reglab/statecodes huggingface dataset:
New Mexico Administrative Code › Title 1 - GENERAL GOVERNMENT ADMINISTRATION › Chapter 12 - INFORMATION TECHNOLOGY › Part 11 - ENTERPRISE ARCHITECTURE › Section 1.12.11.8 - ABBREVIATIONS AND ACRONYMS

Current through Register Vol. 35, No. 13, July 16, 2024
A.
ARIN
means American registry
				for internet numbers
B.
ARP
means address resolution protocol
C.
CIO
means chief information
				officer
D.
EA
means
				enterprise architecture
E.
IETF
means internet engineering task force
F.
IP
means means internet
				protocol
G.
IPSec
means
				IP security
H.
Ipv4
means version 4 of the internet protocol
I.
ISDN
means integrated services
				digital network
J.
IT
means information technology
K.
ITC
means information
				technology commission
L.
ITEA
means information technology enterprise
				architecture
M.
LAN
means local area network
N.
NAT
means network address translation
O.
NM
means New Mexico
P.
NT
means new technology
				(predecessor of windows 2000 server)
Q.
OCIO
means office of chief
				information officer
R.
RFC
means request for comments
S.
SANS
means system
				administration, audit, network, security, or SANS institute
T.
SoNM
means state of New
				Mexico
U.
TCP
means
				transmission control protocol
V.
VPN
means virtual private
				networks
W.
WAN
means
				wide area network
New Mexico Administrative Code › Title 1 - GENERAL GOVERNMENT ADMINISTRATION › Chapter 12 - INFORMATION TECHNOLOGY › Part 11 - ENTERPRISE ARCHITECTURE › Section 1.12.11.15 - NETWORK

Current through Register Vol. 35, No. 13, July 16, 2024
IP addressing.
A.
				The enterprise service provider will assign, document, and manage all address
				blocks of private, public, and reserved address spaces.
B. Agencies will manage and control all
				addresses within their block. Agencies will be required to submit current and
				accurate IP sub-net assignments and change control documentation to the
				enterprise service provider database on a real-time basis.
C. An agency core router will be configured
				to route only 10.0 and 164.64.0.0 addressing.
D. Private class A (RFC 1918) IPv4 is to be
				the named standard for all agencies and core networks to extend networks within
				the state that do not want to be routed to external sources with subnets of
				class B and class C.
E. Public
				Address.
(1) In the event that access is
				required to route to an external source, addresses must be public.
(2) The only public address range that will
				be advertised by the SoNM to the internet is the 164.64.0.0 class B address
				space assigned by ARIN.
New Mexico Administrative Code › Title 1 - GENERAL GOVERNMENT ADMINISTRATION › Chapter 12 - INFORMATION TECHNOLOGY › Part 11 - ENTERPRISE ARCHITECTURE › Section 1.12.11.16 - SECURITY

Current through Register Vol. 35, No. 13, July 16, 2024
Password policy.
A.
				This policy establishes a standard for creation of strong passwords, the
				protection of those passwords, and the frequency of change.
B. Passwords must be at least eight (8)
				alphanumeric characters long.
C.
				All system-level passwords (e.g., root, enable, NT admin, application
				administration accounts, etc.) must be changed at least every 6 months.
				Password changes will be addressed immediately by the password authority when
				personnel changes are made to staff that have root access.
D. Passwords must not be stored on
				unencrypted or other insecure forms (i.e., word document, post-its, labels,
				etc.).
E. All user-level passwords
				(e.g., email, web, desktop computer, etc.) must be changed periodically. The
				minimum change interval is every 4 months.
F. User accounts that have system-level
				privileges granted through group memberships or programs such as "sudo" must
				have a unique password from all other accounts held by that user.
G. Passwords must not be inserted into email
				messages or other forms of electronic communication.
H. All user-level and system-level passwords
				must conform to the guidelines described below.
I. A password authority shall be established
				by the agency CIO or IT lead to disseminate passwords, facilitate as the
				gatekeeper for system-level passwords, and be the point of contact for
				password-related security breaches. Password may only be obtained or requested
				from the password authority of the agency.
New Mexico Administrative Code › Title 1 - GENERAL GOVERNMENT ADMINISTRATION › Chapter 12 - INFORMATION TECHNOLOGY › Part 12 - APPLICATION SOFTWARE SELECTION › Section 1.12.12.3 - STATUTORY AUTHORITY

Current through Register Vol. 35, No. 13, July 16, 2024
Sections
				  15-1C-5 and
				  15-1C-8 NMSA,
				  1978.
New Mexico Administrative Code › Title 1 - GENERAL GOVERNMENT ADMINISTRATION › Chapter 12 - INFORMATION TECHNOLOGY › Part 12 - APPLICATION SOFTWARE SELECTION › Section 1.12.12.6 - OBJECTIVE

Current through Register Vol. 35, No. 13, July 16, 2024
The purpose of this rule is to select enterprise-wide
				  programs, applications, and application systems that do not inhibit or create
				  barriers to necessary interaction, collaboration and information sharing among
				  governmental agencies.
New Mexico Administrative Code › Title 1 - GENERAL GOVERNMENT ADMINISTRATION › Chapter 12 - INFORMATION TECHNOLOGY › Part 12 - APPLICATION SOFTWARE SELECTION › Section 1.12.12.7 - DEFINITIONS

