Exhibit_C-_Information_Security_Policy.pdf

INFORMATION SECURITY POLICY

NUMBER:

OPM-01

SUBJECT:

INFORMATION SECURITY- ACCEPTABLE USE POLICY

EXPIRES:

UNTIL RESCINDED

ESRI Enterprise Agreement Event ID# 0000033425

Exhibit C- Information Security Policy Page 1of 41

ACCEPTABLE USE POLICY OPM-01

1. Acceptable Use Policy

1.1. Introduction and Overview

Information assets owned by State Water Resources Control Board (SWRCB) including, but not limited to, SWRCB data and information, collaboration platforms, laptops, cell phones, and removable storage devices are strategic assets intended for official business use and are entrusted to state personnel in the performance of their job-related duties.

Inappropriate use of SWRCB information assets could negatively affect the confidentiality, integrity, or availability of information, information systems, or other information assets of the SWRCB and/or the State of California. Consequently, it is important for all users to access and use information assets in a responsible, ethical, and legal manner that safeguards SWRCB data and information.

Additionally, the appropriate use of information assets benefits the State and SWRCB by strengthening the protection of the SWRCB and its personnel and business partners from illegal or potentially damaging activities.

1.2. Objectives

This policy defines and establishes the requirements for the appropriate use and safeguarding of SWRCB’s information assets.

2. Ownership of Information

Data and information in hard copy format that are electronically created, sent, received, processed, or stored on information assets owned, leased, administered, or otherwise under the custody and control of SWRCB are the property of the State. Any information or resources (including e-mail, messages, and files) not specifically identified as the property of other parties, and that is transmitted, processed, or stored on SWRCB’s and/or a business partner’s IT facilities is the property of SWRCB.

Individual access and use of SWRCB information assets are neither personal nor private. As such, SWRCB and Regional Water Quality Control Boards (Water Boards) management reserves the right to monitor and/or log all employee use of SWRCB information assets with or without prior notice.

3. Scope and Applicability

The scope of this policy extends to all information assets owned or operated by SWRCB and to all personnel authorized to use these assets.

4. Policy Directives

4.1. Users must not use SWRCB information assets to engage in or solicit the performance of any activity that violates laws, regulations, rules, policies, standards, and/or other applicable requirements issued by the federal government, the State of California, and the SWRCB.

4.2. Users must not use SWRCB information assets for personal enjoyment, private gain or advantage, personal gain, political activity, unsolicited advertising, unauthorized fundraising, or an outside endeavor not related to state business.

ESRI Enterprise Agreement Event ID# 0000033425

4.3. Users must use and protect SWRCB information assets in accordance with this policy and applicable information security and privacy policies.

4.4. Users must not engage in any activity that attempts to circumvent or alter the function of SWRCB's security controls (e.g., spoofing email, anonymous proxies).

4.5. Users must not share their work-related account(s), passwords, Personal Identification Numbers (PIN), security questions/answers, security tokens (e.g., smartcard, key fob), or similar information or devices used for authentication and authorization purposes.

4.6. Users must not use SWRCB information assets to send or arrange to send emails and/or intentionally access sites that contain pornographic, racist, or offensive material.

4.7. Users must not use SWRCB information assets to send or arrange to send email chain letters, unauthorized mass mailings, or malicious code.

Internet, Email, and Collaboration Platform Usage

4.8. Users will understand, acknowledge, and adhere to State Water Resources Control Board’s Internet, Email, and Collaboration Platform Standards document.

Social Media

4.9. Users responsible for maintaining official SWRCB media accounts must comply with the requirements listed in the State of California’s Social Media Standard (SIMM 66B) as well as the guidelines listed in the Social Media Guidelines for State Water Resources Control Board and Regional Water Quality Control Boards’ Internet Presence document.

5. Minimal and Incidental Use

Government Code Section 8314 and the relevant provisions of the Memorandums of Understanding (MOUs) permits the minimal and incidental personal use of State-owned and operated IT resources (e.g., SWRCB computers, telephones, and other approved information assets). As applied at SWRCB, this means:

5.1. Minimal and incidental personal use of state IT assets, including electronic mail, Internet access, fax machines, printers, and copiers is restricted to users that are approved by SWRCB. It does not extend to family members or associates of approved users.

5.2. Minimal and incidental use must not result in direct costs to SWRCB, cause legal action against SWRCB, or reflect negatively upon the mission or values of SWRCB.

5.3. Minimal and incidental use must not interfere with the normal performance of an employee’s work duties.

5.4. Questions related to minimal and incidental use questions and issues will be addressed by using the guidelines of the Acceptable Use Policy. Management at Water Boards will work collaboratively with the Human Resources Branch Chief, Labor Relations office, and Information Security Officer (ISO) to resolve issues related to minimal and incidental use.

ESRI Enterprise Agreement Event ID# 0000033425

6. Roles and Responsibilities

Water Boards Executive Director

6.1. The Executive Director owns this Acceptable Use Policy and is responsible for ensuring that all users of SWRCB information assets are aware of this policy and acknowledge their individual responsibilities.

6.2. The Executive Director is responsible for ensuring that this policy will be reviewed, updated accordingly, and approved by appropriate parties on an annual basis.

6.3. The Executive Director is responsible for the periodic auditing and assessment of compliance with this policy.

Water Boards Management

6.4. Management shall be committed to ensuring compliance with this and other applicable organizational policies.

Water Boards Users

6.5. Users must use and protect SWRCB information assets in accordance with this policy and applicable information security and privacy policies.

