INFORMATION TECHNOLOGY POLICY
|
|
|
- Martina Hudson
- 8 years ago
- Views:
Transcription
1 COMMONWEALTH OF PENNSYLVANIA DEPARTMENT OF PUBLIC WELFARE INFORMATION TECHNOLOGY POLICY Name Of Policy: Physical and Environmental Security Policy Domain: Security Date Issued: 06/09/11 Date Revised: 10/11/13 Number: POL-SEC008 Category: Issued By Direction Of: Sandra Patterson, CIO Bureau of Information Systems
2 Table of Contents 1 Introduction Purpose Scope Compliance Exemptions Policy Review and Update Physical and Environmental Security Policy Fire Protection, Temperature and Humidity Controls Emergency Shutoff / Power Appendix... Error! Bookmark not defined. 3.1 References... 5 Document History Version Date Author Status Notes /09/2011 David Johnson Draft Initial creation /23/2011 David Johnson Draft Revised per Tom Zarb review /11/2013 Pamela Skelton Baseline Revised per Pamela Skelton review Department of Public Welfare Page 2
3 1 Introduction 1.1 Purpose This policy establishes requirements for the implementation of physical and environmental safeguards to adequately protect Department of Public Welfare (DPW) personnel, property and information resources from unauthorized physical intrusion and other physical threats. This policy also addresses compliance with applicable DPW, Commonwealth of Pennsylvania (CoPA) and federal requirements. 1.2 Scope All DPW employees, contractors and business partners are responsible for understanding and complying with this policy. 1.3 Compliance All DPW employees, contractors and other stakeholders are expected to be familiar with and comply with this policy. Violations of this policy may lead to revocation of system privileges and/or disciplinary action. DPW employees who knowingly and willfully violate DPW, Commonwealth or federal law addressing improper use or disclosure of an individual s information may be subject to criminal investigation and prosecution or civil monetary penalties. 1.4 Exemptions Requests for exemption to the policy should be submitted to the Chief Information Security Officer (CISO). Any exceptions granted will be issued a policy waiver for a defined period of time. 1.5 Policy Review and Update This document, and its supporting standards and procedures, will be reviewed annually, and updated as needed. 2 Physical and Environmental Security Policy Physical security represents the first line of defense against intruders and adversaries attempting to gain access to DPW facilities and/or information systems. Physical security restricts the entry and exit of personnel from protected areas, and protects sensitive data and systems. Environmental safety and security provides safeguards for fire safety, building environment, utilities, and other safeguards for the protection of DPW personnel, facilities and information resources. a. The physical security of DPW facilities, including facilities containing information resources, shall be managed per the following Commonwealth and DPW policies and standards: : Willow Oak Building Security. CoPA Policy: General Order 41, Security for Commonwealth Owned/Controlled Buildings, Property, Employees and Visitors CoPA Standards: Minimum Standards for Improving Physical Security Access (ITB-SEC029) 2.1 Physical Access Physical Access is the enforcement of a set of rules that govern physical access authorizations at DPW. Effective physical access control is critical to verifying individual access authorizations before granting access to DPW facilities. Department of Public Welfare Page 3
4 a. DPW shall authorize physical access to the facility where the information system resides based on roles and responsibilities. b. DPW shall require two (2) approved forms of identification before granting access to the facility where the information system resides. c. The organization shall restrict unescorted access to the facility where the information system resides to personnel lacking sufficient security clearances and / or appropriate credentials. d. Physical access authorizations shall be enforced to the information system in addition to physical access controls to DPW facilities. e. Every physical access point to DPW facilities shall be equipped with at least alarms and/or guards where the information system resides, twenty-four (24) hours per day, seven (7) days per week. f. DPW shall monitor physical intrusion alarms and surveillance equipment and employ centralized mechanisms to recognize the types of intrusions and initiate appropriate response actions. 2.2 Power Equipment and Cabling Power equipment and cabling relate to the types of protection necessary to effectively protect equipment and cabling both internal and external to organizational facilities and environments of operation against damage and destruction. a. DPW shall employ power cable redundancy paths that are physically separated and automatic voltage controls for critical information system components. 