligent risk management.

STATEWIDE INFORMATION SECURITY MANUAL (2/6/2024) PAGE 15 OF 305

The information security documentation in this Manual is comprised of four (4) main components:

• Policy - Documents high-level rules, establishes roles and responsibilities, and sets management expectations governing security practices, operational procedures, and the acceptable use of State information assets. Policies are supported by standards and further implemented by procedures.

• Standard - A mandatory control that helps enforce and support a policy. Standards include specifications for processes, practices, uses, and hardware and software configurations that are considered industry or government approved specifications.

External standards organizations, such as the National Institute of Standards and Technology, the Center for Internet Security, and others publish approved information security standards that are included in this Manual.

• Procedure - Contains detailed descriptions of the steps necessary to perform specific operations in conformance with applicable standards and represent the implementation of a policy. They are generally developed by those who are responsible for the implementation of a policy or standard, such as systems administrators, network administrators, database administrators, etc.

• Supplemental Guideline - Consists of recommendations, best practices, and supporting documents and processes that help with the interpretation and implementation of a specific policy or standard. Supplemental Guidance is intended to help agencies and individuals to achieve a policy's objectives by providing a framework in order to implement procedures while allowing for discretion in their interpretation, implementation, or use. Supplemental Guidance may include background information regarding the Policy, Standard, and control objectives.

• Security Operations Directive – Compulsory direction to an agency for purposes of safeguarding State information and information systems from a known or reasonably suspected information security threat, vulnerability, or risk. The State Chief Information Security Officer promulgates and oversees the implementation of Security Operations Directives.

When applied in concert, these components allow for security objectives to be achieved.

PM-07: STATEWIDE INFORMATION SECURITY MANUAL CREATION AND

MAINTENANCE

The State Chief Information Security Officer (CISO), within the New Jersey Office of Homeland Security and Preparedness’ New Jersey Cybersecurity and Communications Integration Cell, has overall responsibility for the creation and maintenance of the Executive Branch of New Jersey State Government’s Statewide Information Security Manual.

The Policies, Standards, Procedures, and Guidelines contained in this Manual shall be reviewed and approved at least annually by the CISO to ensure the State’s security program is relevant and

STATEWIDE INFORMATION SECURITY MANUAL (2/6/2024) PAGE 16 OF 305

applicable to manage the risks associated with new and emerging security threats and vulnerabilities as they arise.

Reviews of the Manual must also be initiated under the following circumstances:

(a) In response to legislative, regulatory, or policy changes that have information security implications;

(b) When industry, national, or international standards for information security are introduced or significantly revised to address emerging business and technology issues;

(c) In response to a security risk assessment or audit in which the current controls are deemed to expose the State to unacceptable risks;

(d) In response to threat or vulnerability trends that indicate State information and information systems are at significantly increased risk;

(e) After the review of a significant information security incident; and/or

(f) To account for the planning and implementation of new or significantly changed technologies.

The Manual is considered a living document and, as such, is subject to changes and modifications, with or without notification, as necessary to protect the State’s business objectives, individuals, and assets. The State reserves the right to revoke, change, or supplement these Policies, Standards, Procedures, and Guidelines at any time without prior notice. Such changes shall be effective immediately upon approval by the State CISO, unless otherwise stated.

PM-08: POLICY AND STANDARDS DISTRIBUTION

The State CISO is responsible for the creation and distribution of the Statewide Information Security Manual to all agencies. At a minimum, the contents of the Manual shall be distributed for viewing on agency Intranet websites.

PM-09: UPDATES

Substantive changes or updates to the Manual will be announced to employees via email and/or announced on the NJCCIC website, cyber.nj.gov. Changes will be noted in the Record of Changes, Appendix C.

PM-10: SECURITY COMMUNICATION AND TRAINING

Executive Branch agencies shall ensure that all users are familiar with the requirements of the Executive Branch of New Jersey State Government’s Statewide Information Security Manual.

