justicedao/ipfs_state_laws huggingface dataset:
274-045-0441 Terms and Requirements of Veterans' Home Improvement Loans (1) The veterans' home improvement loan must be placed in the first lien position on the security or be an immediate subsequent lien to an existing ODVA lien. The first ODVA lien and any immediate subsequent lien made on the security by the Director shall be deemed collectively as a first lien on the security. (2) The net appraised value will be used as the basis for determining the maximum veterans' home improvement loan subject to statutory limitations and remaining loan right. (3) When a veterans' home improvement loan is made on a security with an existing balance owed to the Director, the total of the unpaid balance of the existing loan and the veterans' home improvement loan shall not exceed 80 percent of the net appraised value as determined by the Director. (4) When a veteran' home improvement loan is made on a property where no balance is owing, the veterans' home improvement loan shall not exceed 97 percent of the net appraised value as determined by the Director. If the loan-to-value ratio is greater than 80 percent of the net appraised value, the loan must be insured by mortgage insurance consistent with ORS 407.485. (5) The borrower shall not receive any cash back from the home improvement loan. (6) All existing nonamortizing ODVA loans on the security must be reamortized to bring the principal and interest payment and final payment date into conformance with ODVA policy as identified in the Processing Manual. A copy of the manual is on file with the Oregon Department of Veterans' Affairs, 700 Summer Street NE, Salem Oregon, and available to the public during normal business hours. All other terms of the existing loan on the security remain unchanged. (7) Depending upon the loan amount, the maximum term of a home improvement loan may not exceed 20 years. [Publications: Publications referenced are available from the agency.] Statutory/Other Authority: ORS 406.030, 407.115, 407.125 & Art. XI-A OR Const. Statutes/Other Implemented: ORS 407.115, 407.125 & Art. XI-A OR Const. History: DVA 11-2003, f. & cert. ef. 9-23-03 DVA 3-2003(Temp), f. & cert. ef. 4-7-03 thru 10-3-03 DVA 10-2001, f. & cert. ef. 12-26-01
274-045-0451 Appraisal of Property An appraisal may be made at the discretion of the Director to assist in establishing the net appraised value. A fee will be charged in accordance with OAR 274-045-0220. Statutory/Other Authority: Art. XI-A OR Const. Statutes/Other Implemented: Art. XI-A OR Const. History: DVA 10-2001, f. & cert. ef. 12-26-01
274-045-0461 Transfer of Ownership The Director will call the entire balance of the loan due and payable if any of the conditions in OAR 274-045-0120(2) occur. Statutory/Other Authority: ORS 406.030, 407.115, 407.125 & Art. XI-A OR Const. Statutes/Other Implemented: ORS 407.115, 407.125 & Art. XI-A OR Const. History: DVA 10-2001, f. & cert. ef. 12-26-01
274-045-0471 Taxes, Hazard Insurance and Flood Insurance If delinquent taxes become a lien against the security, or the borrower fails to maintain the required insurance, the Director may pay the taxes or insurance and if so paid, will collect the amount paid by ODVA from the borrower through an escrow account per the provisions of OAR 274-045-0150. Statutory/Other Authority: ORS 406.005 & 407.115 Statutes/Other Implemented: ORS 407.075 to 407.385; Oregon Constitution Article XI-A, Section 3 History: DVA 6-2020, amend filed 07/10/2020, effective 07/11/2020 DVA 1-2020, temporary amend filed 01/21/2020, effective 01/22/2020 through 07/10/2020 DVA 2-2005, f. & cert. ef. 4-22-05 DVA 10-2001, f. & cert. ef. 12-26-01
274-045-0481 Title Insurance Each loan shall be covered by a title insurance policy as designated by the Director at the borrower's expense. Statutory/Other Authority: ORS 406.030, 407.115, 407.125 & Art. XI-A OR Const. Statutes/Other Implemented: ORS 407.115, 407.125 & Art. XI-A OR Const. History: DVA 10-2001, f. & cert. ef. 12-26-01
291-001-0020 Notice of Proposed Rule Prior to the adoption, amendment, or repeal of any permanent rule, the Department of Corrections shall give notice of the proposed adoption, amendment, or repeal: (1) In the Secretary of State's Bulletin referred to in ORS 183.360 at least 21 days before the effective date of the rule; (2) By electronic mail, or postal mail when requested under ORS 183.335(15), to the legislators specified in ORS 183.335(15) at least 49 days before the effective date of the rule; (3) By electronic mail, or postal mail when requested under ORS 183.335(8), to persons on the department's mailing list established under ORS 183.335 (8) at least 28 days before the effective date of the rule; and (4) By electronic mail or postal mail to the