Page 223

GOVERNANCE This document is governed by the IT Governance policy which provides the following guidance: Roles and Responsibilities a. Policy Control Application b. Policy Compliance Requirements c. Policy Exceptions and Exemptions d. Policy Reviews and Updates e. SCOPE This policy covers all State information and information systems to include those used, managed, or operated by a contractor, an agency, or other organization on behalf of the State. This policy applies to all State employees, contractors, and all other users of State information and systems supporting the operation and assets of the State. SA-1 POLICY AND PROCEDURES All information assets that process, store, receive, transmit or otherwise impact the confidentiality, integrity, and accessibility of State data must meet the required security controls defined in this policy document that are based on the National Institute of Standards and Technology (NIST) SP 800-53, r5 Security and Privacy Controls. The State has adopted the System and Service Acquisition principles established in National Institute of Standards and Technology (NIST) SP 800-53 “System and Service Acquisition” control guidelines as the official policy for this security domain. The “SA” designator identified in each control represents the NIST-specified identifier for the System and Service Acquisition control family. A designator followed by a number in parenthesis indicates a control enhancement that provides statements of security and privacy capability that augment a base control. Only those control enhancements associated with the moderate level controls are listed. Should an executive-branch agency be required to address other control enhancements for a control item, the organization will be responsible for writing an additional policy to meet that requirement. The following subsections in this document outline the system and service acquisition requirements the State and executive-branch agencies shall implement and maintain. This policy and associated procedures shall be reviewed and updated at least every three (3) years, or as State-defined events require more frequent review and update. This policy and the associated procedures shall be developed, documented, and disseminated by the Agency Head, Chief Information Officer (CIO), Chief Information Security Officer (CISO), or other designated organizational officials at the senior leadership level. SA-2 ALLOCATION OF RESOURCES Organizations shall expediently allocate resources for information security to provide rapid yet supervised allocation, ensuring the organization is modernized and protected against emerging and ongoing threats. Funding shall include allocation of resources for initial systems or system services acquisition and funding for their sustainment. The following shall be done: Determine the high-level security and privacy requirements for the system or service in each a. System and Services Acquisition Policy GV-PO-P5 Effective Date: 01/31/2025 Date Approved: 01/15/2025 Version: 1 Page #: 1 of 12