2.3 Fire protection, Water damage protection and Temperature and humidity Controls Fire protection, water damage protection and temperature and humidity controls represents the minimum requirements needed to protect DPW information system and its personnel against fire, water damage and temperature and humidity abnormal levels. Fire Protection a. DPW Information system shall employ and maintain fire suppression and detection systems supported by an independent source of energy (e.g., handheld fire extinguishers, smoke detectors, sprinkler systems and fixed fire hose wheels) b. In the event of a fire, those fire suppression and detection systems shall be activated automatically to notify the organization and proper emergency responders. c. DPW shall employ automatic fire suppression capability when the facility is not staffed on a continuous basis. Water Damage Protection a. DPW shall employ automated centralized mechanisms to detect the presence of water in the information system and alerts the CISO. Temperature and Humidity Controls a. DPW shall define the acceptable temperature and humidity levels within the facility where the information system resides b. The frequency to monitor temperatures and humidity levels shall be defined. c. The organization shall then monitor the temperature and humidity with the organization-defined frequency Department of Public Welfare Page 4
5 2.4 Emergency Shutoff / Power / Lighting DPW information system has established appropriate controls in the event of a primary power source loss or power outage / disruption. Emergency Shutoff a. In emergency situations, DPW shall provide the capability of shutting off power to either the information system or individual system components. Emergency Power a. In the event of a primary power source loss, DPW organization shall provide the following: A short-term uninterruptible power supply to facilitate an eventual orderly shutdown of the information system. A long-term self-contained, alternate power supply for the information system that is capable of maintaining minimally required operational capability Emergency Lighting a. In the event of a power outage or disruption, DPW Information system shall employ and maintain an automatic emergency lighting to cover emergency exits and evacuation routes within DPW facilities. 2.5 Monitoring Physical Access a. DPW shall review physical access logs every at least once every two (2) months. 3 Appendix 3.1 References Document DPW Web Application Privacy Standard Health Insurance Portability and Accountability Act (HIPAA) Privacy Implementation Handbook Source DPW DPW Department of Public Welfare Page 5
COMMONWEALTH OF PENNSYLVANIA DEPARTMENT S OF PUBLIC WELFARE, INSURANCE AND AGING
COMMONWEALTH OF PENNSYLVANIA DEPARTMENT S OF PUBLIC WELFARE, INSURANCE AND AGING INFORMATION TECHNOLOGY POLICY Name Of Policy: System and Information Integrity Policy Domain: Security Date Issued: 06/22/11
COMMONWEALTH OF PENNSYLVANIA DEPARTMENT S OF PUBLIC WELFARE, INSURANCE AND AGING
COMMONWEALTH OF PENNSYLVANIA DEPARTMENT S OF PUBLIC WELFARE, INSURANCE AND AGING INFORMATION TECHNOLOGY POLICY Name Of Policy: Security Audit Logging Policy Domain: Security Date Issued: 05/23/11 Date
INFORMATION TECHNOLOGY POLICY
COMMONWEALTH OF PENNSYLVANIA DEPARTMENT OF PUBLIC WELFARE INFORMATION TECHNOLOGY POLICY Name Of Policy: Incident Reporting & Response Policy Domain: Security Date Issued: 05/26/2011 Date Revised: 10/11/2013
Security Control Standard
Department of the Interior Security Control Standard Physical and Environmental Protection April 2011 Version: 1.1 Signature Approval Page Designated Official Bernard J. Mazer, Department of the Interior,
INFORMATION TECHNOLOGY POLICY
COMMONWEALTH OF PENNSYLVANIA DEPARTMENT OF PUBLIC WELFARE INFORMATION TECHNOLOGY POLICY Name Of : DPW Information Security and Privacy Policies Domain: Security Date Issued: 05/09/2011 Date Revised: 11/07/2013
Sample CDC Certification and Accreditation Checklist For an Application That Is Considered a Moderate Threat
Sample CDC Certification and Accreditation Checklist For an Application That Is Considered a Moderate Threat Centers for Disease and Prevention National Center for Chronic Disease Prevention and Health
Information Technology General Controls Review (ITGC) Audit Program Prepared by:
Information Technology General Controls Review (ITGC) Audit Program Date Prepared: 2012 Internal Audit Work Plan Objective: IT General Controls (ITGC) address the overall operation and activities of the
HIPAA Security. 2 Security Standards: Administrative Safeguards. Security Topics
HIPAA Security SERIES Security Topics 1. Security 101 for Covered Entities 5. 2. Security Standards - Organizational, Security Policies Standards & Procedures, - Administrative and Documentation Safeguards
micros MICROS Systems, Inc. Enterprise Information Security Policy (MEIP) August, 2013 Revision 8.0 MICROS Systems, Inc. Version 8.