Current through Register Vol. 35, No. 13, July 16, 2024
A.
"Application"
means the software, including code and processes
				that address specific business needs; separate from the operating system
				software.
B.
"Commercial off
				the shelf (COTS)"
means commercially available software designed to meet
				specific business needs and generally maintained by a commercial
				vendor.
C.
"Enterprise-wide"
means effecting the entire
				organization.
D.
"Platform"
means the modules of computer code that perform
				specific functions with the application.
E.
"Program"
means the modules
				of computer code that perform specific functions with the
				application.
F.
"Source
				code"
means the computer code from which the application and programs
				may be recovered.
G.
"Total
				cost of ownership (TCO)"
means all costs to purchase, implement and
				train users on an application system. The TCO also includes ongoing
				maintenance, in service training and network costs.
New Mexico Administrative Code › Title 1 - GENERAL GOVERNMENT ADMINISTRATION › Chapter 12 - INFORMATION TECHNOLOGY › Part 12 - APPLICATION SOFTWARE SELECTION › Section 1.12.12.8 - POLICY

Current through Register Vol. 35, No. 13, July 16, 2024
When selecting software, the following principles
				  apply.
A. The user base of the
				particular "sourced" application is growing, commercial interest and support is
				evident and a certified peer support group is active.
B. Source code and application platforms are
				well supported and business functionality can be clearly
				demonstrated.
C. A timely schedule
				has been established for new version updates and bug fixes for the
				application.
D. Proposals from
				state entities must demonstrate that an infrastructure of support exists to
				manage applications, implementation and ongoing maintenance.
E. Total cost of ownership for proposed
				application must be equivalent to or less than a commercial solution and should
				present a value driven methodology, TCO (as developed elsewhere) must always
				address costs of implementation, ongoing technical support, training, etc. COTS
				procurement must be equal to or less than the cost of in-house developed
				systems.
F. Training for the
				implementation and ongoing use of the software is readily available and can be
				provided on a reasonable schedule and cost.
G. Applications development practices are of
				high quality, well-documents and easily applied.
H. The vendor is financially stable and could
				be expected to remain a viable entity under state guidelines.
I. In-house developed application software
				will adhere to items B through G above.
New Mexico Administrative Code › Title 1 - GENERAL GOVERNMENT ADMINISTRATION › Chapter 12 - INFORMATION TECHNOLOGY › Part 20 - INFORMATION SECURITY OPERATION MANAGEMENT › Section 1.12.20.2 - SCOPE

Current through Register Vol. 35, No. 13, July 16, 2024
This rule applies to all executive branch agencies, and any
				  other state entity which utilizes the state information technology (IT)
				  infrastructure, contractors and subcontractors and any other non-state
				  government staff members, and outsourced third parties, who have access to,
				  store, or manage state government information on site at a state agency or
				  off-site, as approved by a state agency.
New Mexico Administrative Code › Title 1 - GENERAL GOVERNMENT ADMINISTRATION › Chapter 12 - INFORMATION TECHNOLOGY › Part 20 - INFORMATION SECURITY OPERATION MANAGEMENT › Section 1.12.20.3 - STATUTORY AUTHORITY

Current through Register Vol. 35, No. 13, July 16, 2024
NMSA 1978 Section
				  9-27-6
				  F (3) and
				  9-27-6
				  I (1).
New Mexico Administrative Code › Title 1 - GENERAL GOVERNMENT ADMINISTRATION › Chapter 12 - INFORMATION TECHNOLOGY › Part 20 - INFORMATION SECURITY OPERATION MANAGEMENT › Section 1.12.20.5 - EFFECTIVE DATE

Current through Register Vol. 35, No. 13, July 16, 2024
April 14, 2010, unless a later date is cited at the end of a
				  section.
New Mexico Administrative Code › Title 1 - GENERAL GOVERNMENT ADMINISTRATION › Chapter 12 - INFORMATION TECHNOLOGY › Part 20 - INFORMATION SECURITY OPERATION MANAGEMENT › Section 1.12.20.6 - OBJECTIVE

Current through Register Vol. 35, No. 13, July 16, 2024
The purpose of this rule is to establish security operation
				  management practices for executive branch agencies and any other state entity
				  which utilizes the state information technology (IT) infrastructure in the
				  operation of their information technology (IT) systems and
				  infrastructure/networks. This rule encompasses all systems, automated and
				  manual, for which the state has administrative responsibility, including
				  systems managed or hosted by third parties on behalf of a state
				  agency.
New Mexico Administrative Code › Title 1 - GENERAL GOVERNMENT ADMINISTRATION › Chapter 12 - INFORMATION TECHNOLOGY › Part 20 - INFORMATION SECURITY OPERATION MANAGEMENT › Section 1.12.20.8 - DOCUMENTATION OF SECURITY OPERATIONS

Current through Register Vol. 35, No. 13, July 16, 2024
A. All agency IT technical operations shall
				have documented security operating instructions, management processes, and
				formal incident management procedures in place that define roles and
				responsibilities of individuals who operate or use agency IT technical
				operations and facilities.
B. Where
				one agency provides a server, application, or network services to another
				agency, operational and management responsibilities shall be coordinated by the
				CIOs of both agencies.
C. All
				agencies shall develop procedures for conducting background investigations on
				IT employees or contractors as required by state law, NMSA 1978
				9-27-6
				C (15) and D.
New Mexico Administrative Code › Title 1 - GENERAL GOVERNMENT ADMINISTRATION › Chapter 12 - INFORMATION TECHNOLOGY › Part 20 - INFORMATION SECURITY OPERATION MANAGEMENT › Section 1.12.20.9 - SEGREGATION OF SECURITY DUTIES