following at least 28 days before the effective date of the rule: (a) Capitol Press Room; (b) Associated Press (AP); (c) American Federation of State‑County and Municipal Employees (AFSCME); (d) Oregon Public Employees Union (OPEU); (e) American Civil Liberties Union (ACLU); (f) Office of Public Defense Services; (g) Oregon State Bar Association; (h) Crime Victims United; (i) Corrections Ombudsman; (j) Nine Federally Recognized Tribes of Oregon; (k) Department of Corrections – Institution Functional Unit Managers or designee; and (l) Department of Corrections – Institution Library Coordinators or designee. Statutory/Other Authority: ORS 183.335 & 183.341 Statutes/Other Implemented: ORS 183.335 & 183.341 History: DOC 1-2026, amend filed 01/20/2026, effective 02/01/2026 DOC 6-2023, minor correction filed 04/27/2023, effective 04/27/2023 DOC 21-2020, amend filed 11/12/2020, effective 11/12/2020 DOC 4-2007, f. & cert. ef. 7-20-07 DOC 17-2003, f. & cert. ef. 12-12-03 DOC 9-2000, f. & cert. ef. 4-14-00 DOC 18-1999(Temp), f. & cert. ef. 10-28-99 thru 4-25-00 CD 5-1995, f. 2-22-95, cert. ef. 3-1-95 CD 1-1991, f. & cert. ef. 1-9-91 CD 9-1986, f. & ef. 4-18-86 CD 2-1986(Temp), f. & ef. 1-31-86 CD 9-1985, f. & ef. 7-26-85 CD 3-1985(Temp), f. & ef. 4-26-85 CD 34-1980, f. & ef. 11-7-80
291-001-0023 Requests to Receive Rulemaking Notices (1) Any person may request to be included in the department's electronic mailing list to receive notices of proposed rulemaking by sending a written request through the department’s website at https://www.oregon.gov/doc/rules-and-policies/Pages/Sign-Up-for-Rulemaking-Updates.aspx. (2) Any person may request to be included in the department's postal mailing list to receive notices of proposed rulemaking by sending a written request to the Department of Corrections Rules Coordinator via postal mail at 3723 Fairview Industrial Drive SE, Suite 200, Salem, Oregon 97302 or by sending a written request through the department’s website at https://www.oregon.gov/doc/rules-and-policies/Pages/Sign-Up-for-Rulemaking-Updates.aspx. Persons requesting paper copies of the department's notices of proposed rulemaking shall be required to pay fees before materials are mailed. The cost of duplication of rulemaking notices will be assessed as set forth in OAR 291-001-0080. Statutory/Other Authority: ORS 183.335 & 183.341 Statutes/Other Implemented: ORS 183.335 & 183.341 History: DOC 1-2026, adopt filed 01/20/2026, effective 02/01/2026
291-001-0025 Model Rules of Procedure Pursuant to ORS 183.341, the Department of Corrections adopts the Attorney General's Model Rules for Rulemaking, OAR Chapter 137, Division 1. Statutory/Other Authority: ORS 183.335 & 183.341 Statutes/Other Implemented: ORS 183.335 & 183.341 History: DOC 21-2020, amend filed 11/12/2020, effective 11/12/2020 DOC 4-2007, f. & cert. ef. 7-20-07 DOC 17-2003, f. & cert. ef. 12-12-03 DOC 9-2000, f. & cert. ef. 4-14-00 DOC 18-1999(Temp), f. & cert. ef. 10-28-99 thru 4-25-00 CD 5-1995, f. 2-22-95, cert. ef. 3-1-95 CD 1-1991, f. & cert. ef. 1-9-91 CD 9-1986, f. & ef. 4-18-86 CD 2-1986(Temp), f. & ef. 1-31-86 CD 9-1985, f. & ef. 7-26-85 CD 3-1985(Temp), f. & ef. 4-26-85 CD 34-1980, f. & ef. 11-7-80
291-001-0051 Adult in Custody Written Submissions on Proposed Rules Pursuant to ORS 183.335, the Department of Corrections limits participation by adults in custody in the proposed adoption, amendment, or repeal of any Department of Corrections administrative rule to written submissions. Statutory/Other Authority: ORS 183.335 & 183.341 Statutes/Other Implemented: ORS 183.335 & 183.341 History: DOC 21-2020, amend filed 11/12/2020, effective 11/12/2020 DOC 9-2000, f. & cert. ef. 4-14-00 DOC 18-1999(Temp), f. & cert. ef. 10-28-99 thru 4-25-00
291-001-0080 Requests for Copies and Fees for Copy Service (1) A person may request paper copies of the department’s notices of proposed rulemaking, temporary rules, or permanent rules by sending a written request to the Department of Corrections Rules Coordinator via postal mail at 3723 Fairview Industrial Drive SE, Suite 200, Salem, Oregon 97302 or by submitting a written request through the department’s website at https://www.oregon.gov/doc/rules-and-policies/Pages/Request-Paper-Copies.aspx. Persons requesting paper copies of the department's notices of proposed rulemaking, temporary rules, or permanent rules shall be required to pay fees before materials are mailed. The cost of duplication will be assessed as follows: (a) Each side $.12; and (b) Postage at current postal rates. (2) The department's notices of proposed rulemaking, temporary rules, and permanent rules are available for review on the department’s website at https://www.oregon.gov/doc/rules-and-policies/Pages/rules.aspx. (3) Adults in custody may request paper