Security Awareness Training: System Owners

Definition VITA 501-01 2.2.7, p. 7 The System Owner is the agency business manager responsible for having an IT system operated and maintained. With respect to IT security, the System Owner’s responsibilities include the following: 1. Require that the IT system users complete any system unique security training prior to, or as soon as practicable after, receiving access to the system, and no less than annually, thereafter. 2. Manage system risk and developing any additional information security policies and procedures required to protect the system in a manner commensurate with risk. 3. Maintain compliance with COV Information Security policies and standards in all IT system activities. 4. Maintain compliance with requirements specified by Data Owners for the handling of data processed by the system. 5. Designate a System Administrator for the system.

Security Your responsibility Implement Security Controls Software Safeguards Access Controls Data Owner Requirements Who Type What permissions Approve access Remote Access Investigate unusual activities Notify affected users of Security Breach Ensure proper environmental controls are in place. Ensure systems are in secured locations Notify Data Owner of breach System hardening Baseline Security on all systems Additional Security on all systems Review

Communication The Data Owner decides the sensitivity level and level of protection for the data, communicating it to you, the system owner Designate and direct the System Administrator in requirements to protect the data Work with the Data Owner on BIA Notify Data Owner of breach Assist Data Owner in reviews

Risk Management & Business Continuity Participate in BIA with Data Owner Document Sensitive Systems Risk Assessment Approve backup schedule Approve emergency backup and operations restoration plans SEC501-01 Sect 4.2.2: Security Plan requirements Include: Security Controls, current and planned How the controls mitigate risk Get Agency Head or ISO approval Revise if disapproved Update every three years

System Interoperability Section 4.4.2 of SEC501-01 Document Systems with shared data Type Data flow Contact info Written agreement with security requirements Specify how data is stored System Owner agrees to abide by legal requirements System Owner’s authority to approve access Approve and enforce Inform others who share the system or data to include new shares

Other Security Considerations Phishing/Social Engineering Data Disposal Password requirements SSN and Credit Card number communication