Administrative Security

Policy Statement

In accordance with the Business Data Classification Policy, all information systems that create, receive, store, or transmit data classified as 'Confidential' must adhere to the administrative security principles of this document.

Reason for Policy

State and federal regulations, as well as general best practices, shape the security and privacy protections that must be afforded to data classified as "Confidential". This policy addresses regulatory and best practice requirements to ensure proper administrative security of Confidential data.

Who Should Read this Policy

All users of Business.

Principles

Information systems or applications that create, receive, store, or transmit Confidential data (hereafter "Confidential Systems" - see Data Classification policy) must, without exclusion, adhere to the following:

Risk Assessment

1. All Confidential Systems must undergo a documented risk assessment. At minimum, the following must be addressed:
   1. System purpose
   2. Possible threats
   3. Possible vulnerabilities
   4. Remaining residual risks (after mitigation)
2. Risk assessments should be designed to determine the likelihood of a security compromise and the potential damage such a compromise could cause. Risk assessment tools that address these concerns will be made available to all through the Information Technologies and Services. It is strongly recommended that these tools be used for risk assessment, as they will meet all requirements of this policy.
3. Systems must be rated for risk according to an analysis of the factors above. Systems with significant levels of risk are to be addressed on a priority basis and given the most restrictive and stringent security controls practical.
4. Risk Management
   1. Not all information systems can be governed by the same security controls. In some case, when security controls conflict with equally important considerations of data availability or system usability, it may be necessary to make trade-offs. Managers and administrators of Confidential systems are responsible for:
   2. Identifying and documenting security-control variances between Confidential systems and the policies that apply to those systems.
   3. Documenting the reasons for such variances.
   4. Addressing risks presented.
   5. Identifying compensating controls for the documented risks.
   6. Implementing those compensating controls.
5. Workforce Security Training
   1. Business shall provide appropriate training on security regulations and policies to all workforce members. Training must be managed by the ITS  Officer or his or her designee and must ensure:
   2. All workforce members receive and understand all appropriate Business security policies and procedures.
   3. New workforce members successfully complete Security and Privacy training.
   4. Workforce members receive additional appropriate training whenever acting as a systems administrator, security administrator, or ITS Liaison.
6. Training must be reviewed at least biannually and updated when security policies and procedures are substantially changed.
7. Contingency Planning
   1. Managers and administrators of Confidential systems are responsible for creating, implementing, and testing, at least biannually, disaster recovers and business continuity plans for those systems. All plans must address and document the following:
   2. An analysis of data criticality, which considers importance relative to: the mission of the institution or department, the sensitivity of the data on the system, and the amount of Confidential data on the system.
   3. Data backup policies and procedures.
   4. Recovery procedures used to restore operational capacity or data.
   5. Emergency operating plans, which detail the process for maintaining business operations and protecting Confidential data while operating in an emergency mode.
   6. Procedures for testing and revising emergency operating plans. Copies of these plans should be stored in multiple secure locations, including off-site.
8. Review
   1. Managers and administrators of Confidential systems are responsible for reviewing these systems at least once every 3 years. Reviews must evaluate risks, identify and test security controls, and update risk management and contingency plans. Reviews must include, at minimum:
      1. Any relevant regulatory, compliance, or policy changes.
      2. Changes in the threat or risk environment.
      3. An update of implemented security controls.
      4. An account of data security incidents that occurred since the last review.
      5. Implementation plans for new or updated physical, administrative, or technical controls.
9. Record Retention
   1. All documentation created for Confidential system as part of policy compliance efforts must be kept for a minimum of 7 years from the creation date or most recent change made.
10. Availability
    1. All documentation created for Confidential systems as part of policy compliance efforts must be made available to all parties responsible for implementing the procedures for which the documentation pertains.
11. Security Incident Response Procedures
    1. Unauthorized Confidential system access or use.
    2. Unauthorized Confidential data disclosure, modification, or destruction.
    3. Unauthorized interference with normal operations or Confidential systems.
    4. Theft or loss of Confidential systems or data.