Gap Analysis to Support the Implementation of the South Carolina Data Protection and Privacy Policy The below Gap Analysis is developed based on the feedback provided by the policy implementation team of the (SC State Agency). The table outlines the policy requirements (procedures, standards and policies which may/may not be implemented), relevant questions to address and identify gaps in the Agency’s environment. Policy Requirement Questions asset inventory? YES , NO Gap Comments or N/A InfoSec Policy has been reviewed and approved by the Has the InfoSec Policy been reviewed and approved by key stakeholders. the key stakeholders? InfoSec Policy has been approved and received sign off by Has the policy been approved and received sign off by the authorized executives. the authorized executive? The policy has been socialized across the Agency for Has the policy been shared with all personnel personnel awareness. Does your Agency have a documented Data Protection Information asset data (electronic and hard-copy) is and Privacy policy? classified into one of the following categories: Is the policy aligned with the State of South Carolina Data Public Protection and Privacy Policy? Internal Use Confidential Does your Agency classify information asset data in Restricted accordance with Federal, State, regulatory and statutory guidelines? Does your Agency use a specific tool for data classification (i.e. data inventory)? If you classify data, do you do so by using the State of South Carolina Data Classification Schema? Does your Agency have personnel assigned with responsibility to classify information asset data? Is there a periodic review of asset data classification for accuracy? Has your Agency developed procedures for Information Develop and maintain Information Labeling and Handling Labeling and Handling based on data classification? procedures. Does your Agency have an exception process whereby the information labeling and handling is not required?
Gap Analysis to Support the Implementation of the South Carolina Data Protection and Privacy Policy The below Gap Analysis is developed based on the feedback provided by the policy implementation team of the (SC State Agency). The table outlines the policy requirements (procedures, standards and policies which may/may not be implemented), relevant questions to address and identify gaps in the Agency’s environment. Policy Requirement Questions asset inventory? YES , NO or N/A Gap Comments InfoSec Policy has been reviewed and approved by the key stakeholders. Has the InfoSec Policy been reviewed and approved by the key stakeholders? InfoSec Policy has been approved and received sign off by the authorized executives. Has the policy been approved and received sign off by the authorized executive? The policy has been socialized across the Agency for personnel awareness. Has the policy been shared with all personnel Information asset data (electronic and hard-copy) is classified into one of the following categories: Public Internal Use Confidential Restricted Does your Agency have a documented Data Protection and Privacy policy? Is the policy aligned with the State of South Carolina Data Protection and Privacy Policy? Does your Agency classify information asset data in accordance with Federal, State, regulatory and statutory guidelines? Does your Agency use a specific tool for data classification (i.e. data inventory)? If you classify data, do you do so by using the State of South Carolina Data Classification Schema? Does your Agency have personnel assigned with responsibility to classify information asset data? Is there a periodic review of asset data classification for accuracy? Develop and maintain Information Labeling and Handling procedures. Has your Agency developed procedures for Information Labeling and Handling based on data classification? Does your Agency have an exception process whereby the information labeling and handling is not required?
Gap%20Analysis%20-%20Data%20Protection%20and%20Privacy%20Policy%20-%2027Mar2014.docx