In its biennial strategic plan for information resource management, each agency must identify the computer security policies and standards planned for implementation during the planning period. Rapid and continuing technical advances in information processing have increased the dependence of state agencies on information and automated systems. The value of state data and software, in terms of restoration costs or losses due to unauthorized disclosure, far exceeds the value of its associated hardware. For that reason, information processed by computers must be recognized as a major state asset and be protected accordingly. Promulgate state policies regarding the security of data and information technology resources.
Policies are broad principles underlying the state's information security program.
Define minimum security standards for the protection of state information resources. Standards are required administrative procedures or management controls. Provide optional guidelines to assist agencies of state government in the implementation and interpretation of standards, and to recommend effective security practices which should be implemented where such controls are applicable, as determined by agency management. Provide a compilation of information security material in support of security awareness and training programs. The state's information files and databases are essential and vital public resources which must be protected from unauthorized modification, deletion or disclosure.