Information Technology Security Policy - BIT (002).pdf

Information Technology

Security Policy BIT Version 17.0

March 2024

Page | 2

Information Technology Security Policy

BIT

NOT FOR PUBLIC DISTRIBUTION 03/2024

General-Information Technology Security Policy-Introduction

1.1.4.1. General

1.1.4.2. Chief Information Security Officer

1.1.4.3. Security Infrastructure Team (SIT)

1.1.4.4. Security Operations Team (SOT)

1.1.4.5. BIT Executive Working Group on Cyber Security

General-Procedural-Electronic Monitoring

5.1.4.1. Privacy

5.1.4.2. Consent

General-Procedural-Remote Access - Hourly Employees

5.3.4.1. Legal and Regulatory Requirements for Hourly Employees

Administrative-I/T Asset Protection-Background Checks

10.1.4.1. Background Checks

10.1.4.2. Disqualifying Criteria

10.1.4.3. Noncriminal Agency Coordinator (NAC)

10.1.4.4. Local Agency Security Officer (LASO)

10.1.4.5. Background Check Interpretation

10.1.4.6. Not Guilty Presumption

10.1.4.7. Background Check Information Challenge

10.1.4.8. Corrective Action

10.1.4.9. Training

10.1.4.10. Emailing Background Check Information

Administrative-I/T Asset Protection-Confidentiality

10.3.4.1. Confidentiality Agreement

10.3.4.2. Security Acknowledgement and Access

Administrative-I/T Asset Protection-Security Awareness

10.5.4.1. Program

10.5.4.2. Education and Training

10.5.4.3. Assessment

Administrative-I/T Asset Protection-Risk Management

10.7.4.1. Risk Management Policy

10.7.4.2. Implement and Assess Security Controls, Application or System Connections

10.7.4.3. Security Categorization and Select Security Controls

10.7.4.4. Plan of Action and Milestones, Security Authorization, Monitor Security State Plan of Action and Milestones

10.7.4.5. Risk Assessment Process

Page | 3

BIT

NOT FOR PUBLIC DISTRIBUTION 03/2024

10.7.4.6. System Characterization, Threat Identification, Vulnerability Identification, Control Analysis, Likelihood Determination

10.7.4.7. Impact Analysis, Risk Determination

10.7.4.8. Availability, Protection Profile, Control Recommendations, Results Documentation

Administrative-I/T Asset Protection-Information Technology Audit

10.9.4.1. Information Technology Audit Policy

10.9.4.2. Information Technology Audit Procedures

10.9.4.3. Using Independent Assessors

10.9.4.4. Software Audits

10.9.4.5. Audit Contractual Clauses

10.9.4.6. Verification

Administrative-I/T Asset Protection-Governance of Regulated Data within Information Systems

10.11.4.1. Acquisitions

10.11.4.2. Contracts with Third Parties

10.11.4.3. Third Party Management Requirements (HIPAA, IRS) - DSS

Administrative-I/T Asset Protection-Requests for Technology Information

10.13.4.1. Requests for Technical Details

10.13.4.2. Discovery and Inventorying of Technical Assets

10.13.4.3. Surveys

Administrative-I/T Asset Protection-Reporting Cyber Security Incidents

10.15.4.1. Reporting Violations

10.15.4.2. Reporting Spam

10.15.4.3. Reporting Violations to the Social Security Administration

Administrative-I/T Asset Protection-Preventing and Responding to Cyber Security Incidents

10.17.4.1. Technology Safeguards

Communication-Media-Social Media

15.1.4.1. Use

15.1.4.2. Security

Mainframe-Mainframe Security-Overview

210.1.4.1. Security of Mainframe Resources

210.1.4.2. Mainframe Access Granted by Business Need

210.1.4.3. Requesting Mainframe System Access

210.1.4.4. Mainframe Resource Examples

Mainframe-Mainframe Security-Mainframe Accounts

210.3.4.1. Unique Account Requirement

210.3.4.2. Requests for Mainframe User IDs

210.3.4.3. Responsibility for Mainframe User IDs and Passwords

210.3.4.4. Department Security Officers

Page | 4

BIT

NOT FOR PUBLIC DISTRIBUTION 03/2024

Mainframe-Mainframe Security-Mainframe Accounts

210.4.4.1. Mainframe User ID Revocation

Mainframe-Mainframe Security-Logs of Security Violations

210.5.4.1. Logging of Mainframe Security Violations

210.5.4.2. Review of Security Violation Reports

210.5.4.3. Requesting Audits

210.5.4.4. Audit Trail Maintenance

210.5.4.5. Audit Policy Review

Mainframe-Mainframe Security-Classification Objectives

210.13.4.1. Classification Objectives

Mainframe-Mainframe Security-Disposition of Mainframe Disk Media, Printed Output, and Documentation

