1. November 13, 2008www.infosecurity.ca.gov1 What’s New! Presented by Colleen Pedroza

2. November 13, 2008www.infosecurity.ca.gov2 Policy Releases  MM 08-10 - Industry Standard Terminology For Disaster Recovery  MM 08-11 - Safeguarding Against and Responding to an Information Security Breach involving Personal Information  SIMM 65D - Security Breach Involving Personal Information: Requirements and Decision-Making Criteria for State Agencies  Forthcoming Q1 2009: MM on Incident Management for State Agencies  Add definition(s) for incident, etc  Update reporting criteria and forms  OISPP to provide incident management training

3. November 13, 2008www.infosecurity.ca.gov3 Current OISPP Projects  Enterprise Security Strategic Plan  FSR for an Automated Incident Management System (OHS Grant Funded)  Online Cyber Security and Privacy Training (OHS Grant Funded)  Policy Gap Analysis  Data Exchange Agreement Guidance and Model Templates Document  Information Security Leader Academy (ISLA)

4. November 13, 2008www.infosecurity.ca.gov4 Update on 2009 Compliance Documents DR Plans Due by October 15th 29 Disaster Recovery Plans were due 21 were filed Form Updates SIMM 65A, 70B, 70D forms were revised to reflect the change to Disaster Recovery from Operational Recovery.

5. November 13, 2008www.infosecurity.ca.gov5 Update on 2009 Compliance Documents SIMM 70A Form was revised to: CHANGE: Reflect the change to Disaster Recovery NEW: Require a Privacy Program Coordinator back-up NEW: Require classification be provided for designated back-ups NEW: Require an organization chart indicating the reporting structure for the designees be attached to the Form NEW: Safeguard language added to the footer *Please note that the form allows for more than one individual to be an authorized designee for the Director

6. November 13, 2008www.infosecurity.ca.gov6 Update on 2009 Compliance Documents SIMM 70C Form was revised to:  Change: Reflect the change to Disaster Recovery  NEW: Check boxes added to each component of a fully developed Risk Management and Privacy Program.  Revised: Expansion of the SAM sections to address: Date of your agency’s last Risk Assessment Date the remediation activities were completed  There are NO new policy requirements on this Form  Removed: the bullet stating, “Compliance with the state audit requirement relating to the integrity of information and security incident reporting requirements. See SAM Section 20000.”  NEW: Safeguard language added to the footer.

7. November 13, 2008www.infosecurity.ca.gov7 Update on 2009 Compliance Documents  To meet the January 31, 2009 filing requirements, agencies must file the revised: Form 70A dated November 2008. This form may be signed by the Director or the Director’s Designee. However, if the Designee is not on file with our Office, the form will be returned with a letter indicating that it did not have the authorized signature. Form 70C dated November 2008. It must be signed by the Director or agency head. Old forms submitted will be returned to the Director with a letter indicating that the revised form must be submitted.

8. November 13, 2008www.infosecurity.ca.gov8 Questions?