Security Services Information The solution includes the following services and access to supporting toolkits: Technology Risk baseline: Establish and monitor a Governance, baseline security risk posture using leading industry standard such as the Risk, and National Institute of Standards and Technology (NIST), Cyber Security Compliance Framework (CSF), consistently across Solution the Commonwealth enterprise. Risk baseline identifies presence of similar weaknesses across the enterprise, and provides a correlation of root Service Description causes. Regulatory compliance: Develop The IT GRC solution provided by OA/OIT competency on Commonwealth and EISO encompasses a cyber-security risk federal regulations to assist agencies framework which will show an enterprise an organizational view of security and IT to perform periodic audits and review risk across the enterprise agency. The – for readiness. solution can be accessed by IT and Establish and monitor an enterprise business executives to view enterprise Plan of Action & Milestones (POA&M): and agency risk, risk scores, and risk This helps identify and establish mitigation strategies. The solution collaboration of agencies to provides an avenue to tie cyber to business risk across all agencies, and implement similar safeguards. POA&M provides compliance metrics and will be continuously monitored for reporting to IT admins, IT leaders up to completion of milestones. the Governor cabinet level. The solution Security policy exception can be used to: management: Maintain and monitor Implement a cost effective IT GRC agency and datacenter exceptions to solution. Commonwealth’s established security Assess IT risk across the enterprise. policy and risk baseline/POA&M. Show compliance maturity. Financial risk management: Support Assist agencies with tracking & the Commonwealth’s comptroller mitigating IT risks. team to use OA EISO risk Show an enterprise and agency level management automation for IT risk score to all stakeholders. financial/cost management. Vulnerability assessment and penetration testing: Perform periodic assessments on the Commonwealth’s IT assets. What is Included Security Incident Management: Provide an enterprise platform OA
Security Services Information Technology Governance, Risk, and Compliance Solution Service Description The IT GRC solution provided by OA/OIT EISO encompasses a cyber-security risk framework which will show an enterprise an organizational view of security and IT risk across the enterprise – agency. The solution can be accessed by IT and business executives to view enterprise and agency risk, risk scores, and risk mitigation strategies. The solution provides an avenue to tie cyber to business risk across all agencies, and provides compliance metrics and reporting to IT admins, IT leaders up to the Governor cabinet level. The solution can be used to: Implement a cost effective IT GRC solution. Assess IT risk across the enterprise. Show compliance maturity. Assist agencies with tracking & mitigating IT risks. Show an enterprise and agency level IT risk score to all stakeholders. What is Included The solution includes the following services and access to supporting toolkits: Risk baseline: Establish and monitor a baseline security risk posture using leading industry standard such as the National Institute of Standards and Technology (NIST), Cyber Security Framework (CSF), consistently across the Commonwealth enterprise. Risk baseline identifies presence of similar weaknesses across the enterprise, and provides a correlation of root causes. Regulatory compliance: Develop competency on Commonwealth and federal regulations to assist agencies to perform periodic audits and review for readiness. Establish and monitor an enterprise Plan of Action & Milestones (POA&M): This helps identify and establish collaboration of agencies to implement similar safeguards. POA&M will be continuously monitored for completion of milestones. Security policy exception management: Maintain and monitor agency and datacenter exceptions to Commonwealth’s established security policy and risk baseline/POA&M. Financial risk management: Support the Commonwealth’s comptroller team to use OA EISO risk management automation for financial/cost management. Vulnerability assessment and penetration testing: Perform periodic assessments on the Commonwealth’s IT assets. Security Incident Management: Provide an enterprise platform OA
OA-OIT-Service-Catalog.docx