Current through Register Vol. 35, No. 13, July 16, 2024
Segregation of duties is required to reduce the risk of
				  accidental or deliberate damage to the state or agency IT system through misuse
				  by a person or persons. In small agencies in which separation of duties is
				  difficult to achieve, with the approval of DoIT, the agency shall implement
				  compensatory controls including, but not limited to, actively monitoring its IT
				  operations, audit trails, and by regularly documented management
				  supervision.
New Mexico Administrative Code › Title 1 - GENERAL GOVERNMENT ADMINISTRATION › Chapter 12 - INFORMATION TECHNOLOGY › Part 20 - INFORMATION SECURITY OPERATION MANAGEMENT › Section 1.12.20.10 - NETWORK MANAGEMENT

Current through Register Vol. 35, No. 13, July 16, 2024
All agencies shall implement a range of network controls to
				  maintain security in its trusted, internal network, and to ensure the
				  protection of connected services and networks. Such controls help prevent
				  unauthorized access and use of the agencies' private networks. The following
				  controls, at minimum, shall be implemented:
A. individuals with operational
				responsibility for networks shall be separate from those with computer
				operations responsibility; responsibilities and procedures for remote access
				shall be established;
B. controls,
				such as data encryption, shall be implemented to safeguard data integrity and
				the confidentiality of data passing over public networks (internet);
C. all client-based VPN connections shall
				have split tunneling disabled; VPN connections to the agency are only permitted
				from agency managed VPN devices;
D.
				agencies' networks shall implement private address routing to public addresses
				when sending over the internet to minimize the exposure of public routable
				addresses;
E. firewall policies
				shall be configured to accept only inbound and outbound data traffic which is
				required based on business needs; all other data traffic should be
				denied;
F. firewall policies shall
				take into account the source and destination of the traffic in addition to the
				content;
G. data traffic with
				invalid or private addresses shall be default blocked from delivery;
H. proposed modifications to network and
				security equipment must be requested and approved for implementation through
				the agency change management procedure;
I. to prevent unauthorized modifications of
				the firewall configuration, the firewall administrator must review the firewall
				configuration quarterly;
J. any
				form of cross-connection, which bypasses the firewall, is strictly
				prohibited;
K. remote firewall
				administration must be performed over secure channels (e.g., encrypted network
				connections using SSH or IPSEC) or console access;
L. details of firewall, and security devices
				type, software versions, and configuration data will not be disclosed without
				the permission of the agency CIO;
M. agencies shall define security zones and
				create logical entities and rules for what comprises permissible data and
				network traffic between different agency business units; and
N. agencies shall perform network
				segmentation to control the flow of data between hosts on different segments of
				the network to provide enhanced security, network performance, and
				connectivity.
New Mexico Administrative Code › Title 1 - GENERAL GOVERNMENT ADMINISTRATION › Chapter 12 - INFORMATION TECHNOLOGY › Part 20 - INFORMATION SECURITY OPERATION MANAGEMENT › Section 1.12.20.11 - PRIVILEGED ACCOUNTS MANAGEMENT

Current through Register Vol. 35, No. 13, July 16, 2024
The issuance and use of privileged accounts in agencies shall
				  be restricted and controlled by system administrator management in the
				  agency.
A. Agencies shall develop
				processes to ensure that if a privilege account is issued, the use of such
				privileged accounts is monitored by the manager of system administration, or
				the CIO.
B. Agencies shall promptly
				investigate any suspected misuse of these accounts by the manager of system
				administration or DoIT or an agency approved independent contractor.
C. Agencies shall change passwords of system
				privileged accounts no less than every 60 days.
New Mexico Administrative Code › Title 1 - GENERAL GOVERNMENT ADMINISTRATION › Chapter 12 - INFORMATION TECHNOLOGY › Part 20 - INFORMATION SECURITY OPERATION MANAGEMENT › Section 1.12.20.12 - ACCESS CONTROL POLICY

Current through Register Vol. 35, No. 13, July 16, 2024
To preserve the integrity, confidentiality, and availability
				  of the system and the data, the agency's information assets shall be protected
				  by logical as well as physical access control mechanisms commensurate with the
				  value and sensitivity of the system, the ease of recovery of the assets and the
				  direness of consequences, legal or otherwise, if the loss or compromise were to
				  occur.
A. Agencies' CIOs are
				responsible for determining who shall have access to sensitive and protected
				information resources within the agency. Access privileges shall be granted by
				the CIO in accordance with the particular user's role and job responsibilities
				in the agency.
B. Agency
				enforcement of its access control policy shall be verified during an
				independent annual risk assessment which shall be performed by DoIT or a DoIT
				approved contractor.
New Mexico Administrative Code › Title 1 - GENERAL GOVERNMENT ADMINISTRATION › Chapter 12 - INFORMATION TECHNOLOGY › Part 20 - INFORMATION SECURITY OPERATION MANAGEMENT › Section 1.12.20.13 - OPERATING SYSTEM ACCESS CONTROL

Current through Register Vol. 35, No. 13, July 16, 2024
A. Access to agency operating system code,
				commands and services shall be restricted to individuals with specialized
				skills such as systems programmers, database administrators, network, and
				security administrators who require access to perform their daily job
				responsibilities.
(1) Each of these
				individuals who are given access shall have assigned to them a unique
				privileged account (user ID).
(2)
				User IDs shall not disclose nor provide any indication of the user's
				supervisor, manager, administrator, or privilege level.
New Mexico Administrative Code › Title 1 - GENERAL GOVERNMENT ADMINISTRATION › Chapter 12 - INFORMATION TECHNOLOGY › Part 20 - INFORMATION SECURITY OPERATION MANAGEMENT › Section 1.12.20.14 - APPLICATION ACCESS CONTROL

