If personnel are not Moderate Moderate Agency create a security awareness educated about their training program in compliance with security responsibilities, DTMB policy 1325.00 – security safeguards and Information Technology Security processes that have been Awareness implemented may become ineffective through errors Compliance with NIST 800-53; or intentional actions and AT-1 thru AT-4 could cause: Damage to Agency reputation 2. Lack of Security Awareness program Loss of citizen’s trust from Agency Adhere to legal requirements Financial loss Loss of business or service to citizens Inadequate protection of sensitive or confidential information A possible breach of PII Audit logs Low Moderate Agency is aware of and creates reported by citizens and incident response plan in Agency is not prepared to compliance with: respond cause: DTMB policy 1340.00 – Identity Theft Information Technology Information Security Policy; Fraud establishes how information security be implemented to protect SOM Financial Loss information from unauthorized access, use, disclosure, modification 3. Lack of Incident Compromise of destruction, or denial and to ensure Response confidentiality and confidentiality, integrity and integrity of data availability of SOM information. DTMB procedure 1340.00.01.02 Legal Ramifications defines How to Handle a Breach of Personal Identifiable/Sensitive DTMB Policy/Procedure 100.20 – Compliance with Identity Theft Protection Act Information Incidents
2. Lack of Security Awareness program from Agency If personnel are not educated about their security responsibilities, security safeguards and processes that have been implemented may become ineffective through errors or intentional actions and could cause: Damage to Agency reputation Loss of citizen’s trust Adhere to legal requirements Financial loss Loss of business or service to citizens Inadequate protection of sensitive or confidential information Moderate Moderate Agency create a security awareness training program in compliance with DTMB policy 1325.00 – Information Technology Security Awareness Compliance with NIST 800-53; AT-1 thru AT-4 3. Lack of Incident Response A possible breach of PII reported by citizens and Agency is not prepared to respond cause: Identity Theft Fraud Financial Loss Compromise of confidentiality and integrity of data Legal Ramifications Audit logs Low Moderate Agency is aware of and creates incident response plan in compliance with: DTMB policy 1340.00 – Information Technology Information Security Policy; establishes how information security be implemented to protect SOM information from unauthorized access, use, disclosure, modification destruction, or denial and to ensure confidentiality, integrity and availability of SOM information. DTMB procedure 1340.00.01.02 defines How to Handle a Breach of Personal Identifiable/Sensitive DTMB Policy/Procedure 100.20 – Compliance with Identity Theft Protection Act Information Incidents