justicedao/ipfs_state_laws huggingface dataset:
125-700-0155 Audit Records and Retention (1) The agency's internal audit function, must maintain audit work papers and reports in accordance with records retention requirements. The internal audit function should ensure that its records retention schedule will allow it to keep the documents until an external peer review has been performed, and audit findings and recommendations have been appropriately followed-up on. Refer to State Archive requirements and OAR 166-300-0025 for record retention schedules. Records must be kept so they can be retrieved, if necessary. (2) The agency's Chief Audit Executive must follow appropriate data classification procedures to monitor and control confidential and sensitive internal audit documents. Confidential documents are those designated as confidential by agency policy or covered by ORS 192.496 through 192.505. Statutory/Other Authority: ORS 184.360 Statutes/Other Implemented: ORS 184.360(3) History: DAS 2-2014, f. 4-30-14, cert. ef. 5-1-14 DAS 1-2011, f. 6-23-11, cert. ef. 6-30-11
125-800-0005 Purpose, Application, and Authority These rules are adopted under 2005 Oregon Laws Chapter 739. These rules set forth the policies for state government-wide information security. Statutory/Other Authority: ORS 182.122 & 291.038 Statutes/Other Implemented: ORS 182.122 History: DAS 8-2006, f. & cert. ef. 12-28-06
125-800-0010 Definitions (1) “Incident” means any material adverse event that impairs the confidentiality, integrity or availability of information resources. (2) “Information Resources” means all categories of automated or non-automated systems and data, including but not limited to, records, files, and databases, information technology equipment, facilities, and software owned or leased by the state. (3) “Material adverse event” means an adverse event whereby some aspect of computer security could be threatened: loss of data confidentiality, disruption of data or system integrity, or disruption or denial of availability. (4) “Ordinary Public Access” means unauthenticated access to systems or online resources intentionally provided for public use, such as an agency’s public web site. (5) “Publicly addressable interfaces” means any network device or software application using Internet protocols that can be accessed using addresses that are routable over the public Internet infrastructure, including the state's backbone network. (6) “Privately addressed interfaces” means any network device or software application using Internet protocols accessed using addresses that are not routable over the public Internet infrastructure, including the state's backbone network. (7) “State Information Security Plan” means a compilation of documents including, but not limited to, statutes, administrative rules, policies, and plans, prescribing the information security practices of the State of Oregon. (8) “Security Assessment” means any organized method of determining the risk or vulnerability including, but not limited to: risk assessment; vulnerability assessment; security penetration test, and security audits and reviews. (9) “State Shared Computing and Network Infrastructure” means all network and information assets under the direct control or maintained by the Executive Department. Statutory/Other Authority: ORS 184.305; 182.122 Statutes/Other Implemented: 2005 Oregon Laws Chapter 739 History: DAS 8-2006, f. & cert. ef. 12-28-06
128-010-0005 Purpose (1) The Office of the State Chief Information Officer (Office) operates and maintains the State Private Communications Network comprised of State owned facilities; facilities and services that the Office has acquired or leased, or may acquire or lease from or share with other government entities; or facilities and services that the Office has acquired or leased, or may acquire or lease, from communications providers. The Office wishes to continue to operate and maintain the State’s Private Communications Network, as well as to further develop and expand, the State’s Private Communications Network, for the benefit of the State Agencies, local, federal and tribal government entities, and communities of interest. The primary purpose of these rules is to establish the process by which the Office will determine if Broadband services and operations proposed to be provided to Non-State Entities are already offered by Telecommunications Providers and, if not, to establish the process by which the Office may provide Broadband services and operations to Non-State Entities. (2) Nothing in these Division 10 rules is intended or shall be construed to prohibit a Non-State Entity from providing Broadband services and operations to itself and others in compliance with applicable law, or from acquiring Broadband services and operations in compliance with applicable law from a Telecommunications Provider at any time, on terms and conditions agreed to by the Non-State Entity and the Telecommunications Provider. Statutory/Other Authority: ORS 183.325-410, ORS 276A Statutes/Other Implemented: Or Laws 2018, ch 51 (HB 4023) History: OSCIO 1-2019, adopt filed 03/26/2019, effective 03/26/2019