6.6. Users must not use SWRCB information assets to engage in or solicit the performance of any activity that violates laws, regulations, rules, policies, standards, and/or other applicable requirements issued by the federal government, the State of California, and the SWRCB.

6.7. Users of SWRCB information assets must not engage in any activity that attempts to circumvent SWRCB’s security controls (e.g., spoofing email, anonymous proxies, or unauthorized encryption), or other activities that may degrade the performance of information resources or may deprive an authorized user access to SWRCB assets.

6.8. Users must not use SWRCB information assets for personal enjoyment, private gain or advantage, personal benefit, political activity, unsolicited advertising, unauthorized fundraising, or an outside endeavor not related to state business.

6.9. Users must not connect or otherwise attach personal or unauthorized devices or equipment to the SWRCB network infrastructure.

6.10. Users must not share their work-related account(s), passwords, Personal Identification Numbers (PIN), security questions/answers, security tokens (e.g., smartcard, key fob), or other information or devices used for identification, authentication and/or authorization purposes.

6.11. Users must report any security concerns pertaining to SWRCB information asset security of which they become aware to the ISO, designee, or appropriate security staff. Security concerns in information asset security include unexpected software or system behavior, which could result in unintentional disclosure of information or exposure to security threats.

6.12. Users must report any suspected or actual activities and/or events indicating misuse or violation of this Acceptable Use Policy to the ISO, designee, or appropriate security staff.

6.13. All Water Boards personnel are required to acknowledge they have read and understood this policy and applicable information security and privacy policies. The

ESRI Enterprise Agreement Event ID# 0000033425 acknowledgement via an Acceptable Use Acknowledgement Form will be filed in the employee’s official personnel record.

7. Enforcement

7.1. Violation of the provisions described in this policy may result in possible corrective action or internal discipline as appropriate pursuant to Government Code Section 19572. Criminal or civil action may also be initiated in appropriate circumstances, including violation of State or Federal laws.

7.2. As set forth in Government Code section 11549.3, state entities shall comply with the information security and privacy policies, standards and procedures issued by the California Office of Information Security (OIS). In addition to compliance with the information security and privacy policies, standards, procedures, and filing requirements issued by OIS, state entities shall ensure compliance with all security and privacy laws, regulations, rules, and standards specific to and governing the administration of their programs. Program administrators shall work with their general counsel, Privacy Officer/Program Coordinator, and ISO to identify all security and privacy requirements applicable to their programs and ensure implementation of the requisite controls.

7.3. The consequences of state entity negligence and non-compliance with state laws and policies may include loss of delegated authorities, negative audit findings, monetary penalties, and legal actions.

8. Auditing

SWRCB has the right to audit any activities related to the use of State information assets as written in the security banner presented before login.

9. Reporting

Violations of this policy must be reported to the Information Security Office.

10. Security Variance Process

If compliance is not feasible or is technically impossible, if existing policy currently in place already meets these requirements, or if deviation from this policy is necessary to support a business function, the respective manager must formally request a security variance as defined in the SWRCB Security Variance policy.

11. Authority

This policy complies with the State of California Government Code Section 11549.3.

12. State Administrative Manual (SAM) and Statewide Information Management Manual (SIMM) References

SAM References

5305.3 Information Security Roles and Responsibilities

5320.4 Personnel Security

ESRI Enterprise Agreement Event ID# 0000033425

4989.3 Agency Roles and Responsibilities

SIMM References

5360-B Remote Access Agreement

5300-A State-Defined Security Parameters for NIST SP 800-53 Controls

66B Social Media Standard

13. Definitions of Key Terms

Please refer to the SWRCB Information Technology Glossary for terms and definitions used in this policy.

Eileen Sobeck, Executive Director Water Boards

Date

Oct 17, 2022

ESRI Enterprise Agreement Event ID# 0000033425

Exhibit C- Information Security Policy https://cawaterboards.na1.adobesign.com/verifier?tx=CBJCHBCAABAAFFwYkUzYkbIbhi_sV46r5Ilm-iiEy3Pt

ACCEPTABLE USE POLICY Number: OPM-01

**********INFORMATION TECHNOLOGY USE ONLY**********

1. NIST SP 800-53 Reference

Family Control

Planning (PL) PL-04

Awareness and Training (AT) AT-01, AT-02, AT-03, AT-04

Media Protection (MP) MP-01

Personnel Security (PS) PS-01, PS-02, PS-06, PS-08

Access Control (AC) AC-20

2. Related Policies, Procedures and Standards

Reference Article

OPM-09 Access Control Policy

OPM-18 Personnel Security Policy

OPM-06 Security Variance Policy

3. Revision History

Date Description of Change Reviewer

6/17/2019 Final

SWRCB

Information Security Office

2/20/2020 Integrated topics: security banner and social media

6/10/2021 Annual review

8/3/2022 Annual review

SAM References

5305.3 Information Security Roles and Responsibilities

5320.4 Personnel Security

4989.3 Agency Roles and Responsibilities

NIST CSF Function NIST Category

Identify ID.AM-6, ID.RA

ESRI Enterprise Agreement Event ID# 0000033425

OPM-02

SUBJECT:

INFORMATION SECURITY- IDENTIFICATION AND

AUTHENTICATION POLICY

EXPIRES:

UNTIL RESCINDED

ESRI Enterprise Agreement Event ID# 0000033425

IDENTIFICATION AND AUTHENTICATION POLICY Number: OPM-02

1. Identification and Authentication Policy

1.1. Introduction and Overview

Information assets owned by State Water Resources Control Board (SWRCB) are intended to be accessed by authorized entities and used exclusively for SWRCB’s business purposes. Consequently, it is imperative that all entities that request access to SWRCB’s information assets are uniquely identified prior to being granted access.