micros MICROS Systems, Inc. Enterprise Information Security Policy (MEIP) Revision 8.0 August, 2013 1 Table of Contents Overview /Standards: I. Information Security Policy/Standards Preface...5 I.1 Purpose....5
CSB Needs Better Security Controls to Protect Critical Data Stored on Its Regional Servers
U.S. ENVIRONMENTAL PROTECTION AGENCY OFFICE OF INSPECTOR GENERAL U.S. Chemical Safety Board CSB Needs Better Security Controls to Protect Critical Data Stored on Its Regional Servers Report No. 16-P-0035
EPA Classification No.: CIO-2150.3-P-11.1 CIO Approval Date: 08/06/2012 CIO Transmittal No.: 12-003 Review Date: 08/06/2015
Issued by the EPA Chief Information Officer, Pursuant to Delegation 1-19, dated 07/07/2005 INFORMATION SECURITY INTERIM PHYSICAL AND ENVIRONMENTAL PROTECTION PROCEDURES V1.9 MAY 4, 2012 1. PURPOSE The
Who Should Know This Policy 2 Definitions 2 Contacts 3 Procedures 3 Forms 5 Related Documents 5 Revision History 5 FAQs 5
Information Security Policy Type: Administrative Responsible Office: Office of Technology Services Initial Policy Approved: 09/30/2009 Current Revision Approved: 08/10/2015 Policy Statement and Purpose
Fire Alarm and Protection Impairment Policy and Procedures
1.0 Policy Statement The University of New Haven has developed a Fire Alarm and Protection Impairment Plan in accordance with the National Fire Protection Associations (NFPA) codes. Specific codes referenced
DESIGNATED CONTRACT MARKET OPERATIONAL CAPABILITY TECHNOLOGY QUESTIONNAIRE
DESIGNATED CONTRACT MARKET OPERATIONAL CAPABILITY TECHNOLOGY QUESTIONNAIRE Please provide all relevant documents responsive to the information requests listed within each area below. In addition to the
HIPAA Security Alert
Shipman & Goodwin LLP HIPAA Security Alert July 2008 EXECUTIVE GUIDANCE HIPAA SECURITY COMPLIANCE How would your organization s senior management respond to CMS or OIG inquiries about health information
WHITEPAPER Complying with HIPAA LogRhythm and HIPAA Compliance
WHITEPAPER Complying with HIPAA LogRhythm and HIPAA Compliance Complying With HIPAA The Department of Health and Human Services (HHS) enacted the Health Insurance Portability and Accountability Act of
Rule 4-004M Payment Card Industry (PCI) Monitoring, Logging and Audit (proposed)
Version: Modified By: Date: Approved By: Date: 1.0 Michael Hawkins October 29, 2013 Dan Bowden November 2013 Rule 4-004M Payment Card Industry (PCI) Monitoring, Logging and Audit (proposed) 01.1 Purpose
COMMONWEALTH OF PENNSYLVANIA DEPARTMENT S OF PUBLIC WELFARE, INSURANCE AND AGING
COMMONWEALTH OF PENNSYLVANIA DEPARTMENT S OF PUBLIC WELFARE, INSURANCE AND AGING INFORMATION TECHNOLOGY STANDARD Name Of Standard: Audit Logging Standard Domain: Security Date Issued: 09/07/2012 Date Revised:
REQUEST FOR BOARD ACTION
REQUEST FOR BOARD ACTION HENDERSON COUNTY BOARD OF COMMISSIONERS MEETING DATE: 23 March 2005 SUBJECT: ATTACHMENT(S): HIPAA 1. Proposed Resolution adopting policies 2. Proposed policies SUMMARY OF REQUEST:
Information Security Risk Assessment Checklist. A High-Level Tool to Assist USG Institutions with Risk Analysis
Information Security Risk Assessment Checklist A High-Level Tool to Assist USG Institutions with Risk Analysis Updated Oct 2008 Introduction Information security is an important issue for the University
SWAP EXECUTION FACILITY OPERATIONAL CAPABILITY TECHNOLOGY QUESTIONNAIRE
SWAP EXECUTION FACILITY OPERATIONAL CAPABILITY TECHNOLOGY QUESTIONNAIRE Please provide all relevant documents responsive to the information requests listed within each area below. In addition to the specific
Administrative Procedure
Administrative Procedure Effective: 12/21/2012 Supersedes: N/A Page: 1 of 5 Subject: SECURITY ALARMS 1.0. PURPOSE: The purpose of this procedure is to coordinate and control the installation, monitoring,
Security Policy JUNE 1, 2012. SalesNOW. Security Policy v.1.4 2012-06-01. v.1.4 2012-06-01 1
JUNE 1, 2012 SalesNOW Security Policy v.1.4 2012-06-01 v.1.4 2012-06-01 1 Overview Interchange Solutions Inc. (Interchange) is the proud maker of SalesNOW. Interchange understands that your trust in us
LAMAR STATE COLLEGE - ORANGE INFORMATION RESOURCES SECURITY MANUAL. for INFORMATION RESOURCES
LAMAR STATE COLLEGE - ORANGE INFORMATION RESOURCES SECURITY MANUAL for INFORMATION RESOURCES Updated: June 2007 Information Resources Security Manual 1. Purpose of Security Manual 2. Audience 3. Acceptable
Security Document. Issued April 2014 Updated October 2014 Updated May 2015
Security Document Issued April 2014 Updated October 2014 Updated May 2015 Table of Contents Issued April 2014... 1 Updated October 2014... 1 Updated May 2015... 1 State-of-the-art Security for Legal Data...