128-010-0010 Definitions For the purposes of these rules, the following definitions apply: (1) “Broadband” means wide bandwidth communications transmissions over coaxial cable, optical fiber, radio, twisted pair or other transmission medium with an ability to simultaneously transport multiple signals and traffic types at no less than the minimum transmission speed established for Tier 1 services as set forth in Section 20 of these rules. (2) “Communications” means media that communicate voice, data, text or video over a distance using electrical, electronic or light wave transmissions. (3) “Community of Interest” means an entity so designated by the Office pursuant to these rules. (4) “Nonprofit Organization” means an organization that demonstrates to the Office that it meets all requirements to achieve tax exempt status under Section 501(c)(3) of the Internal Revenue Code of 1986. (5) “Non-State Entity” means: (a) any public body, as defined in ORS 174.109, other than a State Agency; or (b) any federally recognized Indian tribe in Oregon; or (c) any nonprofit organization designated as a Community of Interest under these rules. (6) “Public body” means a public body, as defined in ORS 174.109, in this state. (7) “Office” means the Office of the State Chief Information Officer established pursuant to ORS 276A.203(1). (8) “Service Request” means a request for Broadband services submitted to the Office by a Non-State Entity for purposes of the Office evaluating whether it may, and is willing and able to pursue Broadband services and operations to the Non-State Agency. (9) “Site” means a specific location within an area at which a Non-State Entity desires to receive Broadband services and operations. (10) “State Agency” has the meaning given that term in ORS 279A.010. (11) “State’s Private Communications Network” means the communications network operated and maintained by the Office for the benefit of State Agencies, comprised of equipment, software, hardware, facilities and services owned by the State, or as provided to or acquired by the Office through agreements with communications providers or other government entities. (12) “Telecommunications Provider” means any person that is capable of providing Broadband and communications services including, but not limited to, a telecommunications utility as defined in ORS 759.005, a competitive Telecommunications Provider as defined in ORS 759.005, a cooperative Telecommunications Provider, a cable television provider or an interstate Telecommunications Provider. (13) “Unserved” means, with respect to a particular area, that there is no Telecommunications Provider offering the Broadband services that meet the minimum specifications for Tier 1 services as set forth in Section 20 of these Division 10 rules. Statutory/Other Authority: ORS 183, ORS 276A Statutes/Other Implemented: Or Laws 2018, ch 51 (HB 4023) History: OSCIO 1-2019, adopt filed 03/26/2019, effective 03/26/2019
128-010-0015 Duties of the Office (1) The Office shall: (a) Operate and maintain the State’s Private Communications Network and take such actions as the Office desires to further develop and expand the State’s Private Communications Network; (b) Provide Broadband services and operations over the State’s Private Communications Network to State Agencies; (c) Create and maintain a web-based mechanism that allows any interested party to register to receive notices issued by the Office under these Division 10 rules. In addition, an interested party may notify the Office in writing of its interest in receiving notice of Service Requests and Opportunity Notices provided under these Division 10 rules; (d) Maintain a list of interested parties or those parties who have advised the Office in writing that they wish to receive information about any Service Request or Opportunity Notice; (e) Provide notice of and make available to the interested parties the following: (A) the Office’s preliminary list of eligible Non-State Entities and areas, and any modifications to the preliminary list; (B) any Service Request(s) submitted to the Office; and (C) any Opportunity Notices. (f) Develop and maintain a network map diagramming the State’s Private Communications Network; (g) Develop and maintain a Services Catalog, listing the Broadband services and operations that the Office may provide, as well as the minimum specifications for such services; and (h) Enter into agreements with Telecommunications Providers in compliance with applicable law. (2) The Office may: (a) Install new equipment, build or construct the State’s Private Communications Network on its own, or, in the alternative, enter into agreements or otherwise acquire equipment, software, hardware, facilities or services for the State’s Private Communications Network from Telecommunications Providers, governmental entities, or other providers; (b) Subject to the process described in these rules, provide the Broadband services and operations over the State’s Private Communications Network to Non-State Entities. Statutory/Other Authority: ORS 183, ORS 276A Statutes/Other Implemented: Or Laws 2018, ch 51 (HB 4023) History: OSCIO 1-2019, adopt filed 03/26/2019, effective 03/26/2019
128-010-0020 Minimum Specifications (1) Specifications Generally. The specifications set forth below are the minimum specifications of Broadband services and operations that the Office may offer to Non-State Entities. Tier 1 – Use/Service Profile: Basic to Advanced Service needed depending upon business needs and application use; Sample Use Case*: Small office, 1-5 users; Minimum Realized Download and Upload (as applicable): 25 Mbps Download and 3 Mbps Upload. *These use cases are not exclusive, and are provided as representative samples. Each Non-State Entity requesting Broadband services from the Office is responsible for identifying its own needs and desired service levels and for specifying services appropriate for its situation. (2) From time to time, as necessary, the Office shall review the minimum specifications set forth in these rules and determine whether any revision is required. If the Office determines that a change is necessary, the Office shall engage in the appropriate procedures under the Oregon Administrative Procedures Act (ORS Chapter 183) to amend these rules. Statutory/Other Authority: ORS 276A Statutes/Other Implemented: Or Laws 2018, ch 51 (HB 4023) History: OSCIO 1-2019, adopt filed 03/26/2019, effective 03/26/2019
