In cases where information resources are used by more than one major program, the owners shall reach consensus and advise the information security function as to the designated primary owner. Owners must specify appropriate controls, based on risk assessment, to protect the state's information resources from unauthorized modification, deletion or disclosure. Controls extend to outsourced contracts. Owners must confirm that controls are in place to ensure the accuracy and completeness of data. Owners shall assign custody of assets and provide appropriate authority to implement security controls and procedures.
Owners are the authority on appropriate level of controls and the timing of their implementation.
Users of information resources shall use the resource only for its defined purposes and comply with established controls. The information security function. Each agency head or his or her designated representative shall institute an information security function to administer the agency information security program. It shall be the duty and responsibility of this function to recommend policies and establish procedures and practices, in cooperation with owners and custodians, necessary to ensure the security of information assets against unauthorized or accidental modification, destruction or disclosure. The security program shall include written descriptions of information resources security responsibilities, assigned personnel resources, policies, guidelines, data security classification schemes, standards and procedures for the protection of information resources.