Page 12

West Virginia WIC Policy & Procedure 1.26 Effective Date: 3/20/2018 1.26 Security Policy

12 of 12 a. Contingency plans are to protect PC equipment and its users against unacceptable loss. Proper procedures must be in place in the event of weather-related emergencies and sudden power losses. The SA will identify those applications that must be run immediately, those that can be delayed, and those which can be postponed indefinitely or performed in another manner.

b. Daily backups are performed on the file servers and on the communication stations of each site.

c. Disaster Recovery Exercises will be conducted yearly for the IS&C mainframe to ensure continued operation in the event of an emergency. See Reference VIII.

H. Procedures for WIC Biennial Security Review

The objective of the biennial security review is to perform a network security assessment of the West Virginia WIC Program. The project will involve work being performed on-site at county WIC clinics as well as remotely gathering information on computer systems prior to the on-site visit for corrective action and discussion with the appropriate Local Agency WIC directors. Additionally, a physical safeguards assessment will take place during the on-site visit.

Security reviews consisting of WIC networks will be audited using remote security software in order to detect, interrogate, test for weak passwords, and report on well-known services of identified WIC computers that are network-connected. Scans will occur one week prior to the scheduled on-site security review, and any findings that cannot be corrected remotely will be addressed during the on-site visit. WIC computer users will not be aware of scans, nor will the security scans affect WIC computer operations.

Also, prior to the on-site visit, information will be gathered about WIC user accounts. Reports of user account inconsistencies, disabled, inactive, never used accounts, will be run one week prior to the scheduled on-site security review. Findings will be discussed with the appropriate Local Agency Director and corrected.

REFERENCES:

1. State of West Virginia Information Security Policies 2. WV DHHR Information Technology Policies and Procedures 3. Chapter 61, Article 3C. West Virginia Computer Crime and Abuse Act 4. Diamond Emergency Preparedness Guide 5. FNS Handbook 901

ATTACHMENTS:

1. West Virginia WIC Program Site Description Chart 2. Local Agency Security Survey