210.20.4.1. Agency Defined Access to Output

210.20.4.2. Mainframe Documentation

210.20.4.3. Disclosure of Information

210.20.4.4. Sanitization of Electronic Media

Mainframe-Mainframe Security-Mainframe Access

210.25.4.1. Mainframe Access

Mainframe-Mainframe Security-Management Security Controls

210.33.4.1. List of Secure Settings

210.33.4.2. Quarterly Security Verification

210.33.4.3. Yearly Review of Security Settings

Mainframe-Mainframe Security-NATURAL Security Guidelines

210.38.4.1. ADABAS Passwords

210.38.4.2. NATURAL Security Guidelines

210.38.4.3. Testing ADABAS Applications

210.38.4.4. Embedding ADABAS Passwords

Mainframe-Mainframe Security-Operation of Equipment

210.42.4.1. Operation of Equipment

Server-Server Security-Server Maintenance and Administration

220.1.4.1. Scope of Server Platforms

220.1.4.2. Web Server Administration

220.1.4.3. Visibility of Server and Framework Patching Status

220.1.4.4. Use of Java and Oracle Products

Server-Server Security-File Transfer Protocol

220.7.4.1. Use of File Transfer Protocol Server

Server-Server Security-Assurance HIPAA Regulations are Met

220.10.4.1. The Data User is Responsible for Adhering to HIPAA Regulations

Page | 5

BIT

NOT FOR PUBLIC DISTRIBUTION 03/2024

Server-Server Security-Technical Asset Connections

220.11.4.1. Requirements for State Connected Devices

220.11.4.2. Exemptions

Network-Service-Domain Naming System

220.13.4.1. South Dakota Agency Website Naming

220.13.4.2. Registering a Domain

Server-Server Backups-Server Backups

220.14.4.1. ADABAS, Oracle, and MS SQL Backups

Server-Server Security-Security Baseline Control

220.15.4.1. Security Configurations Settings

220.15.4.2. System Security Baseline

220.15.4.3. Baseline Configurations of Non-Production Systems

Data Center General-Data Center Security-Windows Backups

230.1.4.1. Data Center Objectives

230.1.4.2. Backup Methodologies

230.1.4.3. Backup Timing and Retention

Data Center General-Data Center Security-pSeries Backups

230.2.4.1. Backing up AIX Systems

Data Center General-Data Center Security-iSeries System

230.3.4.1. iSeries Backups

Data Center General-Data Center Security-Mainframe Backups

230.4.4.1. Mainframe Backups

Data Center General-Data Center Security-Data Restore

230.6.4.1. Data Restore

Data Center General-Data Center Security-Cloud Based Services and System Information

230.9.4.1. Responsibility for Cloud Based Services and Systems

Data Center General-Data Center Security-Federal Tax Information and Federal Parent Locator Service Information

230.11.4.1. Federal Tax Information Returns and Return Information

230.11.4.2. What is Not Federal Tax Information

230.11.4.3. Safeguarding Federal Tax Information

230.11.4.4. Remote Access of Federal Tax Information

230.11.4.5. Storing of Federal Tax Information

230.11.4.6. Emailing Federal Tax Information

Data Center General-Data Center Security-Metadata on the Internet and Intranet

230.17.4.1. Metadata on the Internet and Intranet

Data Center General-Data Center Security-Federal Parent Locator Service

230.18.4.1. Safeguarding the Federal Parent Locator Service

Page | 6

BIT

NOT FOR PUBLIC DISTRIBUTION 03/2024

Data Center General-Data Center Security-Email

230.36.4.1. Use of Secure Facilities

230.36.4.2. Use of “[EXT]” Email Subject Prefix

230.36.4.3. Use of “@state.sd.us” Domain Name

230.36.4.4. Use of Generic Email Accounts

230.36.4.5. Email Signatures

230.36.4.6. Out of Office Replies

230.36.4.7. Email Termination

230.36.4.8. Email Retention

Data Center General-Data Center Security-eDiscovery

230.38.4.1. Use of .pst Files is Prohibited

Data Center General-I/T Asset Protection-Logon Screen Requirements

230.49.4.1. Accessing Confidential Information

Network-Hardware-Remote Access Device (RAD)

230.50.4.1. Request RAD Connectivity to the State

230.50.4.2. State Wireless Connectivity

230.50.4.3. Employee Use Agreement

230.50.4.4. eDiscovery and Use of RAD

230.50.4.5. Minimum Security Standards

230.50.4.6. Loss or theft of the RAD

230.50.4.7. Additional Considerations

230.50.4.8. Updating RAD

230.50.4.9. Banned Phones

General-Confidential Data-Mobile Devices

230.51.4.1. Confidential or Sensitive Data Storage

Data Center General-Technical Asset Connections-Domain

230.52.4.1. Protection of External Devices

Data Center General-Operational-Change Control Process

230.53.4.1. Data Center System and Operations Change Management

230.53.4.2. Posting of Weekly Maintenance Schedules

230.53.4.3. Distributed System Emergency Changes

Data Center General-Procedural-Mainframe Access and Authorization Restrictions

230.55.4.1. User Access Authorization

Data Center General-Procedural-Access to Non-Public Output

230.56.4.1. Output Distribution Controls

Data Center General-Procedural-Physical Access - Proximity Cards

230.58.4.1. Access Control and Accountability

230.58.4.2. Proximity Card Loss, Changes and Termination

Page | 7

BIT

NOT FOR PUBLIC DISTRIBUTION 03/2024

230.58.4.3. Proximity Card for Non-BIT Employee Access

230.58.4.4. Identification Badge

230.58.4.5. Physical Access to BIT Offices

Data Center General-Procedural-Physical Access - Hardware Security

230.59.4.1. Theft Protection

Data Center General-Procedural-Physical Access - Facility Construction

230.61.4.1. Construction or Remodeling

Data Center General-Procedural-Physical Access - Equipment Inventory

230.62.4.1. Inventory of Equipment

Data Center General-Procedural-Physical Access - Room Security

230.64.4.1. Rooms and Cabinets to Protect Equipment

Data Center General-Accountability-Administrative Access to Servers

230.65.4.1. Administrative Capabilities on Servers

Data Center General-I/T Asset Protection-Business Continuity

230.66.4.1. Business Continuity Policy

Data Center General-Data Center Security-Accounts Access Control and Authorization