Current through Register Vol. 35, No. 13, July 16, 2024
A.
				Access to agency business and systems applications shall be restricted to those
				individuals who have an identified business need to access those applications
				or systems in the performance of their job responsibilities.
B. Access to source code for applications and
				systems shall be restricted; any such access shall be further restricted so
				that only authorized agency staff and agency supervised contractors can access
				those applications and systems for which they directly provide
				support.
New Mexico Administrative Code › Title 1 - GENERAL GOVERNMENT ADMINISTRATION › Chapter 12 - INFORMATION TECHNOLOGY › Part 20 - INFORMATION SECURITY OPERATION MANAGEMENT › Section 1.12.20.15 - NETWORK ACCESS CONTROL

Current through Register Vol. 35, No. 13, July 16, 2024
Access to an agency's trusted internal network shall require
				  all agency authorized users to authenticate themselves through use of an
				  individually assigned user ID or other agency approved authentication mechanism
				  (e.g., password, token, smart card). Network controls shall be developed and
				  implemented by the agency to ensure that an authorized user can access only
				  those network resources and services necessary to perform their assigned job
				  responsibilities.
New Mexico Administrative Code › Title 1 - GENERAL GOVERNMENT ADMINISTRATION › Chapter 12 - INFORMATION TECHNOLOGY › Part 20 - INFORMATION SECURITY OPERATION MANAGEMENT › Section 1.12.20.17 - DEDICATED NETWORK CONNECTIONS

Current through Register Vol. 35, No. 13, July 16, 2024
A. The internet is inherently insecure,
				access to the internet is prohibited from any device that is connected (wired
				or wireless) to any part of the state network unless such access is authorized
				via exception signed by the state CIO. Such access includes accounts with
				third-party internet service providers.
B. Any dedicated network connection from the
				agency network to any external network (either within or outside state
				government) shall be first approved in writing by the DoIT.
C. Dedicated network connections shall be
				allowed after the requesting agency has presented its proposed network
				architecture for approval by the DoIT; DoIT will approve if the proposal has
				acceptable security controls and procedures in place, and appropriate security
				measures have been implemented by the agency to protect state network
				resources. The agency shall perform a risk analysis of the connection to ensure
				that the connection to the external network shall not compromise the agency's
				private network. The agency may require that additional controls, such as the
				establishment of firewalls and a DMZ (demilitarized zone) be implemented
				between the third-party connection and the agency.
(1) The business case for the dedicated
				connection is still valid and the dedicated connection is still
				required.
(2) The security controls
				are in place (e.g., filters, rules, access control lists) are current and are
				functioning correctly.
New Mexico Administrative Code › Title 1 - GENERAL GOVERNMENT ADMINISTRATION › Chapter 12 - INFORMATION TECHNOLOGY › Part 20 - INFORMATION SECURITY OPERATION MANAGEMENT › Section 1.12.20.18 - NETWORK SEGREGATION

Current through Register Vol. 35, No. 13, July 16, 2024
When an agency desires to connect its network to any other
				  third party network or its network becomes a segment on a larger network,
				  controls shall be in place to prevent access by users from other connected
				  networks to sensitive areas of the agency's private network. Such connection
				  must first be approved by the agency CIO. Firewalls or other agency approved
				  technologies shall be implemented to control access to secured resources on the
				  trusted agency network. If any such third party network connections are
				  contemplated, the agency CIO must first approve and receive approval from the
				  state CIO.
New Mexico Administrative Code › Title 1 - GENERAL GOVERNMENT ADMINISTRATION › Chapter 12 - INFORMATION TECHNOLOGY › Part 20 - INFORMATION SECURITY OPERATION MANAGEMENT › Section 1.12.20.19 - WIRELESS NETWORKS, BLUETOOTH, AND RADIO FREQUENCY IDENTIFICATION

Current through Register Vol. 35, No. 13, July 16, 2024
A. No wireless network
				or wireless access point shall be installed prior to an agency performed risk
				assessment and the written approval of the agency CIO.
B. Suitable controls, such as media access
				control (MAC), address restriction, authentication, and encryption, shall be
				implemented by the agency to ensure that a wireless network or access point
				cannot be exploited to disrupt agency information services or to gain
				unauthorized access to agency information. When selecting wireless
				technologies, such as 802.11x or its predecessors or its successor, wireless
				network security features on the equipment shall be available and implemented
				at the time of deployment.
C.
				Access to systems that hold sensitive information or the transmission of
				protected or sensitive information via a wireless network is not permitted
				unless and until appropriate and adequate measures have been implemented and
				approved by the state CIO. Such measures shall include authentication,
				authorization, encryption, access controls, and logging.
New Mexico Administrative Code › Title 1 - GENERAL GOVERNMENT ADMINISTRATION › Chapter 12 - INFORMATION TECHNOLOGY › Part 20 - INFORMATION SECURITY OPERATION MANAGEMENT › Section 1.12.20.20 - USER REGISTRATION AND MANAGEMENT

