Securing Critical Assets: Arizona’s Security & Privacy Initiatives This domain is the most complex in terms of understanding how we mange data and information and the systems supporting such data. The intent is to develop a representation of IT reality as it applies to the agency, COI’s and the enterprise. Most Internet-based services in the State are developed and presented separately, according to jurisdictional boundaries of an individual agency rather than being integrated cooperatively according to lines of business or function

Background Arizona has been Identity Theft Capital of U.S. for past 4 years AZ Government has Decentralized Service Delivery & IT Infrastructure Management Increasing Our Security Risks Citizens have ready access to public data (Web Portal, Google partnership, Arizona 2-1-1, etc.) All States subject to Federal Privacy Mandates: Health Insurance Portability and Accountability Act (HIPAA) Federal Information Security Management Act of 2002 (FISMA) Family Educational Rights and Privacy Act (FERPA) Pending Data Security Breach (Privacy Disclosure), etc.

AZ Security & Privacy Initiatives Our Security & Privacy Activities have focused on: State Legislation Executive Policies State Initiatives

Legislative Actions 41-3504 GITA Duties as Statewide Strategic IT Planning and Oversight Agency 44-7501 Notification for Compromised Personal Information. 41-4152 Identifies appropriate information practices and protection of all personal information collected from its citizens and consumers. ***Current Pending Legislation - S.B. 1104 – Proposes Statewide Information Security and Privacy Office to be Placed in GITA & Baseline Statewide Security Risk Assessment***

Executive Policy IT Enterprise Architecture developed in 2003 included Statewide IT Security & Privacy Policies, Standards and Practices (PSP). Project Investment Justification (PIJ) Process, Consulting & Monitoring Functions Cover Security & all other IT Areas. Advisory & Oversight Boards: Emergency Preparedness Oversight Council (EPOC) IT Security Advisory Committee (ITSAC) CIO Council (CIOs of largest State agencies) Program Participation: Multi-State Information Sharing & Analysis Center (MS-ISAC) Participation HIPAAZ Program

State Security & Privacy Initiatives Annual Standards Compliance Assessment (TISA) Gap Closure Process Training & Awareness Linkage with BCPs & IT DR IT Security Training & Awareness Annual CIO Standards Awareness Training Annual BCP Coordinator Training (includes IT/DR) DES Training Pilot Business Continuity Planning IT Disaster Recovery Critical Business Function Resource Mapping Statewide Infrastructure Protection Center (SIPC) Incident Reporting Event Management

Resource References Arizona’s Statewide IT Enterprise Architecture, Quality Assurance, and IT Security Standards: http://azgita.gov/policies_standards/ GITA’s online assessment tools (PARIS, ISIS & TISA) allow streamlined IT planning, standards compliance assessment, and inventory reporting: http://azgita.gov/apps/ Business Continuity/IT Disaster Recovery Planning guide: http://www.dem.state.az.us/busines%20continuity/Phase-2-Guidance%20K-1.pdf

Lessons Learned Privacy protection should drive IT Security standards. Business Leaders must drive BCP, IT/DR, IT Planning & Standards Compliance for effective implementation. Risk Management should be tailored to level of risk: 30 “Group 1” BCP agencies (large, critical) 70 “Group 2” BCP agencies, boards, commissions) Different compliance & training for each group Business Impact Analysis (BIA) should target Critical Business Function (CBF) mapping. Agencies need actionable, documented & tested workaround procedures. Statewide Central Oversight & Control is needed in decentralized environments for security protection to be effective.

Government Information Technology Agency (GITA) Questions/Comments Chris Cummiskey State CIO & Director Government Information Technology Agency (GITA) 602-364-4770 ccummiskey@azgita.gov