Plans of Action and Milestones
1. Non-responsive Agency
All 113 organizations will either report or decline to participate by the report due day for FY 2009.
2. Formalize Participation by Outsourcing Agencies
All outsourcing agencies should have formal agreements for this arrangement or be operating their own security program by June 30, 2009.
3. Classify Agencies by Impact Categorizations
Agencies should be classified according to the highest impact rating of the systems operated by the agency by March 31, 2009.
4. Security Awareness Training
Ninety-five percent of all state workers will receive security awareness training by June 30, 2009.
5. System Inventories
All Complex agencies will provide or update their inventories, including impact categorizations, during FY 2009.
6. System Security Plans
Seventy-five percent of all high impact systems and 25% of all moderate impact systems will have approved security plans by June 30, 2009.
7. Desktop Security
One hundred percent of all security plans will expressly address workstation security issues by June 30, 2009.
8. System Security Assessments
Seventy-five percent of all high-impact systems will undergo independent third-party assessments during FY 2009.
9. Disaster Planning
One hundred percent of all systems with an availability impact rating of high will have availability or DR plans that support those requirements by June 30, 2009.
10. Business Continuity Planning Participation
One hundred percent of the agency security activity participation agreements (see Plan of Action and Milestone 2) should explicitly state whether it includes BCP functions by June 30, 2009.
11. Business Continuity Planning
One hundred percent of the agencies will have a minimal BCP by June 30, 2009.
12. Incident Response Planning
All agencies with high-impact or moderate-impact information must have approved security incident management and response plans approved by GTA by June 30, 2009.
13. Strategy
GTA will evaluate the state’s existing security strategy and make adjustments where necessary, including extending it to include four years, by December 31, 2008.
Print this