128-010-0025 Eligibility (1) Eligibility. The Office may only provide Broadband services and operations to Non-State Entities under Oregon Laws 2018, chapter 51, section 5, in accordance with these rules, and only to eligible Non-State Entities at eligible Sites. (2) A particular Site is an eligible Site if it is in an area that is Unserved. (3) The Office may develop and maintain a preliminary list of eligible Non-State Entities and areas. If the Office develops a preliminary list of eligible Non-State Entities and areas, the Office may make an initial determination of whether areas are Unserved for the purposes of its preliminary list based on, without limitation, the following sources of information: (a) Federal Communications Commission, Form 477 carrier filings; (b) Oregon Public Utility Commission communications provider filings, including tariffs and price lists; (c) Broadband connectivity lists maintained by the Oregon State Library; (d) Current state contracts; (e) State and carrier network maps; (f) Requests for service; (g) Telecommunications Provider information; or (h) Historical information. (4) The Office will maintain such list as a means for making a preliminary assessment of the need for Broadband services and operations by Non-State Entities in particular areas for administrative convenience. Non-State Entities are not required to be on the list of eligible Non-State Entities, and Sites are not required to be in an area on the list of eligible areas in order for a Non-State Entity to make a Service Request pursuant to Section 30 of these Division 10 rules. The Office may consider an entity or area for inclusion on the preliminary list of eligible Non-State Entities or areas either on the Office’s own initiative, or in response to a request from a Non-State Entity for the entity or a particular area to be included on the preliminary list of eligible Non-State Entities and areas, provided, however, that a Non-State Entity may not obtain Broadband services from the Office under Or Laws 2018, ch 51 without submitting a Service Request and engaging in the process set forth in these Division 10 rules. Statutory/Other Authority: ORS 276A Statutes/Other Implemented: Or Laws 2018, ch 51 (HB 4023) History: OSCIO 1-2019, adopt filed 03/26/2019, effective 03/26/2019
128-010-0035 Opportunity Notice to Telecommunications Providers and Other Interested Parties (1) The Office will provide an Opportunity Notice to Telecommunications Providers and other interested parties that the Office seeks information to determine if any proposed Broadband services and operations are already offered by a Telecommunications Provider(s) in the area meeting or exceeding the proposed plan developed by the Office. (2) The Office will provide notice of an Opportunity Notice as provided in Section 15(1)(e) of these Division 10 rules and to any parties that the requestor associated with an Opportunity Notice asks to be notified of the Opportunity Notice. (3) The Opportunity Notice may include a request for information or a request for quotes from Telecommunications Providers that are intended to allow Telecommunications Providers to demonstrate their ability to provide the Broadband services and operations proposed by the Office to the Site proposed to be served within a reasonable time and for a reasonable cost. (4) The Office may amend an Opportunity Notice at any time either on its own initiative, or in response to a request to amend the Opportunity Notice by the requestor. (5) Any Telecommunications Provider or interested parties may submit a notice that it intends to submit an offer to provide the requested services within thirty (30) calendar days of the date of the Opportunity Notice or any later date set forth in the Opportunity Notice. The Telecommunications Provider or other interested party must submit an offer to provide the requested services within such time as set forth in the Opportunity Notice. (6) The Office may cancel an Opportunity Notice at any time, and for any reason. However, the Office may not provide Broadband services to any Site of a Non-State Entity that has been the subject of a cancelled Opportunity Notice unless it follows the procedures set forth in these Division 10 rules. (7) Nothing in these Division 10 rules shall be construed to prohibit a telecommunication provider or any other person from communicating with requestor regarding an Opportunity Notice. Statutory/Other Authority: ORS 276A Statutes/Other Implemented: Or Laws 2018, ch 51 (HB 4023) History: OSCIO 1-2019, adopt filed 03/26/2019, effective 03/26/2019
128-010-0050 Appeals A Telecommunications Provider or other interested party may appeal any determination made by the Office under these rules pursuant to the Administrative Procedures Act. Statutory/Other Authority: ORS 276A Statutes/Other Implemented: Or Laws 2018, ch 51 (HB 4023) History: OSCIO 1-2019, adopt filed 03/26/2019, effective 03/26/2019
128-020-0005 Purpose (1) The State Chief Information Officer has responsibility for and authority over executive department information systems security in accordance with ORS 276A.300, including responsibility for taking all measures that are reasonably necessary to protect the availability, integrity or confidentiality of information systems or the information stored in information systems. (2) The primary purpose of these rules is to establish the criteria and processes by which the State Chief Information Officer will determine when a corporate entity poses a national security threat, and when a corporate entity no longer poses a national security threat. These rules define “national security threat” and “artificial intelligence” for purposes of protecting state information technology assets. Statutory/Other Authority: ORS 276A.300 Statutes/Other Implemented: ORS 276A.340-276A.344 & Or Laws 2025, ch 396 (HB 3936) History: OSCIO 1-2025, amend filed 12/04/2025, effective 01/01/2026 OSCIO 1-2024, adopt filed 01/29/2024, effective 02/01/2024
