Laserfiche WebLink
<br />. Does the State have a response plan for responding to critical cyber related events? <br />. Does this plan include a continuity of communications component? <br />. Does the State maintain a relationship with Federal entities such as the United States <br />Computer Readiness Response Team (US-CERT)? <br /> <br />Training: <br /> <br />. Are there requirements by the State to ensure employees have cyber security training and <br />awareness on an annual basis? <br />. Are training programs available at multiple levels commensurate with employees' <br />responsibility (e.g., general awareness, system administrator, network administrator)? <br />. Does the State have an outreach program to ensure the greatest penetration possible for <br />cyber security awareness throughout State and local governments? <br />. Does the State have a web presence that provides cyber security guidance? <br />. Does the State have a program to establish and maintain a set of best practices for cyber <br />security, both for its own use and to share with local jurisdictions? <br /> <br />Technology Deployment: <br /> <br />. Has the State deployed appropriate technology for basic cyber security requirements such <br />as anti-virus protection and network intrusion detection? <br />. Has the State deployed specific technology (including modifications and patches to <br />existing systems and software) to respond to vulnerabilities identified by internal or third- <br />party vulnerability assessments? <br />. Does the State have a system in place for tracking software versions in use, relevant <br />known vulnerabilities, and available patches to counter those vulnerabilities. <br />. Does the State have cyber forensics capabilities to serve both civilian and criminal <br />matters for the State? <br /> <br />V ulnerability Assessment: <br /> <br />. Does the State have a formal program for periodic internal vulnerability assessment? <br />. Does the State supplement its internal assessment program with third-party vulnerability <br />assessments? <br />. Is there a formal process by which assessment results are converted into prioritized <br />remedial actions and tracked to completion? <br /> <br />Local jurisdictions should review many of the same questions, scaled to their individual needs. <br />Every government entity that owns and operates information technology equipment should have <br />at least a rudimentary cyber security plan, and establish an Information Security Officer (ISO) <br />or single point of contact (POC) for cyber security, including up-to-date 24/7 contact <br />information. Smaller jurisdictions should rely on their parent entities to provide sample policy <br />documents and plans, as well as specialized assistance such as forensic analysis. <br /> <br />Grantees are urged to review the information at the following site, which provide valuable <br />advice, best practices, and opportunities for support and information sharing: <br /> <br />1-2 <br /> <br />