An individual or automated application authorized to access an information resource in accordance with the owner-defined controls and access rules. These assets must be available and protected commensurate with the value of the assets. Measures shall be taken to protect these assets against accidental or unauthorized access, disclosure, modification or destruction, as well as to assure the availability, integrity, utility, authenticity and confidentiality of information. Access to state information resources must be appropriately managed. The agency head is responsible for the protection of information resources.
All individuals are accountable for their actions relating to information resources.
Information resources shall be used only for intended purposes as defined by the agency and consistent with applicable laws. Risks to information resources must be managed. The expense of security safeguards must be commensurate with the value of the assets being protected. The integrity of data, its source, its destination, and processes applied to it must be assured. Changes to data must be made only in authorized and acceptable ways.