Data Retention 45 Days, copied every 15 45 Days, copied every 15 45 Days, copied minutes minutes every 15 minutes Audit - internal Department Heads and data Department and data No audit controls custodians responsible for custodians responsible for needed. confidential data must restricted data. Periodic actively review their data review of data access is process and procedures for required. potential Flags’, misuse ‘Red or unauthorized access. Audit - external The Information Security The Information Security No controls Officer is required to Officer is required to needed. periodically scan and detect periodically scan and detect possible breaches in possible breaches in departmental security. departmental security. Protection The use of IPS/IDS, Firewall, Scanning of departmental management, data to ensure correct user encrypted wireless and access and no PII is stored daily review of logs to wrongly. thwart possible breaches. Protection - user User client device has User client device has No restrictions adequate patch adequate patch because we have no management, Antivirus, management, Antivirus, control over Anti-Malware installed and Anti-Malware installed. computers. file encryption if needed. DATA CRITERIA AND CLASSIFICATION DATA STORAGE AND TRANSMISSION DATA EXAMPLES:
Data Retention 45 Days, copied every 15 minutes 45 Days, copied every 15 minutes 45 Days, copied every 15 minutes Audit - internal Department Heads and data custodians responsible for confidential data must actively review their data process and procedures for potential ‘Red Flags’, misuse or unauthorized access. Department and data custodians responsible for restricted data. Periodic review of data access is required. No audit controls needed. Audit - external The Information Security Officer is required to periodically scan and detect possible breaches in departmental security. The Information Security Officer is required to periodically scan and detect possible breaches in departmental security. No controls needed. Protection The use of IPS/IDS, Firewall, management, encrypted wireless and daily review of logs to thwart possible breaches. Scanning of departmental data to ensure correct user access and no PII is stored wrongly. Protection - user User client device has adequate patch management, Antivirus, Anti-Malware installed and file encryption if needed. User client device has adequate patch management, Antivirus, Anti-Malware installed. No restrictions because we have no control over computers. DATA CRITERIA AND CLASSIFICATION DATA STORAGE AND TRANSMISSION DATA EXAMPLES: