Oregon Administrative Rules › Chapter 125 - DEPARTMENT OF ADMINISTRATIVE SERVICES › Division 800 - STATE INFORMATION SECURITY › Section 125-800-0020 - State Information Security

Current through Register Vol. 63, No. 7, July 1, 2024
(1)
Duties
:
(a) Department of Administrative Services
			 (Department): The Department shall serve as the primary point of accountability
			 and coordination for information security in state government except for
			 elected offices as identified in section 4, Elected Offices Exception. The
			 Department, in collaboration with state agencies, shall routinely take
			 necessary actions, proactive and reactive, to protect and verify protection of
			 the state's shared computing and network infrastructure including, but not
			 limited to: active scanning and monitoring; intrusion prevention and detection;
			 scheduled and unscheduled security reviews and compliance audits; protection,
			 containment and mitigation actions taken to address threats, vulnerabilities,
			 and security problems; termination or filtering of connections to mitigate
			 problematic network traffic or unauthorized access; quarantine of infected
			 systems to allow for the forensic identification and analysis of system
			 threats; and the application of other steps and practices as may be required.
(A)
Leadership
. The Department
			 shall provide central leadership for state government-wide information security
			 including, but not limited to: centrally directing and coordinating all
			 enterprise information security activities; determining security risks to the
			 state's Information assets and collaboratively working with state agencies in
			 taking those actions required to mitigate unacceptable risks; collaboratively
			 work with state agencies to determine appropriate state and agency security
			 activities to maintain appropriate levels of security preparedness and
			 competency; reducing the cost of providing security by implementing an
			 enterprise approach; detecting and eliminating unnecessary duplication of
			 efforts and obstacles to forward progress in information security; creating the
			 processes and process linkages necessary to maintain a fully functional state
			 government security capability; and creating and maintaining the tools and
			 practices necessary to manage the host of simultaneous and interoperable
			 activities that comprise information security.
(B)
Planning
. The Department, in
			 collaboration with state agencies, shall direct information security planning
			 including, but not limited to: determining strategic security objectives and
			 associated performance measures; analyzing and evaluating state, agency and
			 trusted partner security practices; proposing and subsequently prescribing
			 solutions for information security challenges; establishing a process to
			 determine, prioritize and schedule security enhancements on a state
			 government-wide basis; ensuring through validation that information security is
			 an essential part of state and agency business planning and operations;
			 determining essential state information security roles and responsibilities;
			 and identifying opportunities for security master contracting and other
			 procurement efficiencies. The Department may plan, manage and undertake
			 enterprise-level information security projects and initiatives.
(C)
Policy
. The Department, in
			 collaboration with state agencies, shall develop, recommend, implement and
			 maintain the full spectrum of administrative rules, policies, architecture,
			 standards, guidelines, and procedures necessary to create and maintain an
			 appropriate state government-wide information security competency.
(D)
Coordination
. The Department
			 shall coordinate the security activities of state government including, but not
			 limited to: providing the security communications, coordination, planning and
			 development hub for state government; establishing collaborative partnerships
			 with local and regional governments and the Federal government in the realm of
			 security planning and implementation; and enterprise coordination of all
			 information security-related activities and initiatives across state
			 government.
(E)
Security
			 Assessments
. The Department shall work collaboratively with state
			 agencies to conduct information security assessments and testing within Oregon
			 state government including, but not limited to: determining when it is
			 appropriate to outsource security testing of state or agency Information
			 assets; coordinating security assessments and tests; establishing standards for
			 the timing and nature of agency information security assessments and tests
			 including, but not limited to internal and external, third-party assessments;
			 provide oversight for agency vulnerability and risk mitigation planning and
			 actions; and ensuring the dissemination of any security assessment and test
			 report data is restricted to only those who, in the judgment of the State Chief
			 Information Security Officer, Agency Director, and/or appropriate state agency
			 staff, have a business need for such information. The Department shall
			 determine qualifications for vendors contracted to perform security
			 assessments.
(F)
Incident
			 Response
. The Department shall create a state incident response
			 capability including, but not limited to: appointing a standing, multi-agency
			 State Incident Response Team (SIRT) as described in section (2) of this rule;
			 ensuring the SIRT, in collaboration with state agencies, prescribes and takes
			 those actions necessary to immediately assemble and deploy the coordinated
			 expertise, tools, communications infrastructure, methodologies and controls
			 required to prevent or mitigate damage caused by an Incident. SIRT will perform
			 a structured investigation into the nature and cause of an Incident; document
			 evidence of computer crime, misuse or Incident; employ forensic techniques and
			 controls; evaluate Incidents for improvement of information security; perform
			 any duties required to appropriately defend against an Incident and
			 subsequently prosecute the perpetrator; and cooperate with law enforcement and
			 other authorities.
(G)
System
			 Management
. The Department, in collaboration with state agencies, shall
			 provide policies, standards and consultation on systems management associated
			 with information security including, but not limited to management of:
			 firewalls; routers; intrusion detection and protection mechanisms; identity and
			 access management; patch/configuration management; digital certificates; secure
			 transmission and access controls (encryption); wireless devices; change
			 controls, and automated system log aggregation and monitoring.
(H)
Security Awareness and
			 Training
. The Department will provide the communications practices and
			 tools necessary to form and maintain a viable information security community of
			 practice across Oregon state government including, but not limited to: creation
			 and maintenance of an information security knowledge and document repository;
			 creation and maintenance of a enterprise level user awareness program, and
			 participation with state and national stakeholder groups; provide the training
			 or training curriculum required to: inform managers, users and technologists on
			 the policies and practices of state information security; work with agencies to
			 ensure all who have access to information assets are provided training on their
			 security-related responsibilities and the specific security-related actions
			 they are expected to take; and identifying, conducting or arranging appropriate
			 security certification for key state and agency staff.
(I)
Reporting
. The Department
			 shall continually track and share relevant enterprise security information
			 including, but not limited to: creation and dissemination of standardized
			 reports demonstrating the status and progress of information security efforts
			 across state government. Keep state executive management and the Legislature
			 appraised of the state's information security posture.
(J)
Performance Management
. The
			 Department shall identify, track, analyze, adjust and report information
			 security performance measurement and management to the Legislature, state
			 executive management.
(K)
Compliance and Oversight
. The Department shall require and enforce
			 compliance with information security practices including, but not limited to:
			 performing or directing compliance reviews to ensure agencies are taking
			 appropriate information security actions and adhering to laws, rules, policies,
			 architecture, standards, procedures and guidelines; routinely inventory and
			 evaluate the information security capabilities of the agencies of state
			 government; prescribing a standardized approach for responding to audit and
			 security assessment issues; and taking appropriate action when there is a
			 failure to adhere to information security practices.
(L)
Financial Management
. The
			 Department shall develop budgets and manage the finances for enterprise
			 security projects and initiatives.
(M)
Procurement
. The Department
			 shall manage procurements for the enterprise information security program
			 including, but not limited to: procurement of hardware, software and expertise;
			 approving enterprise security-related procurements; and issuing and managing
			 enterprise-level, information security program contracts; ensuring contract
			 language regarding information security is properly addressed in
			 contracts.
(N)
Evaluation
. The Department shall evaluate and report the risk,
			 feasibility, effectiveness and cost implications of potential enterprise
			 information security issues and provide recommendations for
			 mitigation.
(O)
State Chief
			 Information Security Officer
. The Department will designate a State
			 Chief Information Security Officer to manage and promote information security
			 across the agencies of state government.