128-020-0015 Covered Vendor List (1) The State Chief Information Officer shall establish a list of covered vendors on its publicly accessible website, inclusive of information sufficient to identify covered products, and the date that each covered vendor was designated as a national security threat. The State Chief Information Officer shall maintain and update this list in accordance with the policies and procedures adopted pursuant to OAR 128-020-0025, Designation Process. (2) Subject to allowable investigatory, regulatory, or law enforcement exceptions, and all applicable policies and procedures, no covered products of a corporate entity listed as a covered vendor on the list maintained by the State Chief Information Officer under this Division 20 may be installed or downloaded onto a state information technology asset that is under the management or control of a state agency, or used or accessed by a state information technology asset. Statutory/Other Authority: ORS 276A.300 Statutes/Other Implemented: Or Laws 2023, ch 256 (HB 3127) History: OSCIO 1-2024, adopt filed 01/29/2024, effective 02/01/2024
128-020-0020 Designation Criteria The State Chief Information Officer will consider one or more of the following criteria when determining if a corporate entity is a national security threat: (1) The corporate entity owns or otherwise provides a product or service that was developed or provided by a covered vendor. (2) The extent to which the corporate entity is affiliated with a covered vendor. (3) The corporate entity owns or otherwise provides a product or service that collects user data, including but not limited to personal information, browsing history, and location history, that is not required for or grossly exceeds the minimum necessary user data for the product or service. (4) The corporate entity owns or otherwise provides a product or service that collects user data, such as biometric data, contact information, GPS locations, chat logs, photos and browser histories, personal information, browsing history, and location history, that is potentially or currently accessible by foreign governments or foreign state actors. (5) The corporate entity owns or otherwise provides a product or service that has security vulnerabilities that, if unresolved, could expose state information technology assets to malicious actors. (6) The corporate entity owns or otherwise provides a product or service developed or provided by a corporate entity that has been designated a national security threat or otherwise meets the criteria of a covered vendor under OAR 128-020-0010. (7) The corporate entity owns or otherwise provides a product or service that supports the administrative use of algorithmic modifications to conduct misinformation, disinformation, or malinformation campaigns. (8) The corporate entity owns or otherwise provides a product or service that has the potential to control or compromise state information technology assets. Statutory/Other Authority: ORS 276A.300 Statutes/Other Implemented: Or Laws 2023, ch 256 (HB 3127) History: OSCIO 1-2024, adopt filed 01/29/2024, effective 02/01/2024
128-020-0025 Designation Process (1) Enterprise Information Services shall adopt and implement a policy and procedure that establishes the schedule for review of corporate entities associated with hardware, software, and services against the criteria in OAR 128-020-0020, and under which Enterprise Information Services will update its covered vendor list to reflect designations made pursuant to the Secure and Trusted Communications Networks Act of 2019, 47 USC 1601, et seq, including as amended. If review or other update identifies that a corporate entity is or may be a national security threat, the State Chief Information Officer will determine if the corporate entity should be designated as a covered vendor. (2) The determination of the State Chief Information Officer will be reflected in an update of the covered vendor list on the publicly accessible Enterprise Information Services website. Statutory/Other Authority: ORS 276A.300 Statutes/Other Implemented: Or Laws 2023, ch 256 (HB 3127) History: OSCIO 1-2024, adopt filed 01/29/2024, effective 02/01/2024
128-020-0030 De-Designation Criteria The State Chief Information Officer will consider one or more of the designation criteria in OAR 128-020-0020 when de-designating or re-evaluating a corporate entity’s status as a national security threat. Statutory/Other Authority: ORS 276A.300 Statutes/Other Implemented: Or Laws 2023, ch 256 (HB 3127) History: OSCIO 1-2024, adopt filed 01/29/2024, effective 02/01/2024
128-020-0035 De-Designation Process (1) If review or other update received pursuant to the process and procedure established under OAR 128-020-0025, Designation Process, identifies that a corporate entity may no longer pose a national security threat, the State Chief Information Officer will determine if the corporate entity should be removed from the covered vendor list. (2) The determination of the State Chief Information Officer will be reflected in an update of the covered vendor list on the publicly accessible Enterprise Information Services website. Statutory/Other Authority: ORS 276A.300 Statutes/Other Implemented: Or Laws 2023, ch 256 (HB 3127) History: OSCIO 1-2024, adopt filed 01/29/2024, effective 02/01/2024