ANAHEIM, CITY OF 5-2006 - Laserfiche WebLink

Home Browse Search

APPENDIX I - CYBER SECURITY GUIDANCE Government entities at every level must have appropriate policies in place, understand where vulnerabilities exist, weigh the risks involved and make informed decisions on how to spend resources to secure data. Some 10,000 new computer viruses were reported last year, and it now only takes a few minutes to compromise an unprotected computer that is connected to the Internet. The negative impact of a virus or successful cyber attack can be devastating on networks, on the information contained within systems and, just as importantly, on the confidence of those who trust that government is working to increase protection. Each State and local government entity should develop and execute a comprehensive cyber security plan that demonstrates due diligence in cyber security. The plan must account for factors such as limited staff and resources (and staff turnover); varying size and complexity of the State and local government entities; varying cyber security and technology knowledge base within government; and a wide variance in technology being used. In addition to a comprehensive plan, government must periodically test and exercise this plan, using vulnerability assessments to identify gaps and training needs. All jurisdictions should ensure that their cyber security plan addresses four main areas: Policy, Training, Technology Deployment, and Vulnerability Assessment. Each of these areas supports the others, and together they meet emerging standards of due diligence in information security. The questions below are designed to identify key issues within each major area at the State level. Policy: · Does the State have a cyber security plan in place that sets the vision, goals, and objectives for Statewide cyber security? · Has the State published a clear policy statement on cyber security to support the plan, including "permitted use" policy for all State-owned cyber assets? Has this policy set been made available to jurisdictions within the State so that it can be adapted for their user? . Has the State established a certification/accreditation program for information systems? · Does the State have a designated cyber security office/officer whose primary focus is on protecting the State's cyber infrastructure? . Does the State have established cyber security metrics? Does the State have a mechanism for rating its cyber security alert level? · Does the State maintain a current inventory of cyber assets, including personnel? · Has the State established public, private, or academic partnerships for cyber security collaboration? . Does the State have a capability for internal secure information sharing (Statewide secure portal)? . Does the State have a formal mechanism for information sharing with external partners (including local government)? . Does the State have a cyber operational center that functions 24/7? Does the State have an ad-hoc 24/7 capability if an operational center does not exist? . Does the State have a Statewide Computer Security Incident Response Team? 1-1