Florida Administrative Code › 60 - DEPARTMENT OF MANAGEMENT SERVICES › 60GG - Florida Digital Service › Chapter 60GG-2 - STATE OF FLORIDA CYBERSECURITY STANDARDS › Section 60GG-2.003 - Protect

Current through Reg. 50, No. 138; July 16, 2024
The protect function of the SFCS is visually represented as
				  such:
Function
Category
Subcategory
Protect (PR)
Identity Management, Authentication, and Access
							 Control (AC)
PR.AC-1: Issue, manage, verify, revoke, and audit
							 identities and credentials for authorized devices, processes, and Users
PR.AC-2: Manage and protect physical access to
							 assets
PR.AC-3: Manage Remote Access
PR.AC-4: Manage access permissions and
							 authorizations, incorporate the principles of least privilege and Separation of
							 Duties
PR.AC-5: Protect network integrity, by incorporating
							 network segregation and segmentation where appropriate
PR.AC-6: Proof and bond identities to credentials,
							 asserting in interactions when appropriate (see Token Control
							 definition)
PR.AC-7: Authenticate credentials assigned to Users,
							 devices, and other assets commensurate with the risk of the transaction.
Awareness and Training (AT)
PR.AT-1: Inform and train all Users
PR.AT-2: Ensure that Privileged Users understand
							 roles and responsibilities
PR.AT-3: Ensure that third-party Stakeholders
							 understand roles and responsibilities
PR.AT-4: Ensure that senior executives understand
							 roles and responsibilities
PR.AT-5: Ensure that physical and cybersecurity
							 personnel understand their roles and responsibilities
Data Security
(DS)
PR.DS-1: Protect Data-at-rest
PR.DS-2: Protect data-in-transit
PR.DS-3: Formally manage assets managed throughout
							 removal, transfers, and disposition
PR.DS-4: Ensure that adequate capacity is maintained
							 to support availability needs
PR.DS-5: Implement data leak protection
							 measures
PR.DS-6: Use integrity checking mechanisms to verify
							 software, firmware, and information integrity
PR.DS-7: Logically or physically separate the
							 development and testing environment(s) from the production environment
PR.DS-8: Use integrity checking mechanisms to verify
							 hardware integrity
Information Protection Processes and
							 Procedures
PR.IP-1: Create and maintain a baseline configuration
							 that incorporates all security principles for information technology/industrial
							 control systems
PR.IP-2: Implement a System Development Life Cycle
							 (SDLC) to manage systems
PR.IP-3: Establish configuration change control
							 processes
PR.IP-4: Conduct, maintain, and test backups of
							 information
PR.IP-5: Meet policy and regulatory requirements that
							 are relevant to the physical operating environment for organizational
							 assets
PR.IP-6: Destroy data according to policy
PR.IP-7: Continuously improve protection
							 processes
PR.IP-8: Share effectiveness of protection
							 technologies with Stakeholders that should or must receive this
							 information
PR.IP-9: Establish and manage response plans
							 (Incident Response and Business Continuity) and recovery plans (Incident
							 Recovery and Disaster Recovery)
PR.IP-10: Test response and recovery plans
PR.IP-11: Include cybersecurity in human resources
							 practices (e.g., deprovisioning, personnel screening)
PR.IP-12: Develop and implement a vulnerability
							 management plan
Maintenance (MA)
PR.MA-1: Perform and log maintenance and repair of
							 organizational assets, with approved and controlled tools
PR.MA-2: Approve, log, and perform remote maintenance
							 of Agency assets in a manner that prevents unauthorized access
Protective Technology (PT)
PR.PT-1: Determine, document, implement, and review
							 audit/log records in accordance with policy
PR.PT-2: Protect and restrict Removable Media usage
							 according to policy
PR.PT-3: Incorporate the principle of least
							 functionality by configuring systems to provide only essential
							 capabilities
PR.PT-4: Protect communications and control
							 networks
PR.PT-5: Implement mechanisms (e.g., failsafe, load
							 balancing, hot swap) to achieve resilience requirements in normal and adverse
							 situations
(1) Access
				Control. Each Agency shall ensure that access to IT Resources is limited to
				authorized Users, processes, or devices, and to authorized activities and
				transactions. Specifically:
(a) Each Agency
				shall manage identities and credentials for authorized devices and Users
				(PR.AC-1). Control measures shall, at a minimum include authentication token(s)
				unique to the individual.
Agencies shall:
1.
				Require that all Agency-owned or approved computing devices, including Mobile
				Devices, use unique User Authentication.
2. Require Users to log off or lock their
				workstations prior to leaving the work area.
3. Require inactivity timeouts that log-off
				or lock workstations or sessions.
4. Locked workstations or sessions must be
				locked in a way that requires User Authentication with an authentication
				token(s) unique to the individual User to disengage.
5. When passwords are used as the sole
				authentication token, require Users to use Complex Passwords.
6. Address responsibilities of information
				stewards that include administering access to systems and data based on the
				documented authorizations and facilitate periodic review of access rights with
				information owners. Frequency of reviews shall be based on system
				categorization or assessed risk.
7.
				Establish access disablement and notification timeframes for Worker
				separations. The Agency will identify the appropriate person in the IT unit to
				receive notification. Notification timeframes shall consider risks associated
				with system access post-separation.
8. Ensure IT access is removed when the IT
				Resource is no longer required.
9.
				Require multi-factor authentication (MFA) for access to networks or
				applications that have a categorization of moderate, high, or contain exempt,
				or confidential and exempt, information. This excludes externally hosted
				systems designed to deliver services to Agency Customers where the Agency
				documents the analysis and the risk steering workgroup accepts the associated
				risk.
10. Require MFA for access to
				Privileged Accounts.