1. Security Awareness Training: System Owners

2. Definition
VITA , p. 7
The System Owner is the agency business manager responsible for having an IT system operated and maintained. With respect to IT security, the System Owner’s responsibilities include the following:
1. Require that the IT system users complete any system unique security training prior to, or as soon as practicable after, receiving access to the system, and no less than annually, thereafter.
2. Manage system risk and developing any additional information security policies and procedures required to protect the system in a manner commensurate with risk.
3. Maintain compliance with COV Information Security policies and standards in all IT
system activities.
4. Maintain compliance with requirements specified by Data Owners for the handling of data processed by the system.
5. Designate a System Administrator for the system.

3. Security Your responsibility Implement Security Controls
Software Safeguards
Access Controls
Data Owner Requirements
Who
Type
What permissions
Approve access
Remote Access
Investigate unusual activities
Notify affected users of Security Breach
Ensure proper environmental controls are in place.
Ensure systems are in secured locations
Notify Data Owner of breach
System hardening
Baseline Security on all systems
Additional Security on all systems
Review

4. Communication
The Data Owner decides the sensitivity level and level of protection for the data, communicating it to you, the system owner
Designate and direct the System Administrator in requirements to protect the data
Work with the Data Owner on BIA
Notify Data Owner of breach
Assist Data Owner in reviews

5. Risk Management & Business Continuity
Participate in BIA with Data Owner
Document Sensitive Systems
Risk Assessment
Approve backup schedule
Approve emergency backup and operations restoration plans
SEC Sect 4.2.2: Security Plan requirements
Include:
Security Controls, current and planned
How the controls mitigate risk
Get Agency Head or ISO approval
Revise if disapproved
Update every three years

6. System Interoperability
Section of SEC501-01
Document Systems with shared data
Type
Data flow
Contact info
Written agreement with security requirements
Specify how data is stored
System Owner agrees to abide by legal requirements
System Owner’s authority to approve access
Approve and enforce
Inform others who share the system or data to include new shares

7. Other Security Considerations
Phishing/Social Engineering
Data Disposal
Password requirements
SSN and Credit Card number communication