Current through Register Vol. 35, No. 13, July 16, 2024
A. A user management process shall be
				established, documented and provided to all IT staff of the agency which
				outlines and identifies all aspects of user management including the
				generation, distribution, modification, and deletion of user accounts. This
				process shall ensure that only authorized individuals have access to agency
				applications and information and that such users only have access to the
				resources required to perform authorized services.
B. The user management process shall include
				the following sub-processes:
(1) how to enroll
				new users;
(2) how to remove user
				IDs;
(3) how to grant a "privileged
				account" to a user;
(4) how to
				remove "privileged accounts" from a user;
(5) how the agency defines "periodic review"
				of "privileged accounts";
(6) how
				the agency defines "periodic review" of users enrolled in any state IT
				system;
(7) how to assign a new
				authentication token (e.g. password reset processing); and
(8) how proper enforcement of user management
				shall be verified during an independent annual risk assessment.
New Mexico Administrative Code › Title 1 - GENERAL GOVERNMENT ADMINISTRATION › Chapter 12 - INFORMATION TECHNOLOGY › Part 20 - INFORMATION SECURITY OPERATION MANAGEMENT › Section 1.12.20.21 - USER PASSWORD MANAGEMENT

Current through Register Vol. 35, No. 13, July 16, 2024
Password protocols shall be developed consistent with state
				  standards and implemented to ensure all authorized individuals accessing agency
				  resources follow 1.12.11 NMAC Enterprise Architecture. Such password protocols
				  shall be mandated by automated system controls whenever possible. Password
				  protocols should include, but not be limited to:
A. compliance with 1.12.11.16 NMAC (Security
				Password rule);
B. prohibiting the
				storage of passwords in clear text;
C. prohibiting the use of passwords that
				could be easily guessed or subject to disclosure through a dictionary
				attack;
D. direction for keeping
				passwords confidential;
E.
				prohibiting any and all password sharing;
F. directing users to change passwords at
				regular intervals;
G. direction for
				changing temporary passwords at the first logon;
H. enforcing the implementation standard
				password formats to include a mix of alphabetic, numeric, special, and
				upper/lower case characters;
I.
				automated logon processes which must be approved by agency CIO;
J. implementing state password standards and
				protocols on agency computing resources; and
K. verifying proper enforcement of password
				management by the agency during an annual independent risk
				assessment.
New Mexico Administrative Code › Title 1 - GENERAL GOVERNMENT ADMINISTRATION › Chapter 12 - INFORMATION TECHNOLOGY › Part 20 - INFORMATION SECURITY OPERATION MANAGEMENT › Section 1.12.20.22 - PROHIBITION OF USE OF PERSONAL COMPUTING DEVICES ON STATE EQUIPMENT OR SYSTEMS

Current through Register Vol. 35, No. 13, July 16, 2024
A.
				Connecting any computing device not owned by the state of New Mexico to a state
				network or to any state computing device is prohibited unless authorized in
				writing by the agency CIO.
B.
				Installation of any software, executable or other file to any state computing
				device is prohibited if that software, executable, or other file was downloaded
				by, is owned by, or was purchased by an employee or contractor with his or her
				own funds.
C. Installation of
				downloaded software, executables, or other files to any state computing device
				is prohibited when downloaded or installed by an employee or contractor for
				personal use. Downloaded software, executable, or other files include, but are
				not limited to: SKYPE, music files or other software, and personal
				photos.
New Mexico Administrative Code › Title 1 - GENERAL GOVERNMENT ADMINISTRATION › Chapter 12 - INFORMATION TECHNOLOGY › Part 20 - INFORMATION SECURITY OPERATION MANAGEMENT › Section 1.12.20.23 - VULNERABILITY SCANNING

Current through Register Vol. 35, No. 13, July 16, 2024
A. All
				state owned computing devices that are, or will be, accessible from outside the
				agency network shall be scanned by DoIT, DoIT-approved contractor or
				DoIT-approved agency IT staff for vulnerabilities and weaknesses prior to
				installation on the state network and following any changes made to the
				software, operating system, or configuration.
B. For both internal and external systems,
				scans shall be performed at least annually by DoIT or a DoIT-approved
				contractor to ensure that no major vulnerabilities have been introduced into
				the environment. The frequency of additional scans shall be determined by the
				agency ISO; such determination shall depend upon the criticality and
				sensitivity of the information on the system.
C. Network vulnerability scanning shall be
				conducted after any new network software or hardware has been installed and
				after major configuration changes have been made on critical and essential
				agency systems.
D. Output from the
				scans shall be reviewed immediately by the agency IT staff or agency ISO and
				the results communicated to the agency CIO.
E. Any vulnerability detected as a result of
				a scan shall be immediately evaluated for risk and actions shall be taken by
				the agency to mitigate such risk.
F. Tools used to scan for vulnerabilities
				shall be updated quarterly to ensure that any recently discovered
				vulnerabilities are included in any scans.
G. If an agency has outsourced a server,
				application, or network services to another agency, the responsibility for
				vulnerability scanning shall be coordinated by both agencies.
H. Anyone authorized to perform vulnerability
				scanning shall have its process defined, documented, tested, and followed at
				all times to minimize the possibility of disruption of services. Reports of
				exposures to vulnerabilities shall immediately be forwarded to the agency CIO
				and agency general counsel.
I. Any
				vulnerability scanning other than that performed by an agency ISO shall be
				conducted only by qualified individuals or organizations contracted with or
				otherwise authorized in writing by the agency's CIO.
New Mexico Administrative Code › Title 1 - GENERAL GOVERNMENT ADMINISTRATION › Chapter 12 - INFORMATION TECHNOLOGY › Part 20 - INFORMATION SECURITY OPERATION MANAGEMENT › Section 1.12.20.24 - PENETRATION AND INTRUSION TESTING