copies of the department’s notices of proposed rulemaking, temporary rules, or permanent rules in facility law libraries. To obtain paper copies of the department’s notices of proposed rulemaking, temporary rules, or permanent rules, adults in custody must submit a completed withdrawal request form (CD 28). (4) Adults in custody may request to review notices of proposed rulemaking, temporary rules, or permanent rules by submitting a law library request form. Statutory/Other Authority: ORS 183.335 & 183.341 Statutes/Other Implemented: ORS 183.335 & 183.341 History: DOC 1-2026, amend filed 01/20/2026, effective 02/01/2026 DOC 1-2024, minor correction filed 02/22/2024, effective 02/22/2024 DOC 21-2020, amend filed 11/12/2020, effective 11/12/2020 DOC 9-2000, f. & cert. ef. 4-14-00 DOC 18-1999(Temp), f. & cert. ef. 10-28-99 thru 4-25-00 CD 5-1995, f. 2-22-95, cert. ef. 3-1-95
291-005-0005 Authority, Purpose, and Policy (1) Authority: The authority for these rules is granted to the Director of the Department of Corrections in accordance with ORS 179.040, 423.020, 423.030, and 423.075. (2) Purpose: (a) The purpose of these rules is to establish policies, procedures, and guidelines for the security of Department of Corrections information systems. Any information system operated by the Department of Corrections, connected to the department’s network, or information contained in the department’s computer systems shall be protected by the security guidelines established in these rules. (b) The Department of Corrections intends to operate all information system assets, including multi-user computer systems, terminal devices, workstations, networks, mobile devices, and communications devices, in such a manner as to ensure: (A) The confidentiality, integrity, and availability of the department’s information, regardless of whether it is stored or processed on the department’s information systems or on other computer systems, including employee-owned personal computers or information systems operated by other agencies and organizations; (B) The protection of rights to privacy concerning personally identifiable information (PII) about a person which may be stored on Department of Corrections information systems; (C) Accessibility to information by department-authorized users or as required by state statute or legislation; (D) Denial of access to Department of Corrections information systems and information contained within for all unauthorized persons; and (E) Detection of misuse of Department of Corrections information systems, computer equipment, computer networks or information, and the intervention against attempted or actual system intrusions, information tampering, destruction, data exfiltration, or any other forms of misuse. (3) Policy: It is the policy of the Department of Corrections that computerized information shall be made secure from unauthorized access. Accepted supervision and management practices shall be required of employees to provide adequate security which restricts unauthorized access. Any external organization granted access to Department of Corrections information systems shall be required to follow and enforce the security guidelines of these rules. Statutory/Other Authority: ORS 179.040, 423.020, 423.030 & 423.075 Statutes/Other Implemented: ORS 179.040, 423.020, 423.030 & 423.075 History: DOC 5-2024, amend filed 04/29/2024, effective 04/29/2024 DOC 16-1999, f. 9-24-99, cert. ef. 10-1-99 CD 10-1997, f. & cert. ef. 6-20-97 CD 24-1992, f. 11-24-92, cert. ef. 12-1-92 CD 12-1986, f. & ef. 6-30-86 CD 38-1985, f. & ef. 8-16-85 CD 7-1981, f. & ef. 4-17-81 CD 5-1978, f. 2-15-78, ef. 2-16-78
291-005-0015 General (1) These rules cover the following assets of the department: (a) Any and all information regarding or related to the department’s business and mission, where that information is stored as data contained in or on any information system or is produced for display and review by that system. (A) Data may be recorded on different media, such as magnetic drives (hard disk drive (HDD) or floppy), optical disks (compact disk (CD) or digital versatile disk (DVD), semiconductor drives (solid state drives (SSD) or flash), and a variety of printed output, etc. (B) This data may be stored, processed, accessed, or displayed on any number of computer systems including, but not limited to, those owned and operated by the department, contractors, or consultants. Personally-owned devices are not authorized to store or process agency data. (b) The information systems equipment, including the computer hardware and software, peripheral devices, network components, data communications devices, terminals, stand-alone computers, and printers which are owned, leased, managed, or operated by the department to