1.2. Objectives

The objective for this policy is to establish SWRCB’s requirements to control access to information assets by uniquely identifying the person or entity requesting access before access is granted.

2. Scope and Applicability

The scope of this policy extends to all State and Agency information assets owned and operated by SWRCB, information assets managed by third parties on behalf of SWRCB, and all information assets that process or store SWRCB information in support of SWRCB’s services and mission. This policy applies to all SWRCB and Regional Water Quality Control Boards (Water Boards) personnel and processes acting on behalf of Water Boards personnel. This policy governs physical and logical access. Logical access includes local access and network, including remote access.

3. Policy Directives

SWRCB will ensure that a SWRCB Identity and Access Management (IAM) strategy is developed, clearly defined, documented, and implemented.

The SWRCB IAM strategy must include the following:

3.1. Requirements to meet all state and federal requirements.

3.2. The unique identification of all authorized personnel or processes acting on behalf of SWRCB that access SWRCB information assets prior to being granted access.

3.3. The use of appropriate credentials for the identification of non-State personnel.

3.4. Implement methods that enable non-repudiation of access requests to all information assets and protect related audit log data for a minimum of 6 months.

3.5. Implementation of a suitable IAM infrastructure supporting SWRCB’s requirements.

3.6. Implementation of safeguards to protect the confidentiality, integrity, and availability of the supporting IAM infrastructure.

3.7. Definition and implementation of authentication mechanisms based on the type and method of access and the inherent risks associated with each access use case.

3.8. Control and management of access by administrative and privileged users, including the ability to immediately revoke access when necessary.

3.9. Requirement to implement application level identification and authentication in addition to platform level access to provide additional security, as appropriate by owners of information assets.

3.10. Definition, documentation, and implementation of audit and security activity and event logging requirements for privileged use.

ESRI Enterprise Agreement Event ID# 0000033425

3.11. Identification, development and implementation of supporting identity and access management processes and procedures.

4. Roles and Responsibilities

Information Security Officer

4.1. The Information Security Officer (ISO) owns this policy and is responsible for ensuring that all users of SWRCB information assets are aware of this policy and acknowledge their individual responsibilities.

4.2. ISO is responsible for ensuring that this policy will be reviewed, updated accordingly, and approved by appropriate parties every three (3) years.

4.3. ISO is responsible for the annual auditing and assessment of compliance with this policy.

Water Boards Management

4.4. SWRCB Management shall be committed to ensuring compliance with this and other applicable organizational policies.

Water Boards Owners of Information Assets and/or Program Management

4.5. Owners of information assets will ensure that this policy is implemented and will review the policy’s implementation annually.

4.6. Owners of information assets will ensure that identification and authentication technologies and process controls commensurate with the sensitivity or criticality of the asset are implemented for assets under their purview.

Water Boards Information Asset Custodians

4.7. Information asset custodians will assist owners of information assets in selecting identification and authentication technologies and process controls commensurate with the sensitivity or criticality of the asset.

4.8. Information asset custodians will implement identification and authentication technologies and process controls as defined by owners of information assets.

4.9. Information asset custodians will maintain the identification and authentication infrastructure and supporting processes and procedures.

4.10. Information asset custodians will maintain identification and authentication records as defined by owners of information assets for a minimum of six (6) months, or as defined by SWRCB.

Water Boards Users

4.11. Users must report any incidents of possible misuse or violation of this policy to the ISO, designee, or appropriate security staff.

4.12. All Water Boards personnel are required to acknowledge they have read and understood this policy and applicable SWRCB information security and privacy policies.

5. Enforcement

ESRI Enterprise Agreement Event ID# 0000033425

5.1. Violation of the provisions described in this policy may result in possible corrective action or internal discipline as appropriate pursuant to Government Code Section 19572. Criminal or civil action may also be initiated in appropriate circumstances, including violation of State or Federal laws.

5.2. As set forth in Government Code section 11549.3, state entities shall comply with the information security and privacy policies, standards and procedures issued by the California Office of Information Security (OIS). In addition to compliance with the information security and privacy policies, standards, procedures, and filing requirements issued by OIS, state entities shall ensure compliance with all security and privacy laws, regulations, rules, and standards specific to and governing the administration of their programs. Program administrators shall work with their general counsel, Privacy Officer/Program Coordinator, and ISO to identify all security and privacy requirements applicable to their programs and ensure implementation of the requisite controls.

5.3. The consequences of state entity negligence and non-compliance with state laws and policies may include loss of delegated authorities, negative audit findings, monetary penalties, and legal actions.

6. Auditing

SWRCB has the right to audit any activities related to the use of State information assets.

7. Reporting

Violations of this policy must be reported to the Information Security Office.

8. Security Variance Process

If compliance is not feasible or is technically impossible, or if deviation from this policy is necessary to support a business function, the respective manager must formally request a security variation as defined in the SWRCB Security Variance policy.