230.67.4.1. Individual Access Authorization

230.67.4.2. Administrative Capabilities

230.67.4.3. User Privilege Capabilities

230.67.4.4. Least Privilege

230.67.4.5. Administrative Privileges

230.67.4.6. Password Requirements

230.67.4.7. Agency Specific Policy DHS, DOR, DSS and DLR Lockout Threshold and Duration

230.67.4.8. Agency Specific Policy DHS, DOR, DSS and DLR Resets

230.67.4.9. Individual Access Termination

230.67.4.10. Granting of Domain Administrator Privileges

230.67.4.11. Non-Expiring Passwords

230.67.4.12. Non-State Accounts

Data Center General-Criminal Justice Information-Restrictions on the Use of Criminal Justice Information

230.68.4.1. Emailing Criminal Justice Information System Data

230.68.4.2. Storing Criminal Justice Information System Data

230.68.4.3. Disposal of Criminal Justice Information System Data

230.68.4.4. Outsourcing or Contracting Criminal History Records Information Operations

230.68.4.5. Criminal History Record Information Training

230.68.4.6. Criminal Justice Information System Configuration Management

230.68.4.7. Compliance with Criminal History Record Information Requirements

230.68.4.8. Maintenance, Retention and Disposal of Criminal History Record Information

Page | 8

BIT

NOT FOR PUBLIC DISTRIBUTION 03/2024

230.68.4.9. Criminal Justice Information System User Rules of Behavior

230.68.4.10. Requesting and Disseminating Criminal History Record Information

230.68.4.11. Physical Security of Criminal History Record Information

230.68.4.12. Criminal Justice Information System Background Checks

Data Center General-Storage Area Network Security-Storage Area Network Audit Logs

230.69.4.1. Review of Storage Area Network Audit Logs

Data Center General-Access to Data Center-Remote Access to the Data Center

230.70.4.1. Authentication for Remote Access to the Data Center

Data Center General-Nonstandard Technology-Nonstandard Technology Requirements

230.71.4.1. Change Management for Nonstandard Technology

230.71.4.2. Nonstandard Technology Disaster Recovery

Data Center General-Payment Card Industry Data Security-Payment Card Industry Data Security Standard

230.72.4.1. Payment Card Industry Data Security Standard Requirements

230.72.4.2. Payment Card Industry Data Storage Requirement

Data Center General-Secure Information Technology Acquisition Policy-Secure Information Technology Acquisition Policy

230.73.4.1. Requests for Proposals

230.73.4.2. Contracts

230.73.4.3. Acquisition of Freeware, Open Source and Product Testing Software

230.73.4.4. Leases

230.73.4.5. Acquisition of Internet of Things Devices

230.73.4.6. Acquisition of Services Involving HIPAA Data

230.73.4.7. Security Scanning Requirements

230.73.4.8. Software Maintenance Agreements

230.73.4.9. Hardware Maintenance Agreements

230.73.4.10. Banned Hardware, Software, and Services

Data Center General-Use of Production Data-Use of Production Data in a Non-Production Environment 118

230.74.4.1. Use of Production Data in a Non-Production Environment

230.74.4.2. Purging of Data

230.74.4.3. Compliance

Data Center General-Security Impacts-Data Classification

230.75.4.1. Data Classification System

230.75.4.2. Classification of Data Produced under Contract

230.75.4.3. Data Classification Responsibilities

Data Center General-Remote Access to State Information System-Multi-Factor Authentication