collect, store, process, maintain, disseminate, dispose of, or display information. (c) Access to and use of the department’s information systems. (2) These rules enable the agency to mitigate the potential loss of data from misuse of user accounts. Further prevention, mitigation, and remediation efforts are explained in agency policies and procedures as well as the State of Oregon Security Plan and State of Oregon Information and Cyber Security Standards. Statutory/Other Authority: ORS 179.040, 423.020, 423.030 & 423.075 Statutes/Other Implemented: ORS 179.040, 423.020, 423.030 & 423.075 History: DOC 5-2024, amend filed 04/29/2024, effective 04/29/2024 DOC 16-1999, f. 9-24-99, cert. ef. 10-1-99 CD 10-1997, f. & cert. ef. 6-20-97 CD 24-1992, f. 11-24-92, cert. ef. 12-1-92 CD 12-1986, f. & ef. 6-30-86 CD 38-1985, f. & ef. 8-16-85 CD 7-1981, f. & ef. 4-17-81
291-005-0035 Termination of Access (1) Notice of termination of employment with the agency shall result in retirement of the individual’s user account(s). Prompt notice of termination shall be sent to the Department of Corrections ISO or designee by the Employee Services manager or designee who handles user authorization. This procedure also applies to users from external organizations, Oregon Corrections Enterprises, contractors, and volunteers. (2) Functional unit managers or their designees shall review a list of user accounts from their respective units annually to ensure accounts are legitimate. Information Technology Services (ITS) shall provide the list. (3) Managers of external users shall review a list of users annually and confirm those needing continued access. ITS shall provide the list. (4) Newly created user profiles that are not used within 45 days will be removed. (5) User profiles for deceased employees shall be immediately disabled upon notification. Notification is provided to manager and site contact. If no response is received from the manager or site contact within 14 days, the profile will be deleted. (6) Users and managers of existing profiles that are inactive for a period of 45 days will be sent notification by the Department of Corrections ISO or designee to confirm continued need for access. If there is no response within 10 business days, the profile will be disabled. Disabled accounts will be deleted 30 days after disablement, unless otherwise noted on the account. Statutory/Other Authority: ORS 179.040, 423.020, 423.030 & 423.075 Statutes/Other Implemented: ORS 179.040, 423.020, 423.030 & 423.075 History: DOC 5-2024, amend filed 04/29/2024, effective 04/29/2024 DOC 11-2000, f. & cert. ef. 6-19-00 DOC 23-1999(Temp), f. & cert. ef. 12-22-99 thru 6-19-00 DOC 16-1999, f. 9-24-99, cert. ef. 10-1-99 CD 10-1997, f. & cert. ef. 6-20-97 CD 24-1992, f. 11-24-92, cert. ef. 12-1-92 CD 12-1986, f. & cert. ef. 6-30-86 CD 38-1985, f. & cert. ef. 8-16-85 CD 7-1981, f. & cert. ef. 4-17-81
291-005-0045 Remote Access (1) Authorized persons may be granted access to Department of Corrections information systems by means of remote connection on a need-to-use basis. Such access shall be via the same user identification and password issued for local access. (2) Remote access is permitted by means of user identification and password only. The use of open user accounts and automatic sign-on are not permitted. (3) ITS standards and guidelines require additional security controls, such as MFA, virtual private network (VPN), geolocation verification, or other forms of secure connection to be used whenever telecommuting is authorized. Statutory/Other Authority: ORS 179.040, 423.020, 423.030 & 423.075 Statutes/Other Implemented: ORS 179.040, 423.020, 423.030 & 423.075 History: DOC 5-2024, amend filed 04/29/2024, effective 04/29/2024 DOC 16-1999, f. 9-24-99, cert. ef. 10-1-99 CD 10-1997, f. & cert. ef. 6-20-97 CD-24-1992, f. 11-24-92, cert. ef. 12-1-92
291-005-0055 User Password Management and Responsibilities (1) Authorized users shall comply with the following rules to create and manage their passwords: (a) All user accounts shall be protected by use of a password. This password shall be generated by and known only to the individual user. (b) The Department of Corrections ISO shall determine password characteristics. (2) Password Duration: All user passwords shall be subject to automatic retirement at a maximum set time period in the standards and guidelines. Authorized users may change passwords as often as they wish during this period and are encouraged to do so. (3) Password Violation: Violation of these rules is a disciplinary matter with consequences up to and including dismissal. (4) A user account shall be automatically disabled when there have been more than five consecutive invalid logon attempts by a user during a 120-minute time period. (5) The Department of Corrections ISO or designee may re-enable a disabled password. Statutory/Other Authority: ORS 179.040, 423.020, 423.030 & 423.075 Statutes/Other Implemented: ORS 179.040, 423.020, 423.030 & 423.075 History: DOC 5-2024, amend filed 04/29/2024, effective 04/29/2024 DOC 16-1999, f. 9-24-99, cert. ef. 10-1-99 CD 10-1997, f. & cert. ef. 6-20-97 CD-24-1992, f. 11-24-92, cert. ef. 12-1-92