9. Authority

This policy complies with the State of California Government Code Section 11549.3.

10. State Administrative Manual (SAM) and Statewide Information Management Manual (SIMM) Reference

SAM References

5335 Information Security Monitoring

5340 Information Security Incident Management

5360 Identity and Access Management

SIMM References

5300-A State-Defined Security Parameters for NIST SP 800-53 Controls

5340-A Incident Reporting and Response Instructions

5360-A Telework and Remote Access Security Standard

ESRI Enterprise Agreement Event ID# 0000033425

11. Definitions of Key Terms

Please refer to the SWRCB Information Technology Glossary for terms and definitions used in this policy.

Eileen Sobeck, Executive Director Water Boards

Date

Oct 17, 2022

ESRI Enterprise Agreement Event ID# 0000033425

Exhibit C- Information Security Policy

**********INFORMATION TECHNOLOGY USE ONLY**********

SAM References

5335 Information Security Monitoring

5340 Information Security Incident Management

5360 Identity and Access Management

NIST CSF Function NIST Category

Protect Protect/Access Control (PR.AC-1)

Protect Protective Technology (PR.PT-1, PR.PT.3, PR.PT-4)

Protect Protective Technology (PR.PT-1, PR.PT.3, PR.PT-4)

1. NIST SP 800-53 Reference

Family Control

Identification and Authentication (IA) IA-1, IA-2, IA-3, IA-4, IA-5, IA-6, IA-7, IA-8, IA-9, IA-10, IA-11, IA-12

Access Control (AC)

AC-1, AC-2, AC-3, AC-4, AC-5, AC-5, AC-7, AC-8, AC-9, AC-10, AC-11, AC-

12, AC-13, AC-14, AC-15, AC-16, AC-17, AC-18, AC-19, AC-20, AC-21, AC-

22, AC-23, AC-24, AC-25

Audit and Accountability (AU) AU-1, AU-2, AU-10, AU-11, AU-12, AU-13

2. Related Policies

Reference Article

OPM-09 Access Control

OPM-06 Security Variance Policy

3. Revision History

Date Description of Change Reviewer

6/17/2019 Final SWRCB Information Security Office

3/10/2020 Updates to minimum log retention period

8/3/2022 Remove RACI matrix, updated Enforcement section

ESRI Enterprise Agreement Event ID# 0000033425

OPM-03

SUBJECT:

INFORMATION SECURITY- ENDPOINT SECURITY POLICY

EXPIRES:

UNTIL RESCINDED

ESRI Enterprise Agreement Event ID# 0000033425

ENDPOINT SECURITY POLICY OPM-03

1. Endpoint Security Policy

1.1. Introduction and Overview

State Water Resources Control Board (SWRCB) information assets are often used to conduct business functions internally and with other state and non-state entities, persons, and devices on the internet. Devices used for such SWRCB business purposes comprise servers, network devices, and end user devices including mobile computers, tablets and smart devices that connect to networks. Smart devices are rapidly evolving to “things”i.

Collectively such devices are “endpoints” or “endpoint devices.” Some SWRCB information assets are more prone to loss or theft, due to their size, mobility, and/or location of use.

The ubiquitous nature of modern telecommunications networks now extends organizational network environment boundaries and corresponding information security risks to endpoint devices.

SWRCB needs to ensure that SWRCB endpoints are suitably protected to prevent unauthorized access to and the protection of data and information that may reside on the endpoints.

1.2. Objectives

Objectives for this policy are to define the requirements to protect SWRCB endpoints that may routinely interact with unknown or untrusted devices on the Internet, or that are more susceptible to loss or theft.

2. Scope and Applicability

The scope of this policy extends to all state and agency information assets owned or operated by SWRCB.

This policy applies to all SWRCB and Regional Water Quality Control Boards (Water Boards) personnel and to all personnel authorized to use SWRCB assets.

3. Policy Directives

SWRCB will:

3.1. Ensure that only SWRCB authorized endpoints are permitted to access or connect to

SWRCB resources.

3.2. Ensure that all SWRCB endpoints are identified, and endpoint asset inventories are documented and continually updated.

3.3. Ensure that risks to individual SWRCB endpoint device types and the data they access, process, and/or store are assessed.

3.4. Ensure that appropriate endpoint protection controls are selected to manage risks to each endpoint type.

3.5. Ensure endpoint security technical controls satisfy requirements listed in State Information Management Manual (SIMM) 5300-A State-Defined Security Parameters for NIST SP 800-53 Controls and SIMM 5335-A Endpoint Protection Standard.

i NIST Special Publication 800-183 – Networks of ‘Things’ (https://dx.doi.org/10.6028/NIST.SP.800-183)

ESRI Enterprise Agreement Event ID# 0000033425

3.6. Ensure that endpoint protection controls include people (asset users), processes and technology controls.

3.7. Ensure that endpoint protection controls are continuously monitored.

3.8. Ensure that endpoint protection controls are implemented, maintained, and reviewed at least annually.

4. Roles and Responsibilities

Water Boards Executive Director

4.1. The Executive Director owns this policy and is responsible for ensuring that all users of SWRCB information assets are aware of this policy and acknowledge their individual responsibilities.

4.2. The Executive Director is responsible for ensuring that this policy will be reviewed, updated accordingly, and approved by appropriate parties on an annual basis.

