RISK MANAGEMENT from SAM Section4842

Note: Effective January 1, 2008, the Office of Information Security (Office)restructured and renumbered the content and moved SAM Sections 4840 – 4845 to SAMSections 5300 – 5399. See also the Office's Government Online ResponsibleInformation Management (GO RIM) Web site at for statewideauthority, standards, guidance, forms, and tools for information securityactivities.

CHAPTER 4800INDEX

Transferred ownership and content to SAM Section 5300 etseq.SECURITY AND RISK MANAGEMENT POLICY from SAM Section4840.AGENCY/STATE ENTITY RESPONSIBILITIES from SAM Section4841.

RISK MANAGEMENT from SAM Section4842.

DISASTER RECOVERY PLANNING from SAM Section4843.

AGENCY INFORMATION SECURITY REPORTING REQUIREMENTS fromSAM

Section4845.

Transferred the following SAMSections:

ACCESS TO INFORMATION BY THE OFFICE OF THE LEGISLATIVEANALYST

from SAM Section 4841.8 to SAM Section4804.

ACCESS TO INFORMATION BY THE CALIFORNIA STATEAUDITOR

from SAM Section 4841.9 to SAM Section4806.

STATE INFORMATION MANAGEMENTPRINCIPLES / 4800
ACCESS TO INFORMATION BY THE OFFICEOF THE LEGISLATIVEANALYST / 4804
CALIFORNIA STATEAUDITOR / 4806

STATUTORY PROVISIONS ANDAPPLICATION

STATUTORYPROVISIONS / 4810
AGENCY INFORMATION OFFICER AND STATE ENTITYCHIEF INFORMATION OFFICERRESPONSIBILITIES / 4815
GENERAL / 4819
Definitions / 4819.2
State Information Management Authority AndResponsibility / 4819.3
BasicPolicy / 4819.31

(Continued)

Chapter 4800 Index (Cont.1)

Project ApprovalAuthority / 4819.34
Project ApprovalLifecycle / 4819.35
ProjectReporting/Oversight / 4819.36
Project ReportingCriteria / 4819.37
Reporting ExemptionRequest / 4819.38
Delegated CostThreshold / 4819.39
Expenditures For Ongoing Information TechnologyActivities / 4819.40
ProcurementCertification / 4819.41
Budget ChangeProposals / 4819.42

CERTIFICATIONREQUIREMENTS

CERTIFICATION OF COMPLIANCE WITHPOLICIES / 4832
INFORMATION TECHNOLOGY ACCESSIBILITYPOLICY / 4833
EXCEPTIONS TOACCESSIBILITY / 4833.1
INFORMATION TECHNOLOGY INFRASTRUCTUREPOLICY / 4834
CALIFORNIA SOFTWARE MANAGEMENTPOLICY / 4846
Software ManagementPlan / 4846.1
Software Management Policy ReportingRequirements / 4846.2

IT PERSONNEL MANAGEMENT – ORGANIZATION, STAFFING, ANDTRAINING

STATUTORYREFERENCES / 4851
TRAINING AND EMPLOYEEDEVELOPMENT / 4854

STATE INFORMATION MANAGEMENTPRINCIPLES4800

(Revised6/2015)

The California Department of Technology (Department of Technology) hasbroad responsibility and authority to guide the application of information technology (IT)in California State Government. The Department of Technology’s areas ofresponsibility include policy making, interagency coordination, IT budget and procurementreview, technical assistance, and advocacy. In view of the scope of these activities andtheir potential impact on state government, the Department of Technology has articulatedthe fundamental principles, policies, and procedures to govern the use of IT inSections 4800 through 5180 of the State Administrative Manual(SAM).

Note that any and all project approvals or conditions made by the DepartmentofTechnology’s predecessor organizations, the California TechnologyAgency (CTA) prior to July 1, 2013, the Office of the State Chief Information Officer(OCIO) prior to January 1, 2011, or the Department of Finance (Finance) priorto

January 1, 2008; remain in effect unless otherwisenotified. Priority of InformationTechnology.

Information technology (IT) is an indispensable tool of modern government.Accordingly, each Agency/state entity is expected to seek opportunities to use this technologyto increase the quality of the services it provides and reduce the overall costof government.

