Thus, the controlling factor for confidential information is dissemination, while the controlling factor for sensitive information is that of integrity. These assets require a degree of protection commensurate with their value. Measures shall be taken to protect these assets against accidental or unauthorized disclosure, modification or destruction, as well as to assure the security, reliability, integrity and availability of information. The protection of assets is a management responsibility. Access to state information resources must be strictly controlled.
State law requires that state owned information resources be used only for official state purposes.
Information which is sensitive or confidential must be protected from unauthorized access or modification. Data which is essential to critical state functions must be protected from loss, contamination, or destruction. Risks to information resources must be managed. The expense of security safeguards must be appropriate to the value of the assets being protected, considering value to both the state and a potential intruder. The integrity of data, its source, its destination, and processes applied to it must be assured.