Policy Reference
| Category | Monitoring and Reporting | |||
| Approval Date | 01-29-2010 | |||
| Scope | All Personnel | |||
Purpose
To protect the confidentiality, integrity, and availability of all information technology systems, networks, and information by have a timely response to newly discovered security risks.
Policy
- ITS will maintain a procedure to identify newly discovered security vulnerabilities and update the protection framework to address them.
- Employees must comply with ITS requests to respond to urgent security risks including taking appropriate measures to apply on-demand upgrades, exit from open applications, re-boot computer systems, etc as necessary to support the appropriate mitigation of an urgent risk.
- All vulnerabilities to computer resources that could be exploited by a threat will be identified and brought to the attention of IT management.
- External network connections required to support city business must be evaluated and approved.
- Departments must notifiy ITS of the need for an external network connection and identify the related business requirements.
- Before granting access to a third party, risks will be identified and necessary controls must be implemented. The identification of risks will take into account the following: The type of access and what information the third party is accessing; the value of the information; the controls used by the third party; procedures to deal with security incidents; measures being used to identify third party personnel who have access; and legal requirements.
Compliance
- The organization must develop procedures for identifying newly discovered vulnerabilities, such as subscribing to alert services.
Verify a process has been implemented to continuously identify new vulnerabilities to the system, including from resources outside the organization. Interview security personnel to ensure new vulnerabilities are identified. § 6.2.b, Payment Card Industry (PCI) Data Security Standard, Requirements and Security Assessment Procedures, Version 1.2 - The organization must develop procedures for identifying newly discovered vulnerabilities, such as subscribing to alert services. § 6.2(b), Payment Card Industry (PCI) Data Security Standard Self-Assessment Questionnaire D and Attestation of Compliance All other Merchants and all SAQ-Eligible Service Providers, Version 1.2
- A vulnerability analysis, a safeguard analysis, a likelihood assessment, threat identification, and a consequence assessment are all called for. § 3.3.1, Generally Accepted Principles and Practices for Securing Information Technology Systems, NIST SP 800-14, September 1996