4.3. The Executive Director is responsible for the annual auditing and assessment of compliance with this policy.

Water Boards Owners of Information Assets and/or Program Management

4.4. Owners of information assets must ensure that endpoint protection controls are defined, documented, and implemented, and that implementation is reviewed annually.

4.5. Owners of information assets must ensure that endpoint protection technologies and controls are maintained and updated per vendor recommendations and align with SIMM 5300-A State-Defined Security Parameters for NIST SP 800-53 Controls and 5335-A Endpoint Protection Standards.

4.6. Owners of information assets must ensure endpoint protection controls commensurate with the sensitivity or criticality are implemented for assets under their purview.

Water Boards Information Asset Custodians

4.7. Asset custodians must advise owners of information assets of suitable endpoint protection options.

4.8. Asset custodians must implement endpoint protection controls as defined by owners of information assets.

4.9. Asset custodians must maintain and update endpoint protection technologies as recommended by vendors and as defined by owners of information assets.

4.10. Asset custodians must maintain records of endpoint protection controls and decisions as defined by owners of information assets.

Information Security Officer

4.11. The Information Security Officer (ISO) must assist owners of information assets and information asset custodians with the identification and selection of endpoint protection controls.

4.12. The ISO must ensure that endpoint protection controls meet SWRCB requirements for security and privacy.

ESRI Enterprise Agreement Event ID# 0000033425

Water Boards Users

4.13. All Water Boards users are required to read and acknowledge they have read and understood this policy and applicable SWRCB information security and privacy policies.

4.14. Each Water Boards user will be issued one computer (desktop PC or laptop/notebook) to conduct official Water Boards business. Any variance to this must be approved by the CIO or designee.

5. Enforcement

5.1. Violation of the provisions described in this policy may result in possible corrective action or internal discipline as appropriate pursuant to Government Code Section 19572. Criminal or civil action may also be initiated in appropriate circumstances, including violation of State or Federal laws.

5.2. As set forth in Government Code section 11549.3, SWRCB shall comply with the information security and privacy policies, standards and procedures issued by the California Office of Information Security (OIS). In addition to compliance with the information security and privacy policies, standards, procedures, and filing requirements issued by the OIS, SWRCB shall ensure compliance with all security and privacy laws, regulations, rules, and standards specific to and governing the administration of their programs. Program administrators shall work with their general counsel, ISO, and Privacy Program Officer/Coordinator to identify all security and privacy requirements applicable to their programs and ensure implementation of the requisite controls.

5.3. The consequences of state entity negligence and non-compliance with state laws and policies may include: Loss of delegated authorities, negative audit findings, monetary penalties, and legal actions.

6. Auditing

6.1. SWRCB has the right to audit any activities related to the use of State information assets.

7. Reporting

7.1. Violations of this policy must be reported to the Information Security Office.

8. Security Variance Process

If compliance is not feasible or is technically impossible, or if deviation from this policy is necessary to support a business function, the respective manager must formally request a security variation as defined in the SWRCB Security Variance policy.

9. Authority

This policy complies with the State of California Government Code Section 11549.3.

ESRI Enterprise Agreement Event ID# 0000033425

10. State Administrative Manual (SAM) and Statewide Information Management Manual (SIMM) Reference

11. Definitions of Key Terms

Please refer to the SWRCB Information Technology Glossary for terms and definitions used in this policy.

Eileen Sobeck, Executive Director Water Boards

Date

SAM References

5305.5 Information Asset Management

5335 Endpoint Defense

5335.1 Malicious Code Protection

SIMM References

5300-A State-Defined Security Parameters for NIST SP 800-53 Controls

5355-A Endpoint Protection Standard

Oct 17, 2022

ESRI Enterprise Agreement Event ID# 0000033425

Exhibit C- Information Security Policy

**********INFORMATION TECHNOLOGY USE ONLY**********

1. NIST SP 800-53 Reference

Family Control

Security Assessment and Authorization

CA-7

Configuration Management CM-2, CM-3, CM-6, CM-7, CM-10, CM-11

System and Communications Protection

SC-8, SC-10, SC-11, SC-13, SC-18, SC-23, SC-24, SC-28, SC-38, SC-42,

SC-43

System and Information Integrity SI-2, SI-3, SI-4, SI-5, SI-7, SI-8, SI-11

Program Management PM-9

Risk Assessment RA-2, RA-3, RA-5

Physical and SWRCB PE-3, PE-19, PE-20

2. Related Policies

Reference Article

OPM-01 Acceptable Use Policy

OPM-10 Change and Configuration Management

OPM-07 Security Analytics and Continuous Monitoring

OPM-06 Security Variance Policy

OPM-15 System and Communications Protection

3. Revision History

Date Description of Change Reviewer

6/17/2019 Final SWRCB Information Security Office

6/17/2020 Annual review and approval

SAM References

5305.5 Information Asset Management

5335 Endpoint Defense

5335.1 Malicious Code Protection

SIMM References

5300-A State-Defined Security Parameters for NIST SP 800-53 Controls

5355-A Endpoint Protection Standard

NIST CSF Function NIST Category

Protect PR.AC Access Control

Protect PR.AT Awareness and Training

Protect PR.DS Data Security

Protect PR.IP Information Protection Processes and Procedures

Protect PR.PT Protective Technology

Detect DE.CM Continuous Monitoring

ESRI Enterprise Agreement Event ID# 0000033425

6/17/2021 Annual review and approval

8/3/2022 Annual review and approval

ESRI Enterprise Agreement Event ID# 0000033425

OPM-08

SUBJECT:

INFORMATION SECURITY - SECURITY AND PRIVACY

AWARENESS POLICY

EXPIRES:

UNTIL RESCINDED

ESRI Enterprise Agreement Event ID# 0000033425

SECURITY AND PRIVACY AWARENESS POLICY OPM-08

1. Security and Privacy Awareness Training Policy

1.1. Introduction and Overview

A well-trained workforce, aware of information privacy and security risk, plays a crucial role in protecting organizations against a variety of information security threats. Consequently, a formal privacy and security awareness and training program is a key component of the State Water Resources Control Board’s (SWRCB) information security program.