Agencies shall conduct security awareness training for all users, at least annually, to ensure that all personnel are aware of the security and privacy risks associated with their roles and that they understand their responsibilities, as well as the applicable laws, policies, standards, and procedures related to the security of State information and State information systems. New hires are required to complete information security awareness training within thirty (30) business days of their start date as part of the required new hire training curriculum.

http://www.cyber.nj.gov/

STATEWIDE INFORMATION SECURITY MANUAL (2/6/2024) PAGE 17 OF 305

Agencies shall ensure that all interns, temporary workers, and contracted third parties covered by this Manual are familiar with this Manual and comply with its requirements.

Users will be kept abreast of policy and standard changes via the following communication methods:

• Emails;

• State Internet sites;

• Department and Agency Intranet sites;

• Staff meetings;

• Annual security awareness training; and/or

• Other communications mediums as required.

PM-11: ENFORCEMENT AND COMPLIANCE

All users of Executive Branch of New Jersey State Government information and information systems are governed by and are responsible for complying with the Policies and Standards in this Manual. Users who are found in violation of these Information Security and Privacy Policies and Standards are subject to disciplinary action up to and including termination of employment or immediate termination of contractor and/or vendor relationship. Violations of law may be referred to the appropriate law enforcement agency for investigation and prosecution.

PM-12: QUESTIONS

Questions about this Manual may be directed to your respective Agency Chief Information Security Officer or to the New Jersey Cybersecurity and Communications Integration Cell, via email at njccic@cyber.nj.gov.

REFERENCES

The requirements established in the Program Management Policies and Standards have been derived from the following:

NIST SP 800-53r5 Program Management (PM); and

NIST CSF Identify/Governance (ID.GV).

mailto:njccic@cyber.nj.gov

STATE OF NEW JERSEY ORGANIZATIONAL SECURITY (OR)

STATEWIDE INFORMATION SECURITY MANUAL (2/6/2024) PAGE 18 OF 305

ORGANIZATIONAL SECURITY (OR)

OR-01: PURPOSE

The purpose of the Organizational Security Policy is to establish and maintain a management framework that promotes and oversees the implementation of security controls and the performance of information security throughout the Executive Branch of New Jersey State Government.

KEY TERMS

None. See the Glossary in Appendix A for the complete listing of terms.

OR-02: POLICY

The Chief Technology Officer (CTO) of New Jersey and the Director of the New Jersey Office of Homeland Security and Preparedness (NJOHSP) jointly establish a management structure for information security across the Executive Branch of New Jersey State Government.

OR-03: INFORMATION SECURITY AND PRIVACY MANAGEMENT ROLES

AND RESPONSIBILITIES

The primary roles within the Executive Branch of the New Jersey State Government information security management framework as well as the responsibilities and expectations associated with these roles are defined in the following Organizational Security subsections.

OR-04: DIRECTOR, NEW JERSEY OFFICE OF HOMELAND SECURITY AND

PREPAREDNESS

The Director of the NJOHSP shall administer, coordinate, lead, and supervise New Jersey's counterterrorism and preparedness efforts. The goal of the NJOHSP is to coordinate emergency response efforts across all levels of government, law enforcement, emergency management, non-profit organizations, other jurisdictions, and the private sector to protect the people of New Jersey. In addition, the Director shall be responsible for the strategic development, execution, and management of an effective and efficient information security program to manage cyber risks and ensure the confidentiality, integrity, and availability of the Executive Branch’s information assets. Additionally, the Director of NJOHSP shall:

(a) Oversee the response to information security incidents;

(b) Stay abreast of cybersecurity threats to the Executive Branch of State Government information and information systems; and

(c) Advise the DSPTF through regular briefings and reports.

