January 10, 2008www.infosecurity.ca.gov/1 Office Updates ORP-COOP/COG Alignment SAM/SIMM Restructure New/Revised SIMM Forms and Instructions Presented by Rosa Umbach

January 10, 2008www.infosecurity.ca.gov/2 ORP-COOP/COG Alignment Publication of Workgroup Products –Revised SIMM 65A Instructions –New SIMM 70D –Definitions –Internal Checklist (coming soon) Pending –Working with OES COOP/COG definitions Updating of the COOP/COG Instructions

January 10, 2008www.infosecurity.ca.gov/3 SAM/SIMM Restructure Phase I – Restructure SAM –Working with DGS to publish in SAM –Developing Management Memo for releasing new structure Phase II – Perform Policy Gap Analysis Phase III – Prioritize and begin establishing new policy

January 10, 2008www.infosecurity.ca.gov/4 SAM Restructure NOTE: SAM restructure from to Section 5300 is still in draft. We recommend making no changes until the Management Memo is released.

January 10, 2008www.infosecurity.ca.gov/5 SAM Restructure (Continued) NOTE: SAM restructure from to Section 5300 is still in draft. We recommend making no changes until the Management Memo is released.

January 10, 2008www.infosecurity.ca.gov/6 Revised SIMM Forms Agency Designation Letter (SIMM 70A) –Director can identify individual to sign as designee –Identification of other agencies that agency supports Agency Operational Recovery Plan Certification (SIMM 70B) –New Office Name Agency Risk Management and Privacy Program Compliance Certification (SIMM 70C) –Certifies full Risk Management Program is in place or the Agency provides remediation plan to become compliant.

January 10, 2008www.infosecurity.ca.gov/7 SIMM 70A

January 10, 2008www.infosecurity.ca.gov/8 SIMM 70C

January 10, 2008www.infosecurity.ca.gov/9 Risk Management Certification Remediation Plan should include: –List of activities which the agency is not yet compliant with –Timeline for completing each activity –Method for validation of completion –Method of verification of compliance –Contact for remediation plan

January 10, 2008www.infosecurity.ca.gov/10 NEW SIMM Form Agency Operational Recovery Plan Transmittal Letter (SIMM 70D)

January 10, 2008www.infosecurity.ca.gov/11 Questions?