Authority andResponsibility.

Each Agency/state entity director should be knowledgeable about theinformation requirements and information management practices of the Agency/state entityand should provide active leadership in the exploration of new opportunities to use IT.Each Agency/state entity should establish clear lines of authority and responsibilityfor informationmanagement.

Management ofInformation.

Each Agency/state entity shall establish and maintain an informationmanagement function consistent with its own operational needs and organizational structure.This function shall serve to ensure the Agency/state entity’s ability to identify theinformation it collects, maintain the integrity and security of the information, and providefor appropriate access to theinformation.

ManagementMethods.

Each Agency/state entity shall employ proven management methodologies to guideand control the planning, acquisition, development, operation, maintenance, andevaluation of information management applications. Pilot projects and/or independentoversight shall be required for larger, more complexapplications.

(Continued)

STATE INFORMATION MANAGEMENTPRINCIPLES4800 (Cont.1)

(Revised6/2015)

Basis forDecisions.

Decisions regarding the application of IT shall be based on analysis of overall costsand benefits to the people of California over the life of the application. EachAgency/state entity shall plan far enough into the future to ensure that adequate time is availablefor analysis of alternatives, for obtaining necessary management approvals, and forthe administration of procurements. Agencies/state entities shall determine the impactof their decisions across Agency/state entity lines and give priority to alternativesthat provide the greatest benefit from a statewideperspective.

Record ofDecisions.

Each Agency/state entity shall maintain records of management decisionsconcerning the use of IT. These records must be sufficiently detailed to satisfy the requirementsof oversight agencies as well as internal management. The records must addresssuch topicsas:

1.Identification of IT needs;

2.Setting of priorities for applications ofIT;

3.Evaluation of applicationalternatives;

4.Project management andcontrol;

5.Contingency planning and risk management;and,

6.Operational controls and maintenanceprovisions.

Agency/State EntityPersonnel.

Agency/state entity managerial, technical and user personnel should possessthe knowledge and skills necessary to use IT to the best advantage for the state.Each Agency/state entity should regularly assess the IT skills and knowledge of itspersonnel in relation to job requirements, identify and document training needs, andprovide suitable training within the limits of availableresources.

(Continued)

Compatibility.

In selecting or developing applications of IT, each Agency/state entity shall considerthe benefits and costs of maintaining compatibility with other planned andexisting applications within the Agency/state entity and in other Agencies/state entities.Such consideration of compatibility shall include computer languages, applicationsand system software, computer hardware and telecommunications equipment, dataformats, and the specific knowledge and skills required of statepersonnel.

Procurement.

In acquiring equipment, software, and services involving IT, Agencies/state entitiesshall seek maximum economic advantage to the state. Procurements shall normallybe competitive, in conformance with the applicable sections of the Public ContractCode and SAM. Agencies/state entities shall use master contracts whenever thefunctional requirements for which the contract was awarded are substantially the same asthe Agency/state entity’srequirements.

CostAllocation.

Each Agency/state entity shall adopt policies and establish procedures forassignment of costs associated with IT by program or operational unit within the Agency/stateentity, as well as for the assignment and recovery of the costs of services provided toother Agencies/state entities, private individuals, andorganizations.

RiskManagement.

Each Agency/state entity shall adopt and maintain a risk management program forthe purpose of identifying and avoiding or minimizing threats to the security of informationit maintains and the operational integrity of its information systems,telecommunications systems, and databases.

(Continued)

STATE INFORMATION MANAGEMENTPRINCIPLES4800 (Cont.3)

(Revised6/2015)

Documentation.

Applications of IT shall be fully documented with respect to the needs of (1)non- technical users; (2) technical personnel; (3) Agency/state entity measurement; and(4) outside auditors. The adequacy of documentation shall be an evaluation criterion inall procurements involving IT (equipment, software, services andtelecommunications facilities). Project plans shall include specific provision for the creation ofsuitable documentation.

Provision forEmergencies.

In planning for the use of automated information systems andtelecommunications facilities, Agencies/state entities shall develop policies and procedures to be followedin times of emergency; when systems are preempted to preserve the publichealth, welfare or safety; and when other events occur which prevent reliance onautomated systems for extended periods oftime.

IndividualRights.