Audit of Security Controls for DHS Information Technology Systems at San Francisco International Airport
Audit of Security Controls for DHS Information Technology Systems at San Francisco International Airport May 7, 2015 DHS OIG HIGHLIGHTS Audit of Security Controls for DHS Information Technology Systems
CHAPTER 71. Regulations governing systems False alarm charges; violations and penalties.
CHAPTER 71 ALARM SYSTEMS ARTICLE I Burglar Alarm Systems S71-1. S71-2. S71-3. Regulations governing systems False alarm charges; violations and penalties. ARTICLE II Fire Alarm Systems S71-4. S71-5. False
TABLE OF CONTENTS. 2006.1259 Information Systems Security Handbook. 7 2006.1260 Information Systems Security program elements. 7
PART 2006 - MANAGEMENT Subpart Z - Information Systems Security TABLE OF CONTENTS Sec. 2006.1251 Purpose. 2006.1252 Policy. 2006.1253 Definitions. 2006.1254 Authority. (a) National. (b) Departmental. 2006.1255
LogRhythm and HIPAA Compliance
LogRhythm and HIPAA Compliance The Department of Health and Human Services (HHS) enacted the Health Insurance Portability and Accountability Act of 1996 (HIPAA) to ensure that personal information stored,
HIPAA PRIVACY AND SECURITY AWARENESS
HIPAA PRIVACY AND SECURITY AWARENESS Introduction The Health Insurance Portability and Accountability Act (known as HIPAA) was enacted by Congress in 1996. HIPAA serves three main purposes: To protect
SUBJECT: SECURITY OF ELECTRONIC MEDICAL RECORDS COMPLIANCE WITH THE HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996 (HIPAA)
UNIVERSITY OF PITTSBURGH POLICY SUBJECT: SECURITY OF ELECTRONIC MEDICAL RECORDS COMPLIANCE WITH THE HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996 (HIPAA) DATE: March 18, 2005 I. SCOPE This
`DEPARTMENT OF VETERANS AFFAIRS VA SOUTHEAST NETWORK Automated Information System User Access Notice
`DEPARTMENT OF VETERANS AFFAIRS VA SOUTHEAST NETWORK Automated Information System User Access Notice I understand, accept, and agree to the following terms and conditions that apply to my access to, and
HIPAA Information Security Overview
HIPAA Information Security Overview Security Overview HIPAA Security Regulations establish safeguards for protected health information (PHI) in electronic format. The security rules apply to PHI that is
Data Management Policies. Sage ERP Online
Sage ERP Online Sage ERP Online Table of Contents 1.0 Server Backup and Restore Policy... 3 1.1 Objectives... 3 1.2 Scope... 3 1.3 Responsibilities... 3 1.4 Policy... 4 1.5 Policy Violation... 5 1.6 Communication...
