Florida Administrative Code › 60 - DEPARTMENT OF MANAGEMENT SERVICES › 60GG - Florida Digital Service › Chapter 60GG-2 - STATE OF FLORIDA CYBERSECURITY STANDARDS › Section 60GG-2.002 - Identify

Current through Reg. 50, No. 138; July 16, 2024
The identify function of the FCS is visually represented as
				  such:
Function
Category
Subcategory
Identify (ID)
Asset Management (AM)
ID.AM-1: Inventory Agency physical devices and
							 systems
ID.AM-2: Inventory Agency software platforms and
							 applications
ID.AM-3: Map Agency communication and data
							 flows
ID.AM-4: Catalog interdependent external information
							 systems
ID.AM-5: Prioritize IT Resources based on
							 classification, criticality, and business value
ID.AM-6: Establish cybersecurity roles and
							 responsibilities for the entire Workforce and third-party Stakeholders
Business Environment
(BE)
ID.BE-1: Identify and communicate the Agency's role
							 in the business mission/processes
ID.BE-2: Identify and communicate the Agency's place
							 in Critical Infrastructure and its Industry Sector to Workers
ID.BE-3: Establish and communicate priorities for
							 Agency mission, objectives, and activities
ID.BE-4: Identify dependencies and critical functions
							 for delivery of critical services
ID.BE-5: Implement resiliency requirements to support
							 the delivery of critical services for all operating states (e.g., normal
							 operations, under duress, during recovery)
Governance
(GV)
ID.GV-1: Establish and communicate an organizational
							 cyber security policy
ID.GV-2: Coordinate and align cybersecurity roles and
							 responsibilities with internal roles and External Partners
ID.GV-3: Understand and manage legal and regulatory
							 requirements regarding cybersecurity, including privacy and civil liberties
							 obligations
ID.GV-4: Ensure that governance and risk management
							 processes address cybersecurity risks
Risk Assessment
(RA)
ID.RA-1: Identify and document asset
							 vulnerabilities
ID.RA-2: Receive cyber Threat intelligence from
							 information sharing forums and sources
ID.RA-3: Identify and document Threats, both internal
							 and external
ID.RA-4: Identify potential business impacts and
							 likelihoods
ID.RA-5: Use Threats, vulnerabilities, likelihoods,
							 and impacts to determine risk
ID.RA-6: Identify and prioritize risk
							 responses
Risk Management
Strategy
(RM)
ID.RM-1: Establish, manage, and ensure organizational
							 Stakeholders understand the approach to be employed via the risk management
							 processes
ID.RM-2: Determine and clearly express organizational
							 risk tolerance
ID.RM-3: Ensure that the organization's determination
							 of risk tolerance is informed by its role in Critical Infrastructure and sector
							 specific risk analysis
Supply Chain Risk Management (SC)
ID.SC-1: Establish management processes to identify,
							 establish, assess, and manage cyber supply chain risk which are agreed to by
							 organizational Stakeholders
ID.SC-2: Identify, prioritize, and assess Suppliers
							 and third-party providers of information systems, components, and services
							 using a cyber supply chain risk assessment process
ID.SC-3: Require Suppliers and third-party providers
							 (by contractual requirement when necessary) to implement appropriate measures
							 designed to meet the objectives of the organization's information security
							 program or cyber supply chain risk management plan
ID.SC-4: Routinely assess Suppliers and third-party
							 providers to confirm that they are meeting their contractual obligations by
							 conducting reviews of audits, summaries of test results, or other equivalent
							 evaluations of Suppliers/providers
ID.SC-5: Conduct response and recovery planning and
							 testing with Suppliers and third-party providers
(1) Asset
				Management. Each agency shall ensure that IT Resources are identified and
				managed. Identification and management shall be consistent with the IT
				Resource's relative importance to agency objectives and the organization's risk
				strategy. Specifically, each agency shall:
(a)
				Ensure that physical devices and systems within the organization are
				inventoried and managed (ID.AM-1).
(b) Ensure that software platforms and
				applications within the organization are inventoried and managed
				(ID.AM-2).
(c) Ensure that
				organizational communication and data flows are mapped and systems are designed
				or configured to regulate information flow based on data classification
				(ID.AM-3). Each Agency shall:
1. Establish
				procedures that ensure only Agency-owned or approved IT Resources are connected
				to the Agency internal network and resources.
2. Design and document its information
				security architecture using a defense-in-breadth approach. Design and
				documentation shall be assessed and updated periodically based on an
				Agency-defined, risk-driven frequency that considers potential Threat vectors
				(i.e., paths or tools that a Threat actor may use to attack a
				target).