Information management policies and procedures shall be consistent with theCalifornia Constitution, the Public Records Act, the Information Practices Act, and otherapplicable laws. Each Agency/state entity shall safeguard the right to privacy of individuals whoare the subjects of the records itmaintains.

Ethics.

In the conduct of their operations and in the accomplishment of the policiesstated above, Agencies/state entities and their employees shall employ IT in a legal andethical manner consistent with government statues, rules and regulations. IT shall not beused for purposes that are unrelated to the Agency/state entity’s mission or that violatestate or federal law. Contract provisions, including software licensing agreements, shallbe strictlyfollowed.

ACCESS TO INFORMATION BY THEOFFICE

OF THE LEGISLATIVEANALYST4804

(Reviewed6/2015)

Section 11534 (f) of the Government Code requires that procedures be publishedin SAM to allow the Legislative Analyst to use data in, or products of, statedata processing information systems to analyze programs andbudgets.

In order to enable the Legislature to determine the fiscal or program effects ofchanges

(1)proposed by the Administration or (2) considered by the Legislature,any Agency/state entity operating an automated information system shall, upon receivinga written request, allow the Legislative Analyst reasonable access to any relevantdata contained in the system's master files, transaction files, history files and/orother appropriate automatedfiles.

However, such access shall not be provided to information: (1) specificallyprohibited by Federal law or (2) relating to proposed administrative actions (such asBudget Change Proposals submitted by individual Agencies/state entities) not yet approvedby theAdministration.

It is the responsibility of the Agency/state entity to which the information pertainsto ensure that any data made available under these provisions are as accurate andup-to- date as is consistent with the Agency/state entity’s normal use ofdata.

The Legislative Analyst must agree that any confidential information obtainedunder these provisions shall remainconfidential.

ACCESS TO INFORMATION BY THE CALIFORNIA STATEAUDITOR4806

(Revised6/2015)

Section 11534 (f) of the Government Code requires that procedures be publishedin SAM to allow the Auditor General in the conduct of his/her audit to use data in,or products of, state data processing information systems. Section 8545.2 ofthe Government Code provides that the Auditor General shall have access to, andauthority to examine, records of any Agency/state entity. Section 8543.1 of theGovernment Code provides that the Auditor General shall examine and report annually uponthe financial statements of the state and make special audits and investigations,including performance audits, of any Agency/stateentity.

In order for the Auditor General to conduct these audits in an expeditious manner,any Agency/state entity operating a statewide information system shall, upon receivinga written request, allow the Auditor General "read only" access to any relevantdata contained in the system's master files, transaction files, history files and/orother appropriate automatedfiles.

The Agency/state entity operating the information system is authorized to requirethe Auditor General to reimburse it for any additional costs incurred as a direct result ofthe Auditor General's acquisition of data from thesystem.

It is the Auditor General's responsibility to check with the individualAgencies/state entities to which the information pertains to ensure that any data acquired underthese provisions are accurate andup-to-date.

Any confidential information obtained by the Auditor General under theseprovisions shall remainconfidential.

STATUTORY PROVISIONS ANDAPPLICATION

STATUTORYPROVISIONS4810

(Revised1/2016)

The following provisions apply to all Agencies/state entities. State entities includeevery state office, officer, department, division, bureau, board, and commission,including Constitutional Officers. State entities do not include the University ofCalifornia, California State University, the State Compensation Insurance Fund, the Legislature,or the Legislative Data Center in the Legislative CounselBureau.

California Department ofTechnology:

Pursuant to Government Code Sections 11545 and 11546, the Director of theCalifornia Department of Technology is charged with the duty to advise the Governor onthe strategic management and direction of the state's information technology (IT)resources. In addition to this advisory role, the Department of Technology is responsiblefor: establishing, maintaining, and enforcing the State's IT strategic plans,policies, standards, procedures, and enterprise architecture; approval and oversight ofIT projects; approval and oversight of IT procurements for reportable projects wherethe procurement has not been delegated by DGS to the department ; consultingwith Agencies/state entities during initial project planning; and suspending, reinstating,or terminating ITprojects.

Department ofFinance:

Pursuant to Government Code Section 11547, the Department of Finance shallperform fiscal oversight of the state's IT projects. The oversight shall consist of adetermination of the availability of project funding from appropriate sources and projectconsistency with state fiscalpolicy.