OR-05: STATE CHIEF TECHNOLOGY OFFICER (CTO)

STATEWIDE INFORMATION SECURITY MANUAL (2/6/2024) PAGE 19 OF 305

The CTO leads the NJOIT, which is responsible for providing and maintaining the information technology infrastructure of the Executive Branch of State Government, including all ancillary departments and agencies. The CTO provides vision and leadership for the NJOIT and is responsible for coordinating and conducting all Executive Branch technology operations. The CTO directs the planning, implementation, and governance of enterprise information technology systems in support of the Executive Branch of State Government’s business objectives and operations to improve cost-effectiveness, service quality, and mission development.

At the CTO’s direction, the NJOIT fulfills the following responsibilities in support of the State’s information security program:

(a) Design, acquisition, and implementation of enterprise IT systems in compliance with the Statewide Information Security Manual’s Policies and Standards set by the State CISO;

(b) Operation and support of IT systems in compliance with approved security procedures, including, but not limited to:

1. IT asset management;

2. Malware protection;

3. Patch management;

4. Web proxying and Content filtering;

5. Secure file exchange; and

6. Data encryption;

(c) Management of third parties providing managed information services to NJOIT and other State entities;

(d) Identity and access management;

(e) Disaster recovery planning and operations;

(f) Providing recommendations on policy and control enhancements to the NJOHSP’s Division of Cybersecurity;

(g) Monitoring the NJOIT’s IT environment to identify, contain, or eliminate unauthorized activity;

(h) Assisting in implementing the Information Security Incident Response Plan;

(i) Providing subject-matter expertise for technical issues regarding information security;

and

(j) Executing the day-to-day security management of enterprise information, systems, and solutions through the application of controls as defined within the Statewide Information Security Manual’s Policies and Standards.

Supplemental Guidance: Consistent with Executive Order 225, the Office of Information Technology is responsible for providing and maintaining the information technology infrastructure (compute, network, and storage) of the Executive Branch, including all ancillary http://nj.gov/infobank/circular/eocc225.pdf

STATEWIDE INFORMATION SECURITY MANUAL (2/6/2024) PAGE 20 OF 305

departments and agencies of the Executive Branch. Within this Manual, the Policies and Standards require agencies to implement safeguards necessary to protect information assets against a loss of confidentiality, integrity, and availability. The term “agency” includes the NJOIT and all ancillary departments and agencies.

OR-06: STATE CHIEF INFORMATION SECURITY OFFICER (CISO)

The State CISO reports to the Director of the NJOHSP and serves as head of the NJOHSP’s Division of Cybersecurity. The State CISO shall establish and manage an information security program to ensure the confidentiality, integrity, and availability of the State of New Jersey Executive Branch’s information resources, systems, and services while promoting and protecting privacy and safety.

The State CISO has overall responsibility for the development, implementation, and performance of the information security program by:

(a) Setting strategic information security planning across the Executive Branch of State Government;

(b) Publishing the Statewide Information Security Manual’s Policies and Standards;

(c) Developing, managing, and executing the Statewide Information Security Incident Response Plan;

(d) Identifying security requirements to limit the risks associated with identified Executive Branch business objectives as defined by the Governor and the Heads of State agencies;

(e) Developing, maintaining, and interpreting the Statewide Information Security Manual’s Policies and Standards;

(f) Providing information security subject matter expertise to State Agencies;

(g) Drafting and implementing an information Security Awareness and Training program to be used by all State Agencies;

(h) Providing security metrics to track the performance of the information security program;

and

(i) Developing an Information Security Governance, Risk, and Compliance program, including, but not limited to:

1. Coordinating and conducting compliance and risk assessments of agencies and their information assets;

2. Conducting and managing vulnerability assessments of agency networks, applications, databases, and systems;

3. Conducting penetration tests of agency networks, applications, databases, and systems; and

4. Conducting information security risk assessments of third parties with access to State of New Jersey information assets.

