California Code of Regulations › Title 2 - Administration › Division 7 - Secretary of State › Chapter 1 - Voter Registration › Article 2.5 - Statewide Voter Registration System › Section 19064 - County Security

Current through Register 2024 Notice Reg. No. 28, July 12, 2024
(a)
				  Each county shall protect the confidentiality, integrity, and availability of
				  the data and the election information system authorized to process, store, and
				  transmit voter registration data. This system shall utilize system hardening
				  and resilient architecture by means of redundancy, high availability, or other
				  fault-tolerant methodologies.
(b)
				  Each county shall provide annual privacy and security awareness training to all
				  staff and contractors, if any, utilizing its county voter registration and
				  election information system in accordance with State Administrative Manual
				  sections 5320 -- 5320.2 and the Information
				  Practices Act of 1977 (Civil Code section
				  1798,
et seq.
).
(c) Each
				  county shall complete a security assessment of its election information system
				  prior to a statewide primary election. The security assessment shall evaluate
				  the:
(1) Active management (inventory,
				  tracking, and correction) of all hardware devices on the network so that only
				  authorized devices are given access, and unauthorized and unmanaged devices are
				  found and prevented from gaining access.
(2) Active management (inventory, tracking,
				  and correction) of all software on the network so that only authorized software
				  is installed and can execute, and unauthorized and unmanaged software is found
				  and prevented from installation or execution.
(3) Establishment, implementation, and active
				  management (tracking, reporting, and correction) of the security configuration
				  of laptops, servers, and workstations in order to prevent attackers from
				  exploiting vulnerable services and settings.
(4) Continuous acquisition, assessment, and
				  action on new threats in order to identify vulnerabilities, and to remediate
				  and minimize opportunity for attacks.
(5) Tracking, control, prevention, and
				  correction of the use, assignment, and configuration of administrative
				  privileges on computers, networks, and applications.
(6) Collection, active management, and
				  analysis of audit logs of events that could help detect, understand, or recover
				  from an attack.
(7) Minimization of
				  opportunities for attackers to manipulate human behavior through their
				  interaction with web browsers and e-mail systems.
(8) Control of the installation, spread, and
				  execution of malicious code at multiple points in the election information
				  system, while optimizing the use of automation to enable rapid updating of
				  defense, data gathering, and corrective action.
(9) Active management (tracking, control, and
				  correction) of the ongoing operational use of ports, protocols, and services on
				  networked devices in order to minimize vulnerabilities available for
				  attack.
(10) Proper backup of
				  critical data to allow for timely recovery. Backups shall be made at least
				  every 24 hours. Backups for counties with more than 50,000 registered voters as
				  of the last Report of Registration are recommended more frequently. Each county
				  shall review critical data backup and recovery procedures to ensure the backups
				  are not stored on the same servers hosting the county voter registration and
				  election information system, and that restoration procedures are detailed and
				  complete.
(11) Establishment,
				  implementation, and active management (tracking, reporting, and correction) of
				  the security configuration of network infrastructure devices in order to
				  prevent attacks exploiting vulnerable services and settings.
(12) Detection, prevention, and correction of
				  the flow of information transferring between networks of different trust levels
				  with a focus on security-damaging data.
(13) Prevention of data exfiltration,
				  mitigating the effects of exfiltrated data, and ensuring the privacy and
				  integrity of sensitive information.
(14) Tracking, controlling, preventing,
				  correcting, and securing access to critical assets (e.g., information,
				  resources, systems) according to the formal determination of which persons,
				  computers, and applications have a need and right to access these critical
				  assets.
(15) Tracking, controlling,
				  preventing, and correcting the security use of wireless local area networks,
				  access points, and wireless client systems.
(16) Active management of the life-cycle of
				  system and application accounts -- their creation, use, dormancy, deletion --
				  in order to minimize opportunities for attackers to leverage them.
(17) Identification of the specific
				  knowledge, skills, and abilities needed to support defense of the election
				  information system; development and execution of an integrated plan to assess,
				  identify and remediate gaps, through policy, organizational planning, training,
				  and awareness programs for all functional roles in the organization.
(18) Active management of the security
				  life-cycle of all in-house developed and acquired software in order to prevent,
				  detect, and correct security weaknesses.
(19) Protection of the organization's
				  information, by developing and implementing an incident response infrastructure
				  (e.g., plans, defined roles, training, communications, and management
				  oversight).
(20) Testing of the
				  overall strength of an organization's defenses (technology, processes, and
				  people) by simulating the objectives and actions of an
				  attacker.