Information Security for Managers
Fiscal Year 2015 Information Security for Managers Introduction Information Security Overview Enterprise Performance Life Cycle Enterprise Performance Life Cycle and the Risk Management Framework Categorize
Security Whitepaper: ivvy Products
Security Whitepaper: ivvy Products Security Whitepaper ivvy Products Table of Contents Introduction Overview Security Policies Internal Protocol and Employee Education Physical and Environmental Security
Service Organization Control (SOC 3) Report on a Description of the Data Center Colocation System Relevant to Security and Availability
15301 Dallas Parkway, Suite 960, Addison, TX 75001 MAIN 214 545 3965 FAX 214 545 3966 www.bkmsh.com Service Organization Control (SOC 3) Report on a Description of the Data Center Colocation System Relevant
INFORMATION TECHNOLOGY STANDARD
COMMONWEALTH OF PENNSYLVANIA DEPARTMENT OF PUBLIC WELFARE INFORMATION TECHNOLOGY STANDARD Name Of Standard: IS Measures of Performance Domain: Security Date Issued: 11/13/2013 Date Revised: Number: STD-ENSS036
Information Security Program Management Standard
State of California California Information Security Office Information Security Program Management Standard SIMM 5305-A September 2013 REVISION HISTORY REVISION DATE OF RELEASE OWNER SUMMARY OF CHANGES
DHHIT Network Security Standards and Procedures
DHHIT Network Security Standards and Procedures Contents 1. Introduction 2 2. Scope 2 3. Definitions 2 4 Employment practices 2 5 Employee responsibility 3 6 Physical security 3 7 Network and Systems Security
ADMINISTRATIVE POLICY # 32 8 2 (2014) Information Security Roles and Responsibilities
Policy Title: Information Security Roles Policy Type: Administrative Policy Number: ADMINISTRATIVE POLICY # 32 8 2 (2014) Information Security Roles Approval Date: 05/28/2014 Revised Responsible Office:
The Commonwealth of Massachusetts
A. JOSEPH DeNUCCI AUDITOR The Commonwealth of Massachusetts AUDITOR OF THE COMMONWEALTH ONE ASHBURTON PLACE, ROOM 1819 BOSTON, MASSACHUSETTS 02108 TEL. (617) 727-6200 No. 2008-1308-4T OFFICE OF THE STATE
Information Security Policy and Handbook Overview. ITSS Information Security June 2015
Information Security Policy and Handbook Overview ITSS Information Security June 2015 Information Security Policy Control Hierarchy System and Campus Information Security Policies UNT System Information
Austin Independent School District Police Department Policy and Procedure Manual
Policy 8.07 Austin Independent School District Police Department Policy and Procedure Manual Life Safety Systems I. POLICY The proper operations of the AISD Life Safety Systems (LSS) are essential for
CORPORATE PROCUREMENT UNIT SITE & SECURITY PROCEDURES BOSTON SPA VERSION 9 SEPT12
SITE PROCEDURES BSPA VERSION 9 PAGE 1 OF 9 CONTENTS PAGE 1. GENERAL INFORMATION 3 2. ACCESS 3 3. SECURITY 3 4. VEHICLE PARKING 4 5. PERMITS TO WORK 4 6. DELIVERY, UNLOADING AND STORAGE 4 7. HOURS OF WORK
Office of Inspector General
DEPARTMENT OF HOMELAND SECURITY Office of Inspector General Security Weaknesses Increase Risks to Critical United States Secret Service Database (Redacted) Notice: The Department of Homeland Security,
Information Resources Security Guidelines
Information Resources Security Guidelines 1. General These guidelines, under the authority of South Texas College Policy #4712- Information Resources Security, set forth the framework for a comprehensive
Appendix A: Rules of Behavior for VA Employees
Appendix A: Rules of Behavior for VA Employees Department of Veterans Affairs (VA) National Rules of Behavior 1 Background a) Section 5723(b)(12) of title 38, United States Code, requires the Assistant
ALARM SYSTEMS Ord. No. 08-02 Adoption Date: September 9, 2008 Publication Date: September 17, 2008 Effective Date: October 16, 2008
An ordinance relating to Alarm Systems THE TOWNSHIPOF BIRCH RUN ORDAINS: ALARM SYSTEMS Ord. No. 08-02 Adoption Date: September 9, 2008 Publication Date: September 17, 2008 Effective Date: October 16, 2008
Information Security Program
Stephen F. Austin State University Information Security Program Revised: September 2014 2014 Table of Contents Overview... 1 Introduction... 1 Purpose... 1 Authority... 2 Scope... 2 Information Security
Health Insurance Portability and Accountability Act (HIPAA) and Health Information Technology for Economic and Clinical Health Act (HITECH)
Health Insurance Portability and Accountability Act (HIPAA) and Health Information Technology for Economic and Clinical Health Act (HITECH) Table of Contents Introduction... 1 1. Administrative Safeguards...
Risk and its Impact to(insert company name here) Risk AFTER Mitigation. Objective (A-D)
Contributed 11/29/99 by Virginia Sutton Corporate Audit Department Date: Audit Project: Mission: Process: Objective A: Objective B: Objective C: Objective D: Physical Security
HIPAA BUSINESS ASSOCIATE AGREEMENT
HIPAA BUSINESS ASSOCIATE AGREEMENT This HIPAA Business Associate Agreement and is made between BEST Life and Health Insurance Company ( BEST Life ) and ( Business Associate ). RECITALS WHEREAS, the U.S.
