Continuity of information resources supporting critical governmental services must be ensured in the event of a disaster or business disruption. Owners, with the agency head's concurrence, are responsible for classifying program information. Owners, custodians and users of information resources shall be identified, and their responsibilities defined and documented by the agency. In cases where information resources are used by more than one major program, the owners shall reach consensus and advise the information security function as to the designated primary owner. Owners must specify appropriate controls, based on risk assessment, to protect the state's information resources from unauthorized modification, deletion or disclosure.
Controls extend to outsourced contracts.
Owners must confirm that controls are in place to ensure the accuracy and completeness of data. Owners shall assign custody of assets and provide appropriate authority to implement security controls and procedures. Owners are the authority on appropriate level of controls and the timing of their implementation. Users of information resources shall use the resource only for its defined purposes and comply with established controls. The information security function.