SAM – INFORMATIONTECHNOLOGY

(California Department ofTechnology)

AGENCY INFORMATION OFFICER AND STATEENTITY

CHIEF INFORMATION OFFICERRESPONSIBILITIES4815

(Revised6/2015)

Within the authority of Government Code (GC) Section 11545 and 11546, theDirector of the California Department of Technology shall be responsible forproviding technology direction to Agency Chief Information Officers (AIOs) and state entityChief Information Officers (CIOs)to:

1.Integrate statewide technologyinitiatives,

2.Ensure Agencies/state entities are in compliance with IT and securitypolicies and standards,and

3.Promote the alignment and effective management of ITresources.

Agency InformationOfficers

All Agency Information Officers (AIOs) are responsible for overseeing themanagement of IT assets, projects, data systems, infrastructure, services andtelecommunications through the oversight and management of department CIOs. Each AIO isresponsible for developing an Agency Enterprise Architecture to rationalize, standardizeand consolidate IT infrastructure, data, and procedures for all state entities withintheir Agency.

Specific responsibilities for the AIOs are published in the State AdministrativeManual (SAM), Technology Letters (TLs), and the Statewide Information ManagementManual (SIMM). Each AIO must be compliant with the responsibilities as described inSAM, SIMM, andTLs.

(Continued)

Chief InformationOfficers

State entity CIOs are directly responsible for all IT activities within the state entity.CIOs are responsible for all IT systems, assets, projects, purchases, and contracts andwill ensure state entity conformity with the Agency Enterprise Architecture. Stateentity CIOs are also responsiblefor:

Portfolio management of the state entity’s technologyinitiatives.
Operational oversight of IT functions, IT personnel and operationsincluding:
Web applicationdevelopment;
Application and database management;
Securityadministration;
Telecommunications;
Project planning, consulting, and management;and
Help desk and customer servicemanagement.

AIOs and CIOs must be in compliance with state IT policies and proceduresas described in SAM, SIMM and TechnologyLetters.

Non-Affiliated Chief InformationOfficers

With the exception of the responsibilities related to the oversight ofAgency-affiliated state entity CIOs, non-affiliated Agency/state entity CIOs have the sameresponsibilities as AIOs. In addition, non-affiliated Agency/state entity CIOs also have thesame responsibilities as Agency-affiliated state entityCIOs.

(Continued)

Reporting

AIOs and CIOs are accountable to the Director of the Department of Technologywith respect to technology direction, including, but not limited to, IT policy, planningand management.

All state employees in IT classifications, and all other state employees orcontractors performing IT activities and/or functions must be in a direct reporting relationship tothe appropriate AIO orCIO.

Consistent with the federated governance model, the Department of Technologywill work with the Agencies/state entities to implement this operating model in a waythat aligns with their businessoperations.

STATUTORY PROVISIONS ANDAPPLICATION/GENERAL 4819

(Revised06/2015)

The State Administrative Manual (SAM) Section 4819 provides definitionsand summarizes the compliance requirements for the administration ofinformation technology (IT) in state government. Additional detail regarding specificrequirements, policies or procedures is provided throughout SAM Sections 4800–5953, SAMSections 6700 – 6780, and the Statewide Information Management Manual(SIMM).

DEFINITIONS4819.2

(Revised07/2016)

The following definitions of administrative and technical terms are provided toassist Agencies/state entities in their application of information technology (IT)policy.

The primary source for technical definitions is the Information ProcessingSystems Technical Report, American National Dictionary for Information ProcessingSystems, developed by the American National Standards Committee, X3 InformationProcessing Systems. In some cases the definitions have been modified to meet stateneeds.

Accessibility/Accessible: Individuals with disabilities are able to acquire the same information, engage in the same activities, perform the same functions, and access the same content and services as individuals without disabilities, with similar ease.

Agency: This term refers to one of the state's super Agencies such as theBusiness, Consumer Services and Housing Agency or the Health and Human ServicesAgency.

Agency Information Management Strategy: An Agency/state entity’sinformation management strategy is the Agency/state entity’s comprehensive plan for using ITto address its business needs, i.e., to successfully carry out its programmaticmission. Ideally, the Agency/