Current through Register Vol. 35, No. 13, July 16, 2024
All state computing infrastructures that provide information
				  through a public network, either directly or through another dedicated circuit,
				  and that provide information externally (such as through the world-wide web),
				  shall be subject to annual independent penetration analysis and intrusion
				  testing by qualified, independent third-party contractor approved by
				  DoIT.
A. Penetration analysis and
				testing shall be used to determine whether:
(1) a user can make an unauthorized change to
				an application;
(2) a user can
				access the application and cause it to perform unauthorized tasks;
(3) an unauthorized individual can access,
				destroy or change any data;
(4) an
				unauthorized individual may access the application and cause it to take actions
				unintended by the application designer(s).
New Mexico Administrative Code › Title 1 - GENERAL GOVERNMENT ADMINISTRATION › Chapter 12 - INFORMATION TECHNOLOGY › Part 20 - INFORMATION SECURITY OPERATION MANAGEMENT › Section 1.12.20.25 - PROTECTION AGAINST MALICIOUS CODE

Current through Register Vol. 35, No. 13, July 16, 2024
A. Software and any other mechanism to
				prevent intrusions shall be implemented across agency systems to prevent as
				well as detect the introduction of malicious code. The introduction of
				malicious code can cause serious damage to networks, workstations, and business
				data.
B. Agency users shall be
				informed of the dangers of unauthorized or malicious code.
C. Agency shall implement controls to, first,
				detect and then prevent any computer virus from being introduced to the agency
				environment. The types of controls and frequency of updating signature files
				shall be dependent on the value and sensitivity of the information at
				risk.
D. For most agency
				workstations, virus signature files shall be kept updated by the agency system
				administrator. On host systems or servers, the signature files shall be updated
				when the virus software vendor's signature files are updated and made
				available.
New Mexico Administrative Code › Title 1 - GENERAL GOVERNMENT ADMINISTRATION › Chapter 12 - INFORMATION TECHNOLOGY › Part 20 - INFORMATION SECURITY OPERATION MANAGEMENT › Section 1.12.20.26 - SYSTEM SECURITY CHECKING

Current through Register Vol. 35, No. 13, July 16, 2024
A. Systems that process or store sensitive or
				confidential information or services that provide support for critical services
				shall undergo technical security reviews by agency system administrators to
				ensure compliance with implementation standards and rules as promulgated by
				DoIT and check for vulnerabilities to threats discovered subsequent to the
				review. Technical reviews of systems and services essential to the support of
				critical agency functions shall be conducted by agency system administrators at
				least once every year. Random reviews of all systems and services shall be
				conducted at least once every 24 months.
B. Any deviations from expected or required
				results, as defined by the agency CIO or ISO which are detected by the
				technical security review shall be reported to the agency CIO and the agency
				ISO and shall be corrected immediately. Agency staff shall also be advised of
				such deviations and agency shall investigate deviations (including the review
				of system activity log records, if necessary) and provide results of
				investigation to agency ISO and CIO.
New Mexico Administrative Code › Title 1 - GENERAL GOVERNMENT ADMINISTRATION › Chapter 12 - INFORMATION TECHNOLOGY › Part 20 - INFORMATION SECURITY OPERATION MANAGEMENT › Section 1.12.20.28 - TELEPHONES AND FAX EQUIPMENT

Current through Register Vol. 35, No. 13, July 16, 2024
A. Users are prohibited from sending
				documents containing sensitive and confidential information via fax unless
				allowed by law.
B. Users are
				prohibited from using fax services to send or receive sensitive and
				confidential information.
C. Users
				are prohibited from using third-party fax services to send or receive sensitive
				and confidential information.
D.
				Users are prohibited from sending documents containing sensitive and private
				information via wireless fax devices.
E. Users are prohibited from sending
				teleconference call-in numbers and pass codes to a pager when sensitive and
				confidential information shall be discussed during the conference.
F. Teleconference chair people shall confirm
				that all teleconference participants are authorized participants, if sensitive
				or confidential information shall be discussed.
New Mexico Administrative Code › Title 1 - GENERAL GOVERNMENT ADMINISTRATION › Chapter 12 - INFORMATION TECHNOLOGY › Part 20 - INFORMATION SECURITY OPERATION MANAGEMENT › Section 1.12.20.29 - MODEM USAGE

Current through Register Vol. 35, No. 13, July 16, 2024
Connecting any dial-up modem to any computer systems which
				  are also connected to the agency's local area network, to the state network, or
				  to another internal communication network shall first be approved in writing by
				  the agency CIO.
New Mexico Administrative Code › Title 1 - GENERAL GOVERNMENT ADMINISTRATION › Chapter 12 - INFORMATION TECHNOLOGY › Part 20 - INFORMATION SECURITY OPERATION MANAGEMENT › Section 1.12.20.30 - PUBLIC WEBSITES CONTENT APPROVAL PROCESS