1.2. Objectives

Objectives for this policy are to establish the requirement of a formal and effective SWRCB privacy and security awareness and training program for all SWRCB and Regional Water Quality Control Boards (Water Boards) personnel.

2. Scope and Applicability

The scope of this policy extends to all Water Boards personnel and governs all forms of access to SWRCB information assets.

This policy applies to all Water Boards personnel and to all personnel authorized to use SWRCB assets.

3. Policy Directives

SWRCB will:

3.1. Establish a formal SWRCB privacy and security awareness and training program, with clearly defined roles and responsibilities, designed to be delivered to all personnel with access to State information assets.

3.2. Provide privacy and security and awareness training to all personnel upon commencement of their employment with Water Boards, and on an annual basis thereafter.

3.3. Require role-based privacy and security awareness and training content is delivered commensurate with personnel roles and responsibilities. Retraining will be required if significant changes occur to curriculum or the job role.

3.4. Ensure effectiveness of the awareness program through a process of tracking and reporting metrics.

3.5. Maintain individual records of all security and privacy training undertaken annually by Water Boards personnel.

4. Roles and Responsibilities

Water Boards Executive Director

4.1. The Executive Director owns this policy and is responsible for ensuring that all users of SWRCB information assets are aware of this policy and acknowledge their individual responsibilities.

4.2. The Executive Director is responsible for ensuring that this policy will be reviewed, updated accordingly, and approved by appropriate parties on an annual basis.

ESRI Enterprise Agreement Event ID# 0000033425

4.3. The Executive Director is responsible for the periodic auditing and assessment of compliance with this policy and effectiveness of the program.

Information Security Officer (ISO)

4.4. The ISO must guide and monitor the development and implementation of the SWRCB’s security and awareness training program.

Water Boards Users

4.5. Users must participate in all required security and awareness training annually and are required to complete training within thirty (30) days of onboarding.

4.6. Users must complete all required role-based training if assigned based on job function included but not limited to personnel, finance, or information technology.

4.7. All Water Boards personnel are required to read and acknowledge they have read and understood this policy and applicable SWRCB information security and privacy policies.

Security and Privacy Awareness training records must be retained for 12 months at minimum.

5. Enforcement

5.1. Violation of the provisions described in this policy may result in possible corrective action or internal discipline as appropriate pursuant to Government Code Section 19572. Criminal or civil action may also be initiated in appropriate circumstances, including violation of State or Federal laws.

5.2. As set forth in Government Code section 11549.3, state entities shall comply with the information security and privacy policies, standards and procedures issued by the California Office of Information Security (OIS). In addition to compliance with the information security and privacy policies, standards, procedures, and filing requirements issued by OSI, state entities shall ensure compliance with all security and privacy laws, regulations, rules, and standards specific to and governing the administration of their programs. Program administrators shall work with their general counsel, Privacy Officer/Program Coordinator and ISO to identify all security and privacy requirements applicable to their programs and ensure implementation of the requisite controls.

5.3. The consequences of state entity negligence and non-compliance with state laws and policies may include: Loss of delegated authorities, negative audit findings, monetary penalties and legal actions.

6. Auditing

SWRCB has the right to audit any activities related to the use of State information assets.

7. Reporting

The ISO and/or the Training Coordinator will provide SWRCB program management with regular reports on personnel participation in, and the effectiveness of privacy and security and awareness training. Violations of this policy must be reported to the Information Security Office.

8. Security Variance Process

ESRI Enterprise Agreement Event ID# 0000033425

Page 23 of 4`

If compliance is not feasible or is technically impossible, if existing policy currently in place already meets these requirements, or if deviation from this policy is necessary to support a business function, the respective manager must formally request a security variance as defined in the SWRCB Security Variance policy.

9. Authority

This policy complies with California Government Code Section 11549.3.

10. State Administrative Manual (SAM) and Statewide Information Management Manual (SIMM) References

SAM References

5305.3 Information Security Roles and Responsibilities

5320 Training and Awareness for Security and Privacy

5320.1 Security and Privacy Awareness

5320.2 Security and Privacy Training

5320.3 Security and Privacy Training Records

5320.4 Personnel Security

SIMM Reference

SIMM 5300-A State-Defined Security Parameters for NIST SPS 800-53 Controls

11. Definitions of Key Terms

Please refer to the SWRCB Information Technology Glossary for terms and definitions used in this policy.