291-005-0065 Information Technology Services (ITS) Responsibilities for User Identification To implement user accountability, the following rules shall be strictly enforced by ITS: (1) Separation of Duties: (a) Separate personnel duties to minimize the potential for abuse of authorized privileges and risk of malevolent activity without collusion. Developers must not have unmonitored access to production environments; (b) Document separation of duties, including roles and permissions; and (c) Define system access authorization in support of separation of duties. (2) Employ the principle of least privilege allowing only authorized access for users, or processes acting on behalf of users, which are necessary to accomplish assigned tasks in accordance with organizational missions and business functions. (a) Authorize Access to Security Functions: (A) Explicitly authorize access to administrative privileges, including security functions and security relevant information; and (B) Establish procedures to maintain documentation of privileged access, including any elevated privileges, and privileges that provide administrative access to network devices, operating systems, software application capabilities, or scripting tools. (b) Use of Non-privileged Access for Non-privileged Functions: Require that users of system accounts or roles, even those with access to privileged or administrative functions, use non-privileged accounts or roles when accessing systems for non-privileged or non-security functions. (c) Privileged Accounts: Restrict privileged accounts to authorized individuals with a need for elevated privileges. (d) Review of User Privileges: (A) Ensure that privileges assigned to users are reviewed to validate the need for such privileges: (i) Initially upon hire; (ii) Any time assigned job duties change; (iii) Any time there is a change in job position; (iv) Annually thereafter. (B) Reassign or remove privileges as necessary, to correctly reflect organizational mission and business needs. (e) Audit the Execution and Use of Privileged Functions. (f) Prohibit Non-privileged Users from Executing Privileged Functions: Prevent non-privileged users from executing privileged functions including disabling, circumventing, or altering implemented security safeguards and countermeasures. (3) Shared or Group Account Credentials: Shared or group account credentials must be changed when members leave the group. (4) Open user accounts are not allowed. An open user account is a log-on username for which there is no password, or for which the password is publicly known. Statutory/Other Authority: ORS 179.040, 423.020, 423.030 & 423.075 Statutes/Other Implemented: ORS 179.040, 423.020, 423.030 & 423.075 History: DOC 5-2024, amend filed 04/29/2024, effective 04/29/2024 DOC 16-1999, f. 9-24-99, cert. ef. 10-1-99 CD 10-1997, f. & cert. ef. 6-20-97 CD-24-1992, f. 11-24-92, cert. ef. 12-1-92
291-005-0075 Physical Security Guidelines (1) Computer equipment shall be protected from unnecessary risk of access, damage, or theft. (2) Facility access must be controlled using physical access control devices such as keys, locks, combinations, radio-frequency identification (RFID) card readers, etc. (a) All facilities must have at least one physical security control protecting it from unauthorized access, damage, or interference; (b) Facilities that process or store information classified at Level 3 (Restricted) or higher must employ multiple layers of physical security controls; and (c) For areas used to process or store information classified at Level 3 (Restricted) or higher, access logs for controlled entry points must be maintained. (3) An annual evaluation of physical security for information systems used by staff shall be conducted by the Department of Corrections ISO or their designee. The findings of this evaluation shall be used to enhance the physical security of the agency systems as needed. (4) Physical security guidelines for information systems shall be developed by ITS and reviewed and approved by the Department of Corrections ISO. Statutory/Other Authority: ORS 179.040, 423.020, 423.030 & 423.075 Statutes/Other Implemented: ORS 179.040, 423.020, 423.030 & 423.075 History: DOC 5-2024, amend filed 04/29/2024, effective 04/29/2024 DOC 16-1999, f. 9-24-99, cert. ef. 10-1-99 CD 10-1997, f. & cert. ef. 6-20-97 CD-24-1992, f. 11-24-92, cert. ef. 12-1-92