Current through Register Vol. 35, No. 13, July 16, 2024
A. Sensitive and confidential information
				shall not be available through a server accessible to a public network without
				appropriate safeguards in place as approved in writing by the agency CIO in
				consultation with the agency legal counsel. The agency ISO shall implement
				safeguards to ensure user authentication, data confidentiality and integrity,
				access control, data protection and logging mechanisms.
B. The design of any proposed web service
				shall be first reviewed and approved in writing by the agency CIO in
				coordination with DoIT to ensure that the security of the web server,
				protection of agency networks, performance of the site, integrity, and
				availability considerations are adequately addressed.
C. Agency websites and agency websites hosted
				outside the state network shall be tested for security vulnerabilities prior to
				being put into production by DoIT or a DoIT approved contractor.
D. Agency website content shall first be
				reviewed by the agency information owner and approved by the agency CIO to
				ensure that the collection and processing of information meets state security
				and privacy requirements. Such review shall ensure that the information is
				adequately protected in transit over public and state networks, in storage, and
				while being processed.
New Mexico Administrative Code › Title 1 - GENERAL GOVERNMENT ADMINISTRATION › Chapter 12 - INFORMATION TECHNOLOGY › Part 20 - INFORMATION SECURITY OPERATION MANAGEMENT › Section 1.12.20.31 - BUSINESS CONTINUITY

Current through Register Vol. 35, No. 13, July 16, 2024
This section is limited to the IT infrastructure and the data
				  and applications of the local agency environment.
A. A threat and risk assessment shall be
				performed by the agency to determine the criticality of business systems and
				the time frame required for recovery in the event of disaster.
B. To minimize interruptions to normal agency
				business operations and critical agency business applications and to ensure
				they are protected from the effects of any major failures, each agency business
				unit or each agency ISO, under the direct guidance of the agency CIO, shall
				develop plans to meet the IT backup and recovery requirements of the agency and
				approved by DoIT.
C. Back-ups of
				critical agency data and software shall be performed daily.
New Mexico Administrative Code › Title 1 - GENERAL GOVERNMENT ADMINISTRATION › Chapter 12 - INFORMATION TECHNOLOGY › Part 20 - INFORMATION SECURITY OPERATION MANAGEMENT › Section 1.12.20.32 - LOG-ON BANNER

Current through Register Vol. 35, No. 13, July 16, 2024
A. Log-on
				banners shall be implemented on all state IT systems to inform all users that
				agency systems are only for agency business and other approved uses consistent
				with agency policy, to inform that users their activities may be monitored, and
				to inform the user that they have no expectation of privacy.
B. Logon banners shall be displayed on
				computer screens during the authentication process.
New Mexico Administrative Code › Title 1 - GENERAL GOVERNMENT ADMINISTRATION › Chapter 12 - INFORMATION TECHNOLOGY › Part 20 - INFORMATION SECURITY OPERATION MANAGEMENT › Section 1.12.20.33 - MONITORING SYSTEM ACCESS AND USE: NO EXPECTATION OF PRIVACY

Current through Register Vol. 35, No. 13, July 16, 2024
A. Consistent with
				applicable law, the agency reserves the right to monitor, inspect, and search
				at any time, all agency information systems and equipment used by agency users.
				Since agency computers and networks are provided for state business purposes,
				agency staff and any contractor(s) specifically allowed limited use of state
				systems or equipment shall have no expectation of privacy with regard to the
				information stored in or sent through the state information systems. Agency
				management may remove from its information systems any material unauthorized by
				the agency or by state statute.
B.
				Systems and applications shall be monitored and analyzed by agency ISO or
				agency designated IT staff to detect deviation from the state access control
				policy.
C. Events shall be recorded
				to provide evidence of misuse and to reconstruct lost or damaged data by the
				agency system administrator.
D.
				Audit logs shall be used to record user activities and other security-relevant
				events.
E. Audit log reports shall
				be produced to agency CIO and ISO and kept consistent with agency record
				retention schedules.
New Mexico Administrative Code › Title 1 - GENERAL GOVERNMENT ADMINISTRATION › Chapter 12 - INFORMATION TECHNOLOGY › Part 20 - INFORMATION SECURITY OPERATION MANAGEMENT › Section 1.12.20.34 - LOST OR STOLEN IT ASSET

Current through Register Vol. 35, No. 13, July 16, 2024
In the event of a lost or stolen IT asset, the user
				  shall:
A. immediately report the
				incident to the user's supervisor;
B. immediately report the incident to the
				DoIT help desk at (505)827-2121 or EnterpriseSupportDesk@state.nm.us; a state
				IT asset incident form must be completed and signed by the agency CIO and
				returned to the DoIT help desk; the asset incident form can be found on the
				DoIT security web site at:
http://www.doit.state.nm.us/securityoffice.html
;
C. if stolen, user must contact the local law
				enforcement agency to report the theft and receive a crime report case
				number;
D. upon loss of or in the
				event of loss of an IT asset by theft, the agency CIO shall work with the DoIT
				ISO to identify the nature of the data exposed; the loss of confidential or
				sensitive data shall be reported to the agency executive management for
				direction.
New Mexico Administrative Code › Title 1 - GENERAL GOVERNMENT ADMINISTRATION › Chapter 12 - INFORMATION TECHNOLOGY › Part 21 - GRANT PROGRAM RULES › Section 1.12.21.2 - SCOPE

Current through Register Vol. 35, No. 13, July 16, 2024
These rules apply to the development, award and
				  administration of grant programs within the jurisdiction of DoIT, the Office of
				  Broadband Access and Expansion ("OBAE"), the Connect New Mexico Council
				  ("Council"), or to any public body administratively attached to DoIT, directly
				  or indirectly. These rules also apply to a subject grant program, as
				  applicable, and to any person who applies, or intends to apply, for a grant
				  under a program that is subject to these rules. These rules do not apply to
				  contracting.
New Mexico Administrative Code › Title 1 - GENERAL GOVERNMENT ADMINISTRATION › Chapter 12 - INFORMATION TECHNOLOGY › Part 21 - GRANT PROGRAM RULES › Section 1.12.21.3 - STATUTORY AUTHORITY