STATEWIDE INFORMATION SECURITY MANUAL (2/6/2024) PAGE 21 OF 305

OR-07: DIRECTOR OF THE NEW JERSEY CYBERSECURITY

COMMUNICATIONS AND INTEGRATION CELL (NJCCIC)

The NJCCIC, established within the NJOHSP’s Division of Cybersecurity, shall be the State’s Cybersecurity Information Sharing and Analysis Organization. The Director of the NJCCIC shall be responsible for:

(a) Developing and managing a cybersecurity information sharing and analysis organization to liaise with the National Cybersecurity and Communications Integration Center within the US Department of Homeland Security, other federal agencies, and other public and private sector entities on issues relating to cybersecurity;

(b) Coordinating cybersecurity information sharing, performing cybersecurity threat analysis, and promoting shared and real-time situational awareness between and among the public and private sectors;

(c) Coordinating information sharing related to cybersecurity risks, warnings, and incidents, and providing support on cybersecurity incident response and cybercrime investigations;

(d) Providing information and recommending best practices on cybersecurity and resilience measures to public and private entities, including information and best practices for information security and data protection;

(e) Developing and implementing a cybersecurity threat information exchange with appropriate sources including public utilities and private industry;

(f) Implementing and monitoring a centralized Security Information and Event Management (SIEM) system and, where appropriate, identifying, containing, or eliminating unauthorized activity and other cyber threats;

(g) Developing and managing an incident reporting system;

(h) Developing and providing information security incident response assistance and subject-matter expertise, as required;

(i) Providing cyber threat intelligence reports, analysis reports, briefings, alerts, and trainings to private and public organizations;

(j) Developing working relationships with external organizations including law enforcement, the private sector, academia, Information Sharing and Analysis Organizations, Information Sharing and Analysis Centers, and regulatory authorities; and

(k) And providing threat, risk, and major incident reports to the New Jersey Domestic Security Preparedness Task Force (DSPTF).

OR-08: NEW JERSEY STATE PRIVACY OFFICER

The New Jersey State Privacy Officer reports to the State CTO and serves as the central point of guidance, leadership, vision, coordination, and oversight of agency privacy programs.

At the CTO’s direction, the State Privacy Officer coordinates the planning, implementation, governance, and management of enterprise privacy initiatives and is responsible for the oversight

STATEWIDE INFORMATION SECURITY MANUAL (2/6/2024) PAGE 22 OF 305

of the State’s compliance with all applicable State and federal laws and regulations regarding the collection, use, maintenance, sharing, and disposal of personally identifiable information.

The State Privacy Officer:

(a) Ensures that the public has access to information about the State’s privacy activities and can communicate with its officials for privacy;

(b) Ensures that the State’s privacy practices and reports are publicly available; and

(c) Employs publicly facing email addresses and/or phone lines to enable the public to provide feedback and/or direct questions to privacy offices regarding privacy practices.

OR-09: HEADS OF STATE AGENCIES (INCLUDES SECRETARIES,

DIRECTORS, COMMISSIONERS, CHAIRPERSONS, OR EQUIVALENT

HEAD OF A STATE ENTITY WITHIN THE EXECUTIVE BRANCH OF

STATE GOVERNMENT)

Heads of State Agencies (includes Secretaries, Directors, Commissioners, Chairpersons, or equivalent head of a State entity within the Executive Branch of State Government) are responsible for their respective agency’s operations. Likewise, they are responsible for the overall protection and use of information assets owned, managed, or licensed by the agency. To these ends, they are charged with:

(a) Driving commitment and support for the information security program;

(b) Accepting risk on behalf of the agency;

(c) Assigning appropriate information technology management responsibilities within their respective agency to a designee who has the responsibility for the implementation and management of information technology systems in support of agency goals and objectives, and in accordance with the Executive Branch of State Government’s Statewide Information Security Policies and Standards;

(d) Assigning appropriate responsibilities within their agency to a designee who has the authority and responsibility for ensuring the implementation of, and the adherence to, the information security program; and

(e) Promoting adherence to information security policies and cyber awareness programs.

OR-10: AGENCY CHIEF INFORMATION OFFICER (CIO)

The Agency CIO shall be responsible for the direction, planning, and implementation of information technology systems in support of agency business goals and objectives. In accordance with the New Jersey Office of Information Technology standards, directives, and enterprise information strategy, the Agency CIO directs the planning and implementation of the agency information technology systems.

