Information Security Standards

Information Security Program Manual Objective & Intent

The Information Security Program Standards Manual objective is to establish minimal organizational information security standards for the State Controller’s Office (SCO) that specify how information assets are safeguarded. Information security standards facilitate SCO compliance with applicable state and federal government statutes, regulations, and directives (policies). These standards assist the SCO in the appropriate information and its technology classification, appropriate security controls implementation, and recommended business security actions and operational measures to protect SCO information assets. The SCO is committed to creating and maintaining an environment that protects SCO information assets from accidental or intentional unauthorized use, modification, disclosure, destruction, or theft. Adherence to information security standards will safeguard the confidentiality, integrity, and availability of SCO information assets and will protect the interests of the SCO, its personnel and contractors, business partners, and the general public.

This manual’s intent is to create and implement an environment that:

1. 
   Protects information and technologies critical to the SCO.
   

1. 
   Protects information as mandated by state and federal statutes, regulations, and administrative requirements.
   

2. 
   Protects confidential and sensitive information.
   
3. 
   Reinforces SCO’s reputation as an institution deserving of trust.
   
4. 
   Complies with due diligence standards for the protection of information and technologies.
   
5. 
   Assigns responsibilities to relevant SCO officers, executives, managers, personnel, contractors, and business partners.
   
6. 
   Protects SCO physical resources and those physical resources entrusted to the SCO.