1. January 10, 2008www.infosecurity.ca.gov/1 Office Updates ORP-COOP/COG Alignment SAM/SIMM Restructure New/Revised SIMM Forms and Instructions Presented by Rosa Umbach

2. January 10, 2008www.infosecurity.ca.gov/2 ORP-COOP/COG Alignment Publication of Workgroup Products –Revised SIMM 65A Instructions –New SIMM 70D –Definitions –Internal Checklist (coming soon) Pending –Working with OES COOP/COG definitions Updating of the COOP/COG Instructions

3. January 10, 2008www.infosecurity.ca.gov/3 SAM/SIMM Restructure Phase I – Restructure SAM 4840-4845 –Working with DGS to publish in SAM –Developing Management Memo for releasing new structure Phase II – Perform Policy Gap Analysis Phase III – Prioritize and begin establishing new policy

4. January 10, 2008www.infosecurity.ca.gov/4 SAM Restructure NOTE: SAM restructure from 4840-4845 to Section 5300 is still in draft. We recommend making no changes until the Management Memo is released.

5. January 10, 2008www.infosecurity.ca.gov/5 SAM Restructure (Continued) NOTE: SAM restructure from 4840-4845 to Section 5300 is still in draft. We recommend making no changes until the Management Memo is released.

6. January 10, 2008www.infosecurity.ca.gov/6 Revised SIMM Forms Agency Designation Letter (SIMM 70A) –Director can identify individual to sign as designee –Identification of other agencies that agency supports Agency Operational Recovery Plan Certification (SIMM 70B) –New Office Name Agency Risk Management and Privacy Program Compliance Certification (SIMM 70C) –Certifies full Risk Management Program is in place or the Agency provides remediation plan to become compliant.

7. January 10, 2008www.infosecurity.ca.gov/7 SIMM 70A

8. January 10, 2008www.infosecurity.ca.gov/8 SIMM 70C

9. January 10, 2008www.infosecurity.ca.gov/9 Risk Management Certification Remediation Plan should include: –List of activities which the agency is not yet compliant with –Timeline for completing each activity –Method for validation of completion –Method of verification of compliance –Contact for remediation plan

10. January 10, 2008www.infosecurity.ca.gov/10 NEW SIMM Form Agency Operational Recovery Plan Transmittal Letter (SIMM 70D)

11. January 10, 2008www.infosecurity.ca.gov/11 Questions?