The Agency CIO fulfills the following responsibilities in support of the State’s information security program:

STATEWIDE INFORMATION SECURITY MANUAL (2/6/2024) PAGE 23 OF 305

(a) Design, acquisition, implementation, and operation of IT systems in compliance with approved policies and standards;

(b) Operation and support of IT systems in compliance with approved security procedures, including, but not limited to:

1. IT asset management;

2. Malware protection;

3. Patch management; and

4. Data encryption;

(c) Management of third parties providing managed information services to the agency;

(d) Identity and access management;

(e) Disaster recovery planning and operations in coordination with NJOIT;

(f) Providing recommendations regarding policy and control enhancements to the Division of Cybersecurity;

(g) Monitoring the agency IT environment and, where appropriate, identifying, containing, and eliminating unauthorized activity;

(h) Assisting in the implementation of the Information Security Incident Response Plan;

(i) Executing the day-to-day security management of information, systems, and solutions through the application of controls as defined within the Statewide Information Security Manual’s Policies and Standards; and

(j) Providing subject matter expertise for technical issues regarding information security.

Supplemental Guidance: Consistent with Executive Order 225, the Office of Information Technology is responsible for providing and maintaining the information technology infrastructure (compute, network, and storage) of the Executive Branch, including all ancillary departments and agencies of the Executive Branch. Within this Manual the Policies and Standards require agencies to implement the safeguards necessary to protect information assets against a loss of confidentiality, integrity, and availability. The term “agency” includes NJOIT and all ancillary departments and agencies.

OR-11: AGENCY CHIEF INFORMATION SECURITY OFFICER (CISO)

The Agency CISO shall be responsible for protecting and maintaining the confidentiality, integrity, and availability of information assets under their purview. The Agency CISO fulfills the following responsibilities in support of the Statewide Information Security Policies and Standards:

(a) Identifying security requirements to effectively limit cyber risks associated with the agency’s business goals and objectives;

(b) Implementing and promoting information security awareness within their respective agency;

http://nj.gov/infobank/circular/eocc225.pdf

STATEWIDE INFORMATION SECURITY MANUAL (2/6/2024) PAGE 24 OF 305

(c) Ensuring compliance with the Statewide Information Security Manual’s Policies and Standards within their respective State agency, including, but not limited to:

1. Coordination of risk assessments and compliance audits with the NJOHSP’s Division of Cybersecurity;

2. Coordination of vulnerability assessments of agency networks, applications, databases, and systems; and

3. Coordination of risk assessments of third parties having access to agency information assets;

(d) Assisting in the implementation of the Information Security Incident Response Plan; and

(e) Reporting all information security incidents to the NJCCIC.

OR-12: AGENCY PRIVACY OFFICER

The Agency Privacy Officer is responsible for the oversight of the agency’s compliance with all applicable State and federal laws and regulations regarding the collection, use, maintenance, sharing, and disposal of personally identifiable information.

OR-13: FUNCTIONAL ROLES AND RESPONSIBILITIES

In addition to the management structure as documented above, the implementation and support for the State’s Information Security Program requires agencies to identify and assign appropriate personnel to the following functional roles and responsibilities.

OR-14: INFORMATION SYSTEM OWNER

The Information System Owner is the agency official responsible for the overall procurement, development, integration, modification, or operation and maintenance of an information system.

The Information System Owner may also be referred to as the Asset Owner. The Information System Owner has the following responsibilities related to system security:

(a) Assigns the security categorization and criticality of the information system;

(b) In coordination with the Information Owner, Asset Custodians, and stakeholders, develops and maintains security plans and contingency plans for all general support systems and major applications under their responsibility, including documenting the business associations and dependencies of the system (e.g., linked IT resources and flows of information);

(c) Ensures contracts pertaining to the information system include provisions for necessary security and privacy controls;

(d) Ensures that the information system…