Question Requirement Response Describe An individual has been designated as being responsible Yes 1. for security within the organization. No n/a An information security policy, based on industry acceptable standards and frameworks, is in place, has Yes 2. been approved by management and has been No communicated to employees, contractors and n/a individuals working on behalf of the organization. Security roles and responsibilities of employees, contractors and individuals working on behalf of the Yes 3. organization are defined and documented in No accordance with the organization’s information security n/a policy. An information security awareness and training Yes program has been established and provides general 4. No awareness and role specific (e.g., secure coding, CJIS, n/a etc.) security training to all employees. Background screenings of employees, contractors and Yes individuals working on behalf of the organization are 5. No performed to include criminal, credit, professional / n/a academic, references and drug screenings. The organization will: (1) locate all production and disaster recovery data centers that store, process or transmit State of Minnesota data only in the Yes continental United States, (2) store, process and 6. No transmit State of Minnesota data only in the n/a continental United States, and (3) locate all monitoring and support of all the cloud computing or hosting services only in the continental U.S. The system/solution/service provides password protection and security controls to prevent Yes 7. unauthorized access to or use of the system, data, and No images. Proposed system solutions will ensure Industry n/a best practices for security architecture & design.
Question Requirement Response Describe 1. An individual has been designated as being responsible for security within the organization. Yes No n/a 2. An information security policy, based on industry acceptable standards and frameworks, is in place, has been approved by management and has been communicated to employees, contractors and individuals working on behalf of the organization. Yes No n/a 3. Security roles and responsibilities of employees, contractors and individuals working on behalf of the organization are defined and documented in accordance with the organization’s information security policy. Yes No n/a 4. An information security awareness and training program has been established and provides general awareness and role specific (e.g., secure coding, CJIS, etc.) security training to all employees. Yes No n/a 5. Background screenings of employees, contractors and individuals working on behalf of the organization are performed to include criminal, credit, professional / academic, references and drug screenings. Yes No n/a 6. The organization will: (1) locate all production and disaster recovery data centers that store, process or transmit State of Minnesota data only in the continental United States, (2) store, process and transmit State of Minnesota data only in the continental United States, and (3) locate all monitoring and support of all the cloud computing or hosting services only in the continental U.S. Yes No n/a 7. The system/solution/service provides password protection and security controls to prevent unauthorized access to or use of the system, data, and images. Proposed system solutions will ensure Industry best practices for security architecture & design. Yes No n/a