230.76.4.1. Usage of Multi-Factor Authentication (MFA)

230.76.4.2. MFA Tokens

Page | 9

BIT

NOT FOR PUBLIC DISTRIBUTION 03/2024

Data Center General-Approved Disposal of State Data-Media Sanitization

230.77.4.1. Sanitization of Media in a Contractor's Control

Data Center General-Transfer of Data-Secure Transfer of Data

230.78.4.1. Use of Secure File Transfer Protocol

Data Center General-Network Maintenance-Controlled Maintenance

230.79.4.1. Required Maintenance

230.79.4.2. Monitoring Maintenance

230.79.4.3. Removal of Information Systems or System Components

230.79.4.4. Sanitization of Information System Components

230.79.4.5. Check of Security Controls

230.79.4.6. Approval of Maintenance Tools

230.79.4.7. Non-Local Maintenance

230.79.4.8. Approval of Maintenance Personnel

Development-Application Security-Federal Tax Information

401.1.4.1. Allocation of Resources and Life Cycle Support

401.1.4.2. Information System Security Documentation

401.1.4.3. Software Usage Restrictions and User Installed Software

401.1.4.4. Developer Configuration Management

Development-Application Security-Security Assessments

401.3.4.1. Security Assessments

401.3.4.2. APM Assessment of Risk

401.3.4.3. Security Assessment Report

401.3.4.4. Annual Review

Development-Application Security-Data Encryption

401.5.4.1. Data Encryption

401.5.4.2. Hashing Values

401.5.4.3. Tools

401.5.4.4. Compliance Measurements

401.5.4.5. Exceptions

401.5.4.6. Non-Compliance

Development-Application Security-Authentication and Authorization

401.7.4.1. User Authentication and Authorization

401.7.4.2. Password Requirements

401.7.4.3. Invalid Login Attempts for projects using Federal Tax Information

401.7.4.4. reCAPTCHA

401.7.4.5. Public Key Infrastructure Certificates

401.7.4.6. Tools

401.7.4.7. Compliance Measurements

Page | 10

BIT

NOT FOR PUBLIC DISTRIBUTION 03/2024

401.7.4.8. Exceptions

401.7.4.9. Non-Compliance

Development-Application Security-Software Development Life Cycle

401.9.4.1. Software Development Life Cycle

401.9.4.2. Change Management

Development-Tools-Azure DevOps Server

410.1.4.1. Agency use of ADOS

LAN Services-Hardware-Workstation Access

605.1.4.1. Identity Verification-User ID

605.1.4.2. Identity Verification-Physical ID

605.1.4.3. Lock the Device

605.1.4.4. Unattended

605.1.4.5. Authorized Users

LAN Services-Software-Hardware

605.3.4.10. Non-State Hardware and Software

605.3.4.11. Unauthorized Software

LAN Services-Operational-Change Control Process

605.5.4.1. BIT Service Requests

Network-Service-Access Control

610.1.4.1. System Access Expectations

610.1.4.2. Contractor Access

610.1.4.3. Modems

610.1.4.4. Remote Access

610.1.4.5. Inspection and Review

610.1.4.6. Department of Social Services

Network-Concept-Security Domain Zones

610.3.4.1. Intranet

610.3.4.2. DMZ

610.3.4.3. Extranet

Network-Concept-Administering Networks and Network Security Devices

610.4.4.1. Authentication

610.4.4.2. IP Address Management

Network-Infrastructure-Wireless

610.5.4.1. Roles and Responsibilities

610.5.4.2. Client Access Requirements

610.5.4.3. DDN Intranet Wireless Infrastructure Requirements

610.5.4.4. State Business Wireless Access

610.5.4.5. Public Access

Page | 11

BIT

NOT FOR PUBLIC DISTRIBUTION 03/2024

610.5.4.6. Physical Security

610.5.4.7. Interfering Devices

Network-Travel-International

610.7.4.1. Preparedness - State Employee Travel

610.7.4.2. Practice: Safe Practices to Follow While Traveling Abroad

610.7.4.3. Returning Home

Network-Concept-Network Integrity

610.9.4.1. Responsibilities

610.9.4.2. Management

610.9.4.3. Disabling Critical Components of Network Security Infrastructure

610.9.4.4. Technical Asset or Contractor Connections

610.9.4.5. Local Area Network

610.9.4.6. Wide Area Network

610.9.4.7. Physical Controls

Network-Communication-Internet

610.11.4.1. Multiple Connections

610.11.4.2. Interfaces

610.11.4.3. Security

610.11.4.4. Responsibilities

610.11.4.5. IPv4/IPv6 and Device Names

Engineering-Communication-Voice Over IP

615.1.4.1. Expectations

615.1.4.2. Technical Requirements

615.1.4.3. Privileged Information Communications Over VOIP

Security-Network Discovery-Probing-Exploiting

620.1.4.1. Limiting Tool Functionality

620.1.4.2. Exploiting Security Controls of Information Systems

620.1.4.3. Cracking Application or Passwords

620.1.4.4. Exemptions

Security-Content Control-Internet Filtering

620.5.4.1. Exemptions

620.5.4.2. Appropriate Use of Administrator Access

620.5.4.3. DDN Content Filtering

620.5.4.4. DDN Intranet Content Filtering

620.5.4.5. Filter Exemption Requests

Security-I/T Asset Protection-Vulnerability Assessment

620.7.4.1. Requirements

620.7.4.2. Expectations

Page | 12

BIT

NOT FOR PUBLIC DISTRIBUTION 03/2024

620.7.4.3. Data Hosted Offsite

620.7.4.4. Department of Social Services

620.7.4.5. Wireless Infrastructure Scanning

620.7.4.6. Assessment and Compliance

Page | 13

BIT

NOT FOR PUBLIC DISTRIBUTION 03/2024

ITSP Change Log

Policy Number Policy Title New Revised Deleted

230.36 Email Retention 05/15/2020

1.1.4.2 Chief Information Security Officer 03/01/2020

5.3 Hourly Employees 03/01/2020

10.1 Background Checks 03/01/2020

10.5 Security Awareness 03/01/2020

10.11 Governance of Regulated Data within Information

Systems

15.1 Social Media 03/01/2020

220.15 Security Baseline Control 03/01/2020

220.1.4.3 Use of Java and Oracle Products 03/01/2020

230.10.4.1 Hardware Maintenance Agreements 03/01/2020

230.11 Federal Tax Information and Federal Parent Locator

Service Information

03/01/2020

230.50.4.1 Request RAD Connectivity to the State 03/01/2020

230.50.4.2 State Wireless Connectivity 03/01/2020

230.50.4.3 Employee Use Agreement 03/01/2020

230.50.4.7 Additional Considerations 03/01/2020

230.50.4.8 Updating RAD 03/01/2020

230.50.4.9 Banned Phones 03/01/2020

230.53.4.2 Distributed System Change Management 03/01/2020

230.58.4.4 Identification Badge 03/01/2020

230.58.4.5 Physical Access to BIT Offices 03/01/2020

230.67.4.12 Non-State Accounts 03/01/2020

230.70.4.1 Authentication for Remote Access to the Data Center 03/01/2020

230.73.4.10 Banned Hardware 03/01/2020

230.76.4.1 Usage of Multi-Factor Authentication 03/01/2020

230.79 Controlled Maintenance 03/01/2020

401.1.4.4 Developer Configuration Management 03/01/2020

401.3.4.2 APM Assessment of Risk 03/01/2020

401.3.4.3 Security Assessment Report 03/01/2020

401.3.4.4 Annual Review 03/01/2020

401.9 Software Development Life Cycle 03/01/2020

410.1 Azure DevOps Server 03/01/2020

610.7 International Travel 03/01/2020

615.3 Privileged Information Communications Over VOIP 03/01/2020

ITSP Terms and Acronyms

Terms and Acronyms are now located on the BIT Intranet Policies page.

http://intranet.bit.sd.gov/policies/default.aspx

Page | 14

BIT

NOT FOR PUBLIC DISTRIBUTION 03/2024

General-Information Technology Security Policy-Introduction

1.1.1. Overview

This Information Technology (IT) Security Policy has been developed by the Bureau of Information & Telecommunications (BIT) of the State of South Dakota. The Information Technology Security Policy provides guidance regarding cyber security policies of the State relevant to the IT goals, beliefs, ethics, and responsibilities. Specific procedures that State employees and contractors must follow to comply with the security objectives are identified.