Eileen Sobeck, Executive Director Water Boards

Date

Oct 17, 2022

ESRI Enterprise Agreement Event ID# 0000033425

Exhibit C- Information Security Policy

**********INFORMATION TECHNOLOGY USE ONLY**********

SAM References

5305.3 Information Security Roles and Responsibilities

5320 Training and Awareness for Security and Privacy

5320.1 Security and Privacy Awareness

5320.2 Security and Privacy Training

5320.3 Security and Privacy Training Records

5320.4 Personnel Security

NIST CSF Function NIST Category

Identify Governance (ID.GV-2)

Protect Awareness and Training (PR.AT)

12. NIST SP 800-53 Reference

Family Control

Planning (PL) PL-4

Awareness and Training (AT) AT-1, AT-2, AT-3, AT-04

13. Related Policies, Procedures and Standards

Reference Article

OPM-01 Acceptable Use Policy

OPM-18 Personnel Security Policy

OPM-06 Security Variance Policy

14. Revision History

Date Description of Change Reviewer

6/17/2019 Final

SWRCB

Information Security Office

3/10/2020 Annual review

6/18/2021 Annual review

8/3/2022 Addition of role-based training, annual review

ESRI Enterprise Agreement Event ID# 0000033425

Information Security Policy

OPM-09

SUBJECT:

INFORMATION SECURITY – ACCESS CONTROL

POLICY

EXPIRES:

UNTIL RESCINDED

ESRI Enterprise Agreement Event ID# 0000033425

ACCESS CONTROL POLICY OPM-09

1. Access Control Policy

1.1. Introduction and Overview

Access can enable or restrict the ability to do something with a resource. Access control, then, is the selective restriction of these abilities and is comprised of both physical and logical access.

Information assets owned by the State Water Resources Control Board (SWRCB) are strategic assets intended for official business use and are entrusted to State personnel and business partners in the performance of their job-related duties.

1.2. Objectives

Objectives for this Access Control Policy are to:

1.2.1. Enable the development and implementation of a SWRCB identity and access management strategy that comprehensively addresses all access to SWRCB information assets;

1.2.2. Document requirements for the appropriate control and management of physical and logical access to, and the use of, SWRCB information assets;

1.2.3. Require the use of appropriate authentication methods based on the type and sensitivity of information assets being accessed; and,

1.2.4. Govern the use of privileged access rights, such as those assigned to Administrator and Privileged Accounts.

2. Scope and Applicability

This policy applies to all personnel; all information assets owned or operated by SWRCB; and all forms of physical and logical access to SWRCB information assets, including using wired, wireless, and remote access network connections. All SWRCB and Regional Water Quality Control Boards (Water Boards) personnel must comply with this policy.

3. Policy Directives

3.1. Access to SWRCB IT infrastructure network must uniquely identify and positively authenticate users prior to providing network access.

3.2. Access to all information systems with information classified as non-public must uniquely identify and positively authenticate users prior to providing access to use SWRCB owned or operated information assets and associated facilities.

3.3. Access to SWRCB information assets and associated permissions must be approved by the respective Water Boards information asset owner or Water Boards official.

3.4. Connectivity to SWRCB cloud-based services will require Multi-Factor Authentication (MFA) using a hard token or authenticator application. Text messages and phone calls are prohibited authentication methods for MFA.

3.5. Records of all user account creations, deletions and changes to user access and permissions must be maintained for a period of 12 months at minimum.

SWRCB must:

3.6. Develop a comprehensive identity and access management strategy based on statutory and organizational business requirements, including:

ESRI Enterprise Agreement Event ID# 0000033425

3.7. Supporting unique identification, individual user types and groups, job roles and/or access methods;

3.8. Limiting access to information assets and associated facilities to authorized users, processes, or devices, and to authorized activities and transactions;

3.9. Defining roles and assigning responsibilities pertaining to access control tools, technologies and processes;

3.10. Developing and implementing standards, technologies and processes to support its access control strategy;

3.11. Formally defining and documenting user account types and groups, and access use cases, commensurate with employment responsibilities; and,

3.12. Employing multi-factor authentication for remote access, and risk-based user authentication methods to accommodate approved logical access use cases.

3.13. Publicly available or published access and authentication credentials, such as default credentials, anonymous credentials and guest credentials, must not re-used, and must be replaced as a matter of standard procedure.

3.14. Ensure that access to non-active personnel is deactivated prior to or immediately after termination, as appropriate;

3.15. Review and validate user access and associated access permissions and privileges every 12 months.

Administrator and Privileged Accounts

Certain Water Boards information technology support personnel and network administrators will require specific privileges to perform their duties.

For all Administrators and/or Privileged Account holders, SWRCB must:

3.16. Identify and document all Administrator and Privileged Account holders.

3.17. Ensure that such users acknowledge the privileges and only use those accounts to fulfil the specific job responsibilities for which the privileges apply.

3.18. Automated processes with access to information systems will follow the same standards for password rotation, limited access and auditing as named user accounts.

3.19. Review and validate the continued business need for all Administrator and Privileged Accounts on an annual basis, or when staffing, resource, or job function changes occur.

User Permissions

3.20. User access and permissions must be based on the principles of least privilege and separation of duties.

Audit Records

3.21. SWRCB must define and document all auditable system events related to data and information access that must be recorded.

3.22. SWRCB must ensure access control management systems are configured to capture and record audit and security information related to access events.

3.23. Audit and security records must be securely stored and protected against tampering;

audit and security records will be maintained for a period of 12 months.

ESRI Enterprise Agreement Event ID# 0000033425

Monitoring and Alerting

Monitoring and alerting of anomalous or suspicious activities and events is most effectively accomplished through automated and real-time reviews of audit and security logs.