Health Insurance Portability and Accountability Act Enterprise Compliance Auditing & Reporting ECAR for HIPAA Technical Product Overview Whitepaper
Regulatory Compliance Solutions for Microsoft Windows IT Security Controls Supporting DHS HIPAA Final Security Rules Health Insurance Portability and Accountability Act Enterprise Compliance Auditing &
Network and Workstation Acceptable Use Policy
CONTENT: Introduction Purpose Policy / Procedure References INTRODUCTION Information Technology services including, staff, workstations, peripherals and network infrastructures are an integral part of
Data center solutions from Siemens. For the factories of the 21 st century. siemens.com/datacenters
Data center solutions from Siemens For the factories of the 21 st century siemens.com/datacenters We face the challenges for the factories of the 21 st century Based on our vast experience, we offer a
Retention & Destruction
Last Updated: March 28, 2014 This document sets forth the security policies and procedures for WealthEngine, Inc. ( WealthEngine or the Company ). A. Retention & Destruction Retention & Destruction of
Nationwide Review of CMS s HIPAA Oversight. Brian C. Johnson, CPA, CISA. Wednesday, January 19, 2011
Nationwide Review of CMS s HIPAA Oversight Brian C. Johnson, CPA, CISA Wednesday, January 19, 2011 1 WHAT I DO Manage Region IV IT Audit and Advance Audit Technique Staff (AATS) IT Audit consists of 8
PBGC Information Security Policy
PBGC Information Security Policy 1. Purpose. The Pension Benefit Guaranty Corporation (PBGC) Information Security Policy (ISP) defines the security and protection of PBGC information resources. 2. Reference.
System Security Plan University of Texas Health Science Center School of Public Health
System Security Plan University of Texas Health Science Center School of Public Health Note: This is simply a template for a NIH System Security Plan. You will need to complete, or add content, to many
MAJOR PROJECTS CONSTRUCTION SAFETY STANDARD HS-09 Revision 0
MAJOR PROJECTS CONSTRUCTION SAFETY SECURITY MANAGEMENT PROGRAM STANDARD HS-09 Document Owner(s) Tom Munro Project/Organization Role Supervisor, Major Projects Safety & Security (Canada) Version Control:
CHIS, Inc. Privacy General Guidelines
CHIS, Inc. and HIPAA CHIS, Inc. provides services to healthcare facilities and uses certain protected health information (PHI) in connection with performing these services. Therefore, CHIS, Inc. is classified
Business Associate Agreement
Business Associate Agreement This Business Associate Agreement (the Agreement ) is made by and between Business Associate, [Name of Business Associate], and Covered Entity, The Connecticut Center for Health,
SMITH COLLEGE EMERGENCY PLANNING SUMMER PROGRAMS EMERGENCY PLAN
T (413) 585-2669 F (413) 585-6990 SMITH COLLEGE EMERGENCY PLANNING Overview Smith College currently has in place an Emergency Response Plan, an Emergency Response Team, and a Crisis Management Team. Campus
State of Vermont. Physical Security for Computer Protection Policy
State of Vermont Physical Security for Computer Protection Policy Date Approved: 04-02-10 Approved by: Tom Pelham Policy Number: 0501.012005 Contents 1.0 Introduction... 3 1.1 Authority... 3 1.2 Purpose...
OPERATIONAL CAPABILITY TECHNOLOGY QUESTIONNAIRE
OPERATIONAL CAPABILITY TECHNOLOGY QUESTIONNAIRE Please provide all relevant documents responsive to the information requests listed within each area below. In addition to the specific documents requested,
Information Security Operational Procedures Banner Student Information System Security Policy
Policy No: 803 Area: Information Technology Services Adopted: 8/6/2012 Information Security Operational Procedures Banner Student Information System Security Policy INTRODUCTION This document provides
REVIEWED ICT DATA CENTRE PHYSICAL ACCESS AND ENVIROMENTAL CONTROL POLICY
LI_M_POPO PROVINCIAL GOVERNMENT :;:ED.JBl-C ()F SO"';-H AFR;IC. ':.,. DEPARTMENT OF CO-OPERATIVE GOVERNANCE, HUMAN SETTLEMENTS & TRADITIONAL AFFAIRS REVIEWED ICT DATA CENTRE PHYSICAL ACCESS AND ENVIROMENTAL
OFFICE OF THE STATE AUDITOR General Controls Review Questionnaire
