Page 1

West Virginia WIC Policy & Procedure 1.26 Effective Date: 3/20/2018 1.26 Security Policy

1 of 12 POLICY:

State and local agencies are responsible for the security of all ADP projects being developed and operational systems involved in the administration of FNS programs. State agencies shall determine appropriate ADP security requirements based on recognized industry standards of standards governing security of Federal ADP systems and information processing.

SCOPE:

All State and Local agency WIC personnel will adhere to the policies and procedures herein described as well as those already established by the State of West Virginia Office of Technology Policies: http://www.technology.wv.gov/security/Pages/policies-issued-by-the-cto.aspx • Information Security Policy • Internet Usage Policy • Email Use Standards • Acceptable Use of Portable and/or Wireless Devices along with Chapter 61, Article 3C. West Virginia Computer Crime and Abuse Act., http://www.legis.state.wv.us/wvcode/ChapterEntire.cfm?chap=61&art=3C

PROCEDURE:

The State Agency (SA) will maintain a program for conducting periodic risk assessments to ensure that appropriate, cost-effective safeguards are incorporated into new and existing systems. A risk assessment shall be performed whenever significant system changes occur.

The SA will review the ADP system security of 20% of all WIC clinic sites on a biennial basis. The review shall evaluate physical and data security, operating procedures, and personnel practices. The SA will determine compliance with requirements and provide a written summary of all findings to both the local agency and FNS after the completion of the ADP System Security Review. The SA will submit a plan of corrective action to the Local Agency with dates of scheduled milestones, when completed, will correct any security weaknesses.

The State Agency will provide one copy of all IT Policies initially to each local clinic site. These policies will be kept on-site for review and new staff training. The Local Agency will be notified of changes to the IT Policies on the web sites. It will be the responsibility of each local clinic site to update these separate policies.

A. Administrative/Management Security Controls

1. The SA will delegate a staff member who will act as the WIC Security Officer. The roles of the WIC Security Officer are outlined under the Personnel Security section of this policy. The WIC Security Officer will track all system breaches and monitor and test for vulnerability of security safeguards at irregular intervals but at least once a year.

B. Computer Security Controls

1. Access Control