3.24. SWRCB will implement suitable controls to monitor for unauthorized changes to user access. Where feasible, unauthorized changes should generate automated alerts to notify responsible SWRCB individuals.

3.25. In the absence of automated monitoring and alerting, the Information Security Officer (ISO) must review access records on a quarterly basis. Access records include: new user account creation requests, user access revocation requests, active user lists, and user termination lists.

4. Roles and Responsibilities

Water Boards Executive Director

4.1. The Water Boards Executive Director owns this policy and is responsible for ensuring that all users of SWRCB Information Assets are aware of this policy and acknowledge their individual responsibilities.

4.2. The Water Boards Executive Director is responsible for ensuring that this policy will be reviewed, updated accordingly, and approved by appropriate parties every two (2) years.

4.3. The Water Boards Executive Director is responsible for the periodic auditing and assessment of compliance with this policy.

Water Boards Owners of Information Assets and/or Program Management

4.4. Owners of information assets must ensure that this policy is implemented and implementation is reviewed at minimum annually.

4.5. Information System Owners must periodically review accounts with elevated privileges and verify that continued privilege account access is required.

4.6. Owners of information assets must ensure access technology and process controls are commensurate with the sensitivity or criticality of information assets under their purview.

4.7. Owners of information assets must audit and assess user access rights and privileges to ensure alignment with individual job roles and functions on an annual basis.

Water Boards Information Asset Custodians

4.8. Asset custodians must implement access technology and process controls as approved by owners of information assets.

4.9. Asset custodians must implement user access and associated rights and privileges as requested and approved by owners of information assets.

4.10. Asset custodians must revoke or modify individual user access rights and privileges upon notification from the owners of information assets.

4.11. Asset custodians must maintain access records as defined by owners of information assets.

Water Boards Users

ESRI Enterprise Agreement Event ID# 0000033425

4.12. Users must report any incidents of possible misuse or violation of this policy to the SWRCB ISO, designee or appropriate security staff.

4.13. All Water Boards personnel are required to read and acknowledge they have read and understood this policy and applicable SWRCB information security and privacy policies.

5. Enforcement

5.1. Violation of the provisions described in this policy may result in possible corrective action or internal discipline as appropriate pursuant to Government Code Section 19572.

Criminal or civil action may also be initiated in appropriate circumstances, including violation of State or Federal laws.

5.2. As set forth in Government Code section 11549.3, state entities shall comply with the information security and privacy policies, standards and procedures issued by the California Office of Information Security (OIS). In addition to compliance with the information security and privacy policies, standards, procedures, and filing requirements issued by OIS, state entities shall ensure compliance with all security and privacy laws, regulations, rules, and standards specific to and governing the administration of their programs. Program administrators shall work with their general counsel, Privacy Officer/Program Coordinator and ISO to identify all security and privacy requirements applicable to their programs and ensure implementation of the requisite controls.

5.3. The consequences of state entity negligence and non-compliance with state laws and policies may include: Loss of delegated authorities, negative audit findings, monetary penalties and legal actions.

6. Auditing

SWRCB has the right to audit any activities related to the use of State information assets.

7. Reporting

Violations of this policy must be reported to the Information Security Office.

8. Security Variance Process

If compliance is not feasible or is technically impossible, if existing policy currently in place already meets these requirements, or if deviation from this policy is necessary to support a business function, the respective manager must formally request a security variation as defined in the SWRCB Security Variance policy.

9. Authority

This Access Control Policy complies with California Government Code Section 11549.3.

10. State Administrative Manual (SAM) and State Information Management Manual (SIMM) Reference

SAM References

5305.4 Personnel Management

5305.7 Risk Assessment

5315 Information Security Integration

5335 Information Security Monitoring

5335.1 Continuous Monitoring

ESRI Enterprise Agreement Event ID# 0000033425

SAM References

5335.2 Auditable Events

5355 Endpoint Defense

5355.1 Malicious Code Protection

5360 Identity and Access Management

5360.1 Remote Access

5360.2 Wireless Access

5365.1 Access Control for Output Devices

SIMM Reference

5300-A State-Defined Security Parameters for NIST SP 800-53 Controls

5305-A Information Security Management Program Standard

11. Definitions of Key Terms

Please refer to the SWRCB Information Technology Glossary for terms and definitions used in this policy.

Eileen Sobeck, Executive Director Water Boards

Date

Oct 17, 2022

ESRI Enterprise Agreement Event ID# 0000033425

Exhibit C- Information Security Policy

**********INFORMATION TECHNOLOGY USE ONLY**********

SAM References

5305.4 Personnel Management

5305.7 Risk Assessment

5315 Information Security Integration

5335 Information Security Monitoring

5335.1 Continuous Monitoring

5335.2 Auditable Events

5355 Endpoint Defense

5355.1 Malicious Code Protection

5360 Identity and Access Management

5360.1 Remote Access

5360.2 Wireless Access

5365.1 Access Control for Output Devices

NIST CSF Function NIST Category

Protect Access Control (PR.AC)

Protect Awareness Training (PR.AT)

Protect Protective Technology (PR.PT)

Protect Information Protection Process and Procedures (PR.IP)

Detect Anomalies & Events (DE.AE)

Detect Detection Processes (DE.DP)

1. Roles and Responsibilities – RACI Matrix

The responsibility assignment matrix below describes the participation of the various roles and responsibilities in managing and adhering to this policy.

2. NIST SP 800-53 Reference

3.…