OFFICE OF THE STATE AUDITOR Agency: * University Please answer all of the following questions. Where we ask for copies of policies and procedures and other documentation, we would prefer this in electronic
DHHS Information Technology (IT) Access Control Standard
DHHS Information Technology (IT) Access Control Standard Issue Date: October 1, 2013 Effective Date: October 1,2013 Revised Date: Number: DHHS-2013-001-B 1.0 Purpose and Objectives With the diversity of
FISH AND WILDLIFE SERVICE INFORMATION RESOURCES MANAGEMENT. Chapter 7 Information Technology (IT) Security Program 270 FW 7 TABLE OF CONTENTS
TABLE OF CONTENTS General Topics Purpose and Authorities Roles and Responsibilities Policy and Program Waiver Process Contact Abbreviated Sections/Questions 7.1 What is the purpose of this chapter? 7.2
NMSU FIRE DEPARTMENT Commercial Kitchen Fire Suppression Worksheet
This Commercial Kitchen Automatic Fire has been created to assure all documentation has been submitted to assist you in assuring proper plans and documentations has been submitted and reviewed by New Mexico
IT - General Controls Questionnaire
IT - General Controls Questionnaire Internal Control Questionnaire Question Yes No N/A Remarks G1. ACCESS CONTROLS Access controls are comprised of those policies and procedures that are designed to allow
SOUTHWEST VIRGINIA COMMUNITY COLLEGE RECORDS MANAGEMENT POLICY
SOUTHWEST VIRGINIA COMMUNITY COLLEGE RECORDS MANAGEMENT POLICY Statement of Intent This policy establishes the general responsibilities for management, retention, and disposition of SOUTHWEST VIRGINIA
HIPAA BUSINESS ASSOCIATE AGREEMENT
HIPAA BUSINESS ASSOCIATE AGREEMENT This HIPAA Business Associate Agreement ( Agreement ) is by and between ( Covered Entity ) and Xelex Digital, LLC ( Business Associate ), and is effective as of. WHEREAS,
AUGUST 28, 2013 INFORMATION TECHNOLOGY INCIDENT RESPONSE PLAN. 1250 Siskiyou Boulevard Ashland OR 97520
AUGUST 28, 2013 INFORMATION TECHNOLOGY INCIDENT RESPONSE PLAN 1250 Siskiyou Boulevard Ashland OR 97520 Revision History Revision Change Date 1.0 Initial Incident Response Plan 8/28/2013 Official copies
HIPAA Employee Training Guide. Revision Date: April 11, 2015
HIPAA Employee Training Guide Revision Date: April 11, 2015 What is HIPAA? The Health Insurance Portability and Accountability Act of 1996 (also known as Kennedy- Kassebaum Act ). HIPAA regulations address
EPA Classification No.: CIO-2150.3-P-09.1 CIO Approval Date: 08/06/2012 CIO Transmittal No.: 12-003 Review Date: 08/06/2015
Issued by the EPA Chief Information Officer, Pursuant to Delegation 1-19, dated 07/07/2005 INFORMATION SECURITY INTERIM MAINTENANCE PROCEDURES V1.8 JULY 18, 2012 1. PURPOSE The purpose of this procedure
Summary of CIP Version 5 Standards
Summary of CIP Version 5 Standards In Version 5 of the Critical Infrastructure Protection ( CIP ) Reliability Standards ( CIP Version 5 Standards ), the existing versions of CIP-002 through CIP-009 have
SOC 2 Report Seattle, WA (SEF)
SOC 2 Report Seattle, WA (SEF) October 1, 2013 January 31, 2014 Independent Service Auditor s Report INTERNAP NETWORK SERVICES CORPORATION Company-Controlled Data Center Services Type 2 Report on Controls
BEST PRACTICES FOR COMMERCIAL COMPLIANCE
BEST PRACTICES FOR COMMERCIAL COMPLIANCE [ BEST PRACTICES FOR COMMERCIAL COMPLIANCE ] 2 Contents OVERVIEW... 3 Health Insurance Portability and Accountability Act (HIPAA) of 1996... 4 Sarbanes-Oxley Act
Version: Modified By: Date: Approved By: Date: 1.0 Michael Hawkins October 29, 2013 Dan Bowden November 2013
Version: Modified By: Date: Approved By: Date: 1.0 Michael Hawkins October 29, 2013 Dan Bowden November 2013 Rule 4-004L Payment Card Industry (PCI) Physical Security (proposed) 01.1 Purpose The purpose
Sample audit - A Review of the IT Department (PCDA)
2006-1265-4 A. JOSEPH DeNUCCI AUDITOR The Commonwealth of Massachusetts AUDITOR OF THE COMMONWEALTH ONE ASHBURTON PLACE, ROOM 1819 Boston, MASSACHUSETTS 02108 TEL. (617) 727-6200 No. 2006-1265-4T OFFICE
COMMONWEALTH OF PENNSYLVANIA DEPARTMENT S OF PUBLIC WELFARE, INSURANCE AND AGING