The objective of the Information Technology Security Policy is to provide a comprehensive set of cyber security policies detailing the acceptable practices for use of State of South Dakota IT resources. The security policies and procedures set forth are to accomplish the following:

• Assure proper implementation of security controls within the BIT environment.

• Assure government data is protected regardless of hosting location.

• Demonstrate commitment and support to the implementation of security measures by BIT and Executive management.

• Avoid litigation by documenting acceptable use of State IT resources.

• Achieve consistent and complete security across the diverse technology infrastructure of the State and hosted State data.

The Information Technology Security Policy, when combined with individual, specific security procedures, provides a comprehensive approach to security planning and execution to ensure that State managed assets are afforded appropriate levels of protection against destruction; loss; unauthorized access, change, or use; and disruption or denial of service.

BIT is responsible for maintaining and updating this policy. An updated version of the Information Technology Security Policy will be posted to the Intranet annually the first of March. The Commissioner of BIT or the Chief Information Security Officer can authorize an out of cycle or special edition to be released.

Information Technology Security is based on three principles:

• Confidentiality

• Integrity

• Availability

Confidentiality - ensuring that only permitted individuals are able to view information pertinent to apply defined responsibilities.

Integrity - the information is accurate because nothing has been changed or altered.

Availability - the technology infrastructure and services built upon that infrastructure are not intentionally disrupted and are available for use by the clientele in a dependable and reliable manner.

Each individual policy defined herein falls within one or more of these guiding principles.

Information Technology security requires on-going vigilance, and employees should understand the importance of cyber security in the protection of State data and technology resources along with the personal/home computing/data assets of every individual. Guardianship of State data, infrastructure, and applications is a critical

Page | 15

BIT

NOT FOR PUBLIC DISTRIBUTION 03/2024

priority for BIT. The effort is complicated by the balance needed between usability/service and meaningful protection.

BIT Mission Statement

The Bureau of Information and Telecommunications (BIT) strives to partner and collaborate with clients in support of their missions through innovative information technology consulting, systems, and solutions.

Vision Through our highly motivated staff - we will be a Leader and valued partner in providing technology solutions, services, and support that directly contribute to the success of our clients.

Goals:

Provide a Reliable, Secure and Modern Infrastructure.

Provide a well-designed and architected secure computing and communications environment to ensure optimal service delivery to business. Architecture and process will be optimized to support agile and reliable computing and communication services.

Technology assets must be high performing and dependable to ensure services are available whenever needed.

Centralization, standardization, and collaboration are vital to efficiently leverage investments. To maintain public trust, we must secure data and technology assets through leading security tools, policies, and practices.

Deliver Valuable Services at Economical Costs.

Develop innovative and cost-effective solutions through collaboration, cooperation, and in partnership with our clients. The solution sets include developing customized business solutions, efficient project management services, and productive relationships with clients.

Regarding our citizens interacting with their government: "People should be online, not waiting in line."

Build and Retain a Highly Skilled Workforce.

Improve the effectiveness, productivity, and satisfaction of employees in order to attract (and retain) a highly qualified workforce to foster individual innovation and professional growth. Appropriate training and tools will be provided to enhance and improve career skills in the workforce.

Information technology systems are critical, valuable assets. Policies relating to the valuable assets are important to ensure that all entities receive adequate information to enable the department, office, and agency to provide a basic level of protection to the technology systems.

Security is not accomplished at a single point or by a single individual! (Or in a single point in time!)

Instead of relying on one person or a firewall or anti-virus software or some other single piece of hardware or software, a series of assets and entities together build a safe computing environment. Technically, a layered approach is taken to accomplish security within the State which is called the Information Technology (IT) Security Model. A foundation is established; additional layers may build on the previous layer or may also act independently to provide separate security measures. Each point of accessibility into the wired and wireless network creates security concerns. Security is not limited to technology. A critical portion of cyber security is the human aspect.

Information Technology Security Model The different technology layers of the Information Technology Security Model create opportunities for implementing security:

Page | 16

BIT

NOT FOR PUBLIC DISTRIBUTION 03/2024

• User Education involves the training of employees to ensure that proper awareness is brought to the topic of security including steps to take when incidents occur that are outside of the scope of the daily work routine.

• Physical Access is taking appropriate steps to physically safeguard technical equipment such as outlining procedures to prevent workstations from being stolen which can include limiting access to a particular room or locking up the device in a cabinet.

• Network Access includes protecting the State Network from unauthorized access via internal methods and from outside our physical offices. Because technology can be manipulated by individuals or workstations to create a detrimental outcome, safeguards must be implemented to prevent, thwart, and repel workstation attacks from inside State Government and the Internet; access protection is not limited to workstations, it includes smartphones, Internet of Thing devices, environmental controls, and network -network connectivity.

• Workstation Platform means taking advantage of the inherent feature sets of workstation platforms. For example, user id and password capabilities must be used as intended within the workstation platform.

• Cyber Strength Evaluation of business software must apply across in-house developed and third party built or supplied software applications. New applications must be tested before being placed into service and existing applications must be re-evaluated on a regular basis.

• Cyber security language is incorporated within all information technology (I/T) requests for proposals and I/T contracts.

• Information System security entails designing the necessary security features and permissions to ensure that only legitimized staff have proper resource access. The design must consider areas such as viewers of departmental data to individuals that can add data or update records.

• Data security is the protection of the asset; often referred to as the "money in the vault". Insuring that data is only accessible by permitted applications and personnel is the core of the security model. The data could be credit card numbers, social security numbers, health records, or financial information.