3. Consider diverse
				Suppliers when designing the information security
				architecture.
(d) Each
				Agency shall ensure that interdependent external information systems are
				catalogued (ID.AM-4). Agencies shall:
1.
				Verify or enforce required security controls on interconnected external IT
				Resources in accordance with the information security policy or security
				plan.
2. Implement service level
				agreements for non-Agency provided technology services to ensure appropriate
				security controls are established and maintained.
3. For non-interdependent external IT
				Resources, execute information sharing or processing agreements with the entity
				receiving the shared information or hosting the external system in receipt of
				shared information.
4. Restrict or
				prohibit portable storage devices either by policy or a technology that
				enforces security controls for such devices.
5. Authorize and document inter-agency system
				connections.
6. Require that (e.g.,
				contractually) external service providers adhere to Agency security
				policies.
7. Document Agency
				oversight expectations, and periodically monitor provider
				compliance.
(e) Each
				Agency shall ensure that IT Resources (hardware, data, personnel, devices and
				software) are categorized, prioritized, and documented based on their
				classification, criticality, and business value (ID.AM-5). Agencies shall:
1. Perform a criticality analysis for each
				categorized IT Resource and document the findings of the analysis
				conducted.
2. Designate an
				authorizing official for each categorized IT Resource and document the
				authorizing official's approval of the security categorization.
3. Create a contingency plan for each
				categorized IT Resource. The contingency plan shall be based on resource
				classification and identify related cybersecurity roles and
				responsibilities.
4. Identify and
				maintain a reference list of exempt, and confidential and exempt Agency
				information or software and the associated applicable state and federal
				statutes and rules.
(f)
				Establish cybersecurity roles and responsibilities for the entire Workforce and
				third-party Stakeholders (ID.AM-6). Each Agency is responsible for:
1. Informing Workers that they are
				responsible for safeguarding their passwords and other Authentication
				methods.
2. Informing Workers that
				they shall not share their Agency accounts, passwords, personal identification
				numbers, security tokens, smart cards, identification badges, or other devices
				used for identification and Authentication purposes.
3. Informing Workers that use, or oversee or
				manage Workers that use, IT equipment that they shall report suspected
				unauthorized activity, in accordance with Agency-established Incident reporting
				procedures.
4. Informing Users that
				they shall take precautions that are appropriate to protect IT Resources in
				their possession from loss, theft, tampering, unauthorized access, and damage.
				Consideration will be given to the impact that may result if the IT Resource is
				lost, and safety issues relevant to protections identified in this
				subsection.
5. Informing Users of
				the extent that they will be held accountable for their activities.
6. Informing Workers that they have no
				reasonable expectation of privacy with respect to Agency-owned or
				Agency-managed IT Resources.
7.
				Ensuring that monitoring, network sniffing, and related security activities are
				only to be performed by Workers who have been assigned security-related
				responsibilities either via their approved position descriptions or tasks
				assigned to them.
8. Appointing an
				Information Security Manager (ISM). Agency responsibilities related to the ISM
				include:
a. Notifying FL[DS] of ISM
				designations and redesignations.
b.
				Specifying ISM responsibilities in the ISM position description.
c. Establishing an information security
				program that includes information security policies, procedures, standards, and
				guidelines; an information security awareness program; an information security
				risk management process, including the comprehensive Risk Assessment required
				by section  282.318, F.S.; a Cybersecurity
				Incident Response Team; and a disaster recovery program that aligns with the
				Agency's COOP Plan.
d. Each Agency
				ISM shall be responsible for the information security program
				plan.
9. Performing
				background checks and ensuring that a background investigation is performed on
				all individuals hired as IT Workers with access to information processing
				facilities, or who have system, database, developer, network, or other
				administrative capabilities for systems, applications, or servers with risk
				categorization of moderate-impact or higher. These positions often, if not
				always, have privileged access. As such, in addition to Agency-required
				background screening, background checks conducted by Agencies shall include a
				federal criminal history check that screens for felony convictions that concern
				or involve the following:
a. Computer related
				or IT crimes;
b. Identity theft
				crimes;
c. Financially-related
				crimes, such as: fraudulent practices, false pretenses and frauds, credit card
				crimes;
d. Forgery and
				counterfeiting;
e. Violations
				involving checks and drafts;
f.
				Misuse of medical or personnel records; and,
g. Theft.
Each Agency shall establish appointment selection
				  disqualifying criteria for individuals hired as IT Workers that will have
				  access to information processing facilities, or who have system, database,
				  developer, network, or other administrative capabilities for systems,
				  applications, or servers with risk categorization of moderate-impact or
				  higher.