COMMONWEALTH OF PENNSYLVANIA DEPARTMENT S OF PUBLIC WELFARE, INSURANCE AND AGING INFORMATION TECHNOLOGY STANDARD Name Of Standard: Mobile Device Standard Domain: Security Date Issued: 09/07/2012 Date Revised:
HIPAA Security COMPLIANCE Checklist For Employers
Compliance HIPAA Security COMPLIANCE Checklist For Employers All of the following steps must be completed by April 20, 2006 (April 14, 2005 for Large Health Plans) Broadly speaking, there are three major
Hosted Testing and Grading
Hosted Testing and Grading Technical White Paper July 2014 www.lexmark.com Lexmark and Lexmark with diamond design are trademarks of Lexmark International, Inc., registered in the United States and/or
HIGH-RISK SECURITY VULNERABILITIES IDENTIFIED DURING REVIEWS OF INFORMATION TECHNOLOGY GENERAL CONTROLS
Department of Health and Human Services OFFICE OF INSPECTOR GENERAL HIGH-RISK SECURITY VULNERABILITIES IDENTIFIED DURING REVIEWS OF INFORMATION TECHNOLOGY GENERAL CONTROLS AT STATE MEDICAID AGENCIES Inquiries
Section 2. A new Chapter 8.38 is hereby added to Title 8 of the Brea City Code to read as follows: CHAPTER 8.38: REGULATION OF ALARM SYSTEMS
ORDINANCE NO. [DRAFT 04-07-04] AN ORDINANCE OF THE CITY COUNCIL OF THE CITY OF BREA ESTABLISHING REGULATIONS FOR THE OPERATION OF ALARM SYSTEMS The City Council hereby ordains as follows: Section 1. Chapter
Metropolitan Washington Airports Authority Office of Public Safety Fire & Rescue Department. Fire Code Enforcement Division
Metropolitan Washington Airports Authority Office of Public Safety Fire & Rescue Department Fire Code Enforcement Division Fire Protection System Impairment Requirements For Contractors and Service Personnel
Encryption Security Standard
Virginia Commonwealth University Information Security Standard Title: Encryption Security Standard Scope: Approval February 22, 2012 This document provides the encryption requirements for all data generated,
SITECATALYST SECURITY
SITECATALYST SECURITY Ensuring the Security of Client Data June 6, 2008 Version 2.0 CHAPTER 1 1 Omniture Security The availability, integrity and confidentiality of client data is of paramount importance
ECSA EuroCloud Star Audit Data Privacy Audit Guide
ECSA EuroCloud Star Audit Data Privacy Audit Guide Page 1 of 15 Table of contents Introduction... 3 ECSA Data Privacy Rules... 4 Governing Law... 6 Sub processing... 6 A. TOMs: Cloud Service... 7 TOMs:
HIPAA Compliance with LT Auditor+
HIPAA Compliance with LT Auditor+ An Executive White Paper By BLUE LANCE, Inc. BLUE LANCE INC. www.bluelance.com 713.255.4800 info@bluelance.com On February 20, 2003, the Department of Health and Human
NETWORK AND AIS AUDIT, LOGGING, AND MONITORING POLICY OCIO-6011-09 TABLE OF CONTENTS
OFFICE OF THE CHIEF INFORMATION OFFICER NETWORK AND AIS AUDIT, LOGGING, AND MONITORING POLICY OCIO-6011-09 Date of Issuance: May 22, 2009 Effective Date: May 22, 2009 Review Date: TABLE OF CONTENTS Section
HIPAA Privacy Summary for Fully-insured Employer Groups
HIPAA Privacy Summary for Fully-insured Employer Groups I. Overview The Privacy Regulations of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) regulate the uses and disclosures
I. U.S. Government Privacy Laws
I. U.S. Government Privacy Laws A. Privacy Definitions and Principles a. Privacy Definitions i. Privacy and personally identifiable information (PII) b. Privacy Basics Definition of PII 1. Office of Management
Banking and Financial Institutions (Physical Security Measures) THE BANKING AND FINANCIAL INSTITUTIONS (PHYSICAL SECURITY MEASURES) REGULATIONS, 2008
THE BANKING AND FINANCIAL INSTITUTIONS (PHYSICAL SECURITY MEASURES) REGULATIONS, 2008 ARRANGEMENT OF REGULATIONS Regulation Title PART I PRELIMINARY PROVISIONS 1. Short title 2. Application 3. Interpretation
Rotherham CCG Network Security Policy V2.0
Title: Rotherham CCG Network Security Policy V2.0 Reference No: Owner: Author: Andrew Clayton - Head of IT Robin Carlisle Deputy - Chief Officer D Stowe ICT Security Manager First Issued On: 17 th October
Environment of Care Fire Safety Management Plan 2014
Environment of Care Fire Safety Management Plan 2014 Updated 4.29.2014 PURPOSE The purpose of the Fire Safety Management Plan is to ensure that all facilities are designed, constructed, maintained, and