Partners The IT Security model goal is to ensure that the hardware, software, and data technology assets of the State are protected in a reasonable and prudent manner. Planning, cooperation, and assistance from many different entities is required to meet the goal. The State has various partners in cyber security efforts. BIT must continue to evolve relationships with:

• State government of South Dakota branches, departments, and constitutional offices

• Internet Service Providers

• Multi-State Information And Sharing Center (MS ISAC)

• Department of Homeland Security

• State Fusion Center

• Federal Bureau of Investigation (FBI) - InfraGard program

• National Association of State Technology Directors (NASTD)

• National Association of Chief Information Officers (NASCIO)

• SysAdmin, Audit, Networking and Security (SANS)

• Microsoft, Inc.

• Symantec, Inc.

• US CERT

• A variety of hardware and software contractors.

All of these organizations contribute to the development of cyber security information sharing, policies, procedures, and metrics. In return, specific reporting is distributed amongst the partners.

Roles and Responsibilities In the application of information technology, BIT is responsible for providing leadership, policy, and technical support to all agencies of the Executive branch of the State of South Dakota. Also, various levels of support are

Page | 17

BIT

NOT FOR PUBLIC DISTRIBUTION 03/2024

provided to the Judicial branch, constitutional offices of government, K-12 education, and higher education. In addition to data center operations and related end user and customer support services, the broad statement of roles and responsibilities encompasses major information resource functions such as development, delivery, administration of voice, data, and video, applications - to include services, software, hardware selection, installation, and support.

Individual roles and responsibilities are defined herein; the following responsibilities are shared by all:

• Participate in information security awareness program activities.

• Read, understand, and follow the policies defined in the Information Technology Security Policy.

• Report all violations, security incidents, suspected, and/or attempted security incidents to BIT.

BIT Commissioner:

The Commissioner of the Bureau of Information & Telecommunications for the State of South Dakota is responsible for ensuring that:

• Reasonable security measures are taken to protect sensitive files and information.

• Enforceable security rules are created and disseminated.

• System resources are managed and monitored to ensure prudent and legitimate usage.

• Alleged security violations are addressed, and problems are investigated.

• Designated individuals are responsible for design, configuration, and support of technology resources.

Employees and Contractors are responsible for:

• Taking the time to read, understand, and ask questions if necessary, to clarify the policies defined herein.

• Fully adhering to these policies defined herein.

• Agreeing that use of State technologies which includes equipment, applications, and resources are for work-related purposes.

• Applying recommended password policies.

• Safeguarding sensitive information whether employee / contractor is in the office or traveling for the State.

• Reporting any unusual requests for information or obvious security incidents to the BIT Service Desk.

• Immediately reporting loss of any State technology devices or data.

• Understanding that everyone is a potential target of nefarious individuals seeking 'social engineering' information to be used for illegally accessing State of South Dakota systems and technologies; Hence, be aware that any information provided to outside entities can be dangerous.

• Protecting information technology assets by following policies and procedures.

• Ensuring each individual is authorized to use a given technical asset.

• Understanding and complying with the policies, procedures, and laws related to conditions of use authorizing access to BIT systems and data.

• Not subverting or attempting to subvert security measures.

Department, Office, Division, or Group Managers are responsible for:

• Creating, disseminating, and enforcing conditions of use for technology and applications in areas of responsibility.

• Responding to concerns regarding alleged or real violations of this policy.

• Ensuring that their employees understand security responsibilities.

• Monitoring the use of South Dakota technology resources by observing usage.

Page | 18

BIT

NOT FOR PUBLIC DISTRIBUTION 03/2024

• Determining the access requirements of staff, and ensuring completion of the appropriate forms, including all required authorizations for the application(s) requested by insuring only legitimate staff have access to the set of functions needed to perform defined tasks.

• Communicating terminations and status changes of individuals immediately to the Bureau of Human Resources (BHR) through BHR-defined procedures so that BIT is notified to ensure proper deletion or revision of user access is performed.

• Ensuring a secure physical environment for the staff use of State equipment, information systems, and data.

Bureau of Information & Telecommunications (BIT) is responsible for:

• Taking reasonable action to assure the authorized use and security of data, networks, applications, and communications amongst these technologies.

• Promptly responding to client questions on details relating to appropriate use of technical resources.

• Providing advice regarding the development of conditions of use or authorized use and procedures through work order requests.

• Ensuring that investigations into any alleged personal workstation or network security compromises, incidents, or problems are conducted.

• Ensuring that appropriate security controls are enabled and are being followed in coordination with BIT staff that are responsible for security administration.

• Verifying and authorizing individuals for an appropriate level of access to only the resources required to perform one's responsibilities.

• Overseeing that an individual has the necessary security authorizations in order for the person to perform assigned duties or tasks.

• Cooperating with appropriate departments, branches, agencies, and law enforcement officials in the course of investigation of alleged violations of policy or law.

• Overseeing the administration of BIT employee and contractor access to BIT facilities.

• Coordinating disaster recovery and testing exercises.

Data Owners

All data files, information, and applications belong to the State. Authorized users or agents of the data are the State of South Dakota departments, agencies, and offices. Files in central systems belong to the account owner. Data owners are responsible for:

• Tracking the data owned/managed by the agency and agency staff.

• Providing BIT notification within 24 hours of any notices regarding federal/state/or industry audits related to any aspects of an agency data, electronic communications, or data processing.

• Working with BIT to ensure access to the data and application(s) is limited to individuals with a legitimate need for the resource access.

• Ensuring that security measures and standards are implemented and enforced in a method consistent with BIT security policies and procedures.

• Establishing measures to ensure the integrity of the data and applications found within the owner's area of responsibility.

• Authorizing individual's appropriate security access rights for accessing the data and applications that are assigned to the data owner for administration.