Current through Register Vol. 35, No. 13, July 16, 2024
Paragraphs A and B of Section
				  9-27-6 NMSA 1978; Paragraph C of
				  Section 63-9K-4 NMSA
				  1978;
New Mexico Administrative Code › Title 1 - GENERAL GOVERNMENT ADMINISTRATION › Chapter 12 - INFORMATION TECHNOLOGY › Part 21 - GRANT PROGRAM RULES › Section 1.12.21.6 - OBJECTIVE

Current through Register Vol. 35, No. 13, July 16, 2024
These rules establish standards and practices for the
				  development, challenge, application, award and administration of subject grant
				  programs.
New Mexico Administrative Code › Title 1 - GENERAL GOVERNMENT ADMINISTRATION › Chapter 12 - INFORMATION TECHNOLOGY › Part 21 - GRANT PROGRAM RULES › Section 1.12.21.8 - GENERAL RULES

Current through Register Vol. 35, No. 13, July 16, 2024
These rules govern all subject grant programs:
A.
Program administrator.
A
				sponsoring body shall designate at least one person to serve as the program
				administrator for each grant program. The sponsoring body for a program shall
				notify applicants and grantees (as applicable) of any change to the program
				administrator(s) within 30 days of the change.
(1) The program administrator for a subject
				program shall be retained and subject to discharge by the sponsoring body
				subject to the provisions of the State Personnel Act and procurement laws, and
				to the advice and consent of the sponsoring body, as applicable.
(2) The program administrator shall report to
				the sponsoring body for a subject grant program.
New Mexico Administrative Code › Title 1 - GENERAL GOVERNMENT ADMINISTRATION › Chapter 12 - INFORMATION TECHNOLOGY › Part 21 - GRANT PROGRAM RULES › Section 1.12.21.10 - ASSISTANCE GRANTS

Current through Register Vol. 35, No. 13, July 16, 2024
These additional rules apply to assistance grant
				  programs.
A.
Authorization.
An assistance grant is authorized if the:
(1) total available program funding does not
				exceed $2,500,000,
(2) funding
				source specifies the grantee or subrecipient;
(3) funding source requires program funds to
				be fully expended in fewer than 18 months;
(4) sponsoring body determines that the
				grantee or subrecipient is the only person who can satisfy program requirements
				specified by a funding source in a timely, correct and cost-effective
				manner;
(5) delay inherent in the
				merit-based program would likely create or exacerbate a threat to life, health,
				physical security, economic security, cyber security or educational development
				of state residents or to the State, or would likely delay meaningful mitigation
				of such an existing threat; or
(6)
				grantee or subrecipient is a local governmental unit, tribal unit, electric
				cooperative, or telephone cooperative and the funding source does not expressly
				require a competitive or merit based process.
New Mexico Administrative Code › Title 1 - GENERAL GOVERNMENT ADMINISTRATION › Chapter 12 - INFORMATION TECHNOLOGY › Part 21 - GRANT PROGRAM RULES › Section 1.12.21.13 - CHALLENGES AND DISPUTES

Current through Register Vol. 35, No. 13, July 16, 2024
These rules apply when a person seeks to challenge any
				  action or inaction authorized, taken, required or governed by these rules, by a
				  funding source or by any state or federal law that governs a program and is
				  not, by law or agreement, within the exclusive subject matter jurisdiction of
				  another dispute resolution process or forum.
A.
Roles.
Any challenge brought
				pursuant to these rules shall be determined by the secretary or the secretary's
				designee. If a person challenges an action taken directly by the secretary, or
				an action allegedly owed directly by the secretary, the secretary shall be
				recused and the OBAE director shall determine the matter.
(1) The secretary or director may appoint a
				hearing officer or special master to take evidence, conduct proceedings,
				including hearings, and make recommended findings, conclusions and
				decisions.
(2) An appointed hearing
				officer or special master may be a council member, employee of DoIT, or
				contractor.
New Mexico Administrative Code › Title 1 - GENERAL GOVERNMENT ADMINISTRATION › Chapter 12 - INFORMATION TECHNOLOGY › Part 21 - GRANT PROGRAM RULES › Section 1.12.21.14 - DEFAULT, CURE AND AWARD TERMINATION

Current through Register Vol. 35, No. 13, July 16, 2024
A sponsoring body may unilaterally terminate an award only as
				  authorized by, and subject to the requirements of, these rules.
A.
Uncured material default.
A
				sponsoring body may terminate an award based on a grantee's uncured failure to
				comply with or satisfy a material term of an award, including, but not limited
				to, failure to meet a financial, reporting, budget, performance, service level,
				pricing or deadline requirement.
B.
Notice of default.
Before terminating an award, a program
				administrator shall provide a grantee notice of the default and an opportunity
				to cure.
(1) Unless exigent circumstances
				justify a shorter period, a grantee shall be allowed at least 30 days to cure
				the noticed default.
(2) If a
				default presents a risk to health, life, or financial welfare of any person or
				to the state unless cured in fewer than 30 days, and the circumstances creating
				that exigency were not within the control of the program administrator or
				sponsoring body, the period allowed to cure a default may be less than 30 days
				as necessary to mitigate or eliminate the risk.