• Periodically reviewing access rights to determine that the level is still appropriate for authorized users or the level needs to be changed.

• Assuring a process is in place to retain or purge information according to record retention schedules as set by the Records Management office of the Bureau of Administration or other entities.

Page | 19

BIT

NOT FOR PUBLIC DISTRIBUTION 03/2024

• Determining the sensitivity and criticality of the data and application based on established Federal, State, and organizational definitions.

Compliance with system security and integrity; noncompliance and enforcement; reservation of authority and rights is expected of all employees and contractors.

• All State and contractor personnel utilizing information technology resources shall cooperate fully with the cyber security policies of the State.

• The State reserves the right to take all necessary actions to prevent the State network and computing infrastructure from being used to attack, damage, harm, or improperly exploit any internal or external systems or networks.

• The State reserves the right to take all necessary actions to protect the integrity of the State network, the systems attached to the State network, and the data contained therein.

• Violations of federal, State regulations, or any laws respecting information technology will be considered serious matters that may warrant loss of applicable privileges, fines, or more serious action as necessary, to include but not limited, appropriate disciplinary action.

Individuals with questions concerning the policies described herein should be directed to either an immediate State supervisor or the BIT Service Desk for assignment to the most pertinent BIT Division.

Compliance and Enforcement:

All managers and supervisors are responsible for enforcing the Security Awareness policy.

Any disclosure of regulated data is subject to the Human Resource Polices of BHR.

1.1.2. Purpose

This Information Technology Security Policy contains information technology security policies to ensure that employees and contractors are familiar with the laws and regulations that govern use of IT systems and the data those systems contain.

1.1.3. Scope

The Information Technology Security Policy is intended to address the range of cyber security related topics. Detailed policies are listed and explained throughout the document. Security topics included are workstation, server, network, applications development, mobile, administrative, operational, and other IT areas.

The clientele served by BIT is very diverse. Including the Executive and Judicial branches of State government, local - municipal - county governments, K-12 schools, technical schools, and colleges and universities. Different policies will have a different set of impacted clienteles.

1.1.3.1. Scope Assumptions

The security policies listed within the Information Technology Security Policy apply to State employees and contractors working on or with State of South Dakota IT equipment, data, or services. All are expected to comply with BIT cyber security policies.

1.1.3.2. Scope Constraints

Page | 20

BIT

NOT FOR PUBLIC DISTRIBUTION 03/2024

Contractors are not given any special privileges or dispensations regarding policies listed herein. Contractors are expected to follow all policies designated as an employee would follow them. Third party hosting companies also have a set of policies applicable to them. This set of policies is normally a subset of the entire BIT catalog of policies.

1.1.4. Policy

1.1.4.1. General

The policy of BIT is that information is considered a valuable asset and must be appropriately evaluated and protected against all forms of unauthorized access, use, disclosure, modification, or destruction. Security controls must be sufficient to ensure the confidentiality, integrity, availability, and accountability of sensitive and critical information processed and stored on BIT resources and other hosting parties. In addition to implementing the necessary safeguards, each State department, office, and agency is required to determine that the proper levels of protection for the information for that entity exists to include information that is under the control of the department, office, or agency. The security controls that must be applied will be consistent with the classification or value of the information and associated processes that the security controls are designed to protect. Information that is considered by management to be sensitive, critical, or sensitive and critical requires more stringent controls.

1.1.4.2. Chief Information Security Officer

The Commissioner of BIT shall appoint a Chief Information Security Officer (CISO) to implement the information technology security program for the State. The CISO shall seek to assure that information technology is secure at the State and shall be responsible for the following duties:

• Enforcing the provisions of the Information Technology Security Policy.

• Providing for and implementing, in cooperation with the Data Center, Development, and Telecommunications Divisions of BIT, a written process to investigate any violations or potential violations of this policy or any policy regarding system security and integrity, individually or in cooperation with any appropriate State law enforcement or investigative official.

• Implementing training and education programs to ensure government employees are aware of the risks and expected behaviors towards cyber security.

• Keeping a record of system integrity problems and incidents.

• Maintaining and updating the Information Technology Security Policies.

• Taking such emergency action as is reasonably necessary to provide system control where security is deemed to have been lost or jeopardized.

• Performing periodic security surveys.

• Providing for network security by seeking to preclude misuse of the network of the State to gain or attempt to gain unauthorized access to any system.

• Performing checks of information systems to assess system security and integrity, as well as to determine the use or placement of illegal or improper software or equipment.

• Coordinating the cyber security activities across BIT to ensure technology services and IT policies are effective in balancing security requirements vs. client needs.

• Ensuring processes are in place to remove all data before equipment is disposed or redeployed.

• Coordinating and consulting with the BIT Security Infrastructure Team (SIT), Executive Working Group on Cyber Security, other State departments, Board of Regents, K-12 community, federal Department of Homeland Security, and Multi-State Information Sharing and Analysis Center (MS-ISAC).

• Implementing decisions of the State concerning information technology security.

• Providing reports directly to the Office of the Governor where any serious security violation or potential challenge to security occurs.

• Leading the BIT Security Infrastructure Team.

• Leading the Executive Working Group on Cyber Security.

• Coordinating and entering into agreements with organizations on data-sharing.

Page | 21

BIT

NOT FOR PUBLIC DISTRIBUTION 03/2024

1.1.4.3. Security Infrastructure Team (SIT)

The SIT shall, in coordination with the CISO, recommend technology solutions, written policies, and procedures necessary for assuring the security and integrity of State information technology. The SIT shall coordinate with the CISO in creating and implementing a written system to investigate any violations or potential violations of this policy or any policy regarding system security and integrity.

• The CISO shall appoint the Security Infrastructure Team members.

• The SIT shall be chaired by the CISO.

• At a minimum, the SIT communicates internally every two weeks, via a scheduled bi-weekly meeting or via email, the current security posture of the State.

• The SIT shall consist of at least one member from each of the BIT information technology divisions.

• The recommendation is that membership include multiple representation from development, systems integration, desktop support, networking.

• K-12, Regental, Judicial, Legislative, and other government entities can be invited at the discretion of the

CISO.

1.1.4.4. Security Operations Team (SOT)

The Security Operations Team (SOT) shall be appointed by the CISO. The SOT meets daily to review any cyber security findings or issues with the State Infrastructure within the previous day. The SOT includes members of the Telecommunications, Data Center, and Development divisions.

• Logs are fed into the State security information and event management system and are monitored by the SOT daily. These logs include firewall, intrusion detection, intrusion prevention, desktop protection, audit logs, etc.

• The SOT meets daily to review any findings or issues.

• Plans of action are established with assignments established based on the deficiencies.

The SOT can make recommendations and suggestions to the SIT for operational considerations.

1.1.4.5. BIT Executive Working Group on Cyber Security

The Executive Working group shall be informed and educated on matters regarding cyber security. They shall offer their perspective and feedback on technology, policies and other important matters.

• At the CISO's discretion, the members of the Working group shall come from the Executive, Judicial, Legislative branches of State government, constitutional offices, K-12 public schools and higher education, and other qualified individuals.

The Group shall meet quarterly at a minimum.

1.1.5. Related Topics

1.1.5.1. State Policies

1.1.5.2. State Regulations / Laws

SDCL 1-33-43, SDCL 1-33-44, SDCL 1-33-45

1.1.5.3. Federal Regulations / Laws

1.1.5.4. Industry Documents / Sections

Page | 22

BIT

NOT FOR PUBLIC DISTRIBUTION 03/2024

NIST SP 800-39

General-Procedural-Electronic Monitoring

5.1.1. Overview

A balance exists between employee privacy and the rights of the employer. An employer has the right to employ productive and proficient workers. The intent of this policy is to ensure that all individuals that utilizing State technology resources are familiar with the breadth of electronic monitoring that can occur on the DDN.

5.1.2. Purpose

All individuals utilizing the technology infrastructure of the State must be familiar with the breadth of electronic monitoring that can occur on the DDN.

5.1.3. Scope

This policy applies to State employees, consultants, and other clients of the DDN.

5.1.3.1. Scope Assumptions

The policy pertains to the use of digital resources owned or managed by State government or transmitted over government resources. These resources include networks, workstations, phones, printers, faxes, storage facilities, email, etc. - all technology. K-12 schools and Higher Education are included only from a network transport - network data perspective. Data that is transported over BIT managed government network facilities are within scope. Applications on personal devices storing government data are within scope.

5.1.3.2. Scope Constraints

Applications on or usage of personal devices regarding non-government data or resources are outside the scope of this policy with the exceptions noted herein. Data on personal devices, that is not government data, is outside the scope of this policy except to ensure that NO government data exists on a personal device. State government has no interest in personal data. Personal devices are subject to ediscovery requirements.

5.1.4. Policy

5.1.4.1. Privacy

All messages and correspondence sent over the technology infrastructure of the State are the property of the State. To properly maintain and manage the technology resources and data of the State, BIT reserves the right to examine all data stored on devices connected to the DDN or transmitted across the DDN where allowed by law. In accordance with the Federal Electronic Communications Privacy Act of 1986, employers can monitor electronic messages. No expectation of privacy should be made regarding the information or data transmitted across the DDN, or stored on devices connected to the DDN:

• Individuals are notified they have no reasonable expectation of privacy regarding communications or data transiting or stored on the technology infrastructure of the State or on personal devices granted access to government resources.

• Any communications or data transiting or stored on the technology infrastructure of the State may be monitored, disclosed, or used for any lawful government purpose.

Page | 23

BIT

NOT FOR PUBLIC DISTRIBUTION 03/2024

At any time, and without prior notice, the Commissioner of BIT (or their senior management designee) reserves the right to grant an authorized agency the ability to examine email, archived email, directories and files created on workstations, servers, cloud sources, workstation directories and email or data stored on phones, and other government data stored on the technology infrastructure of the State or personal devices. These requests to inspect any government data or technology will only be granted to those with a valid, legal right to make such request. These requests may be to assure compliance with internal policies, to support investigations, and/or to assist with the management of State information systems. BIT does not access email or work files for content-review purposes. Any access by BIT is required for information systems support purposes only. State employees and contractors may be subject to electronic monitoring while utilizing government resources.

5.1.4.2. Consent

All government employees and contractors will sign the Security Acknowledgement form (http://intranet.bit.sd.gov/forms/ ) acknowledging that they have received, read and understood the State's monitoring policies. Users of State networks and resources should have no expectation of privacy. BIT employees are expected to annually sign the form at the time of their personnel review.

5.1.5. Related Topics

5.1.5.1. State Policies

ITSP 230.38 eDiscovery, ITSP 230.44 Email Customization, ITSP 610.1 Access Control.

5.1.5.2. State Regulations / Laws

5.1.5.3. Federal Regulations / Laws

Federal Electronic Communications Privacy Act of 1986: 18 U.S.C. §1030. Fraud and related activity in connection with computers; 18 U.S.C. §2701 et seq. Stored Communications Act.

5.1.5.4. Industry Documents / Sections

General-Procedural-Remote Access - Hourly Employees

5.3.1. Overview

Remote access to government data is a common requirement in today's working world. Access for mobile workers in addition to other traveling workers is a necessity for an efficient workforce. Mobile access must be managed in a manner that emphasizes government data security as the highest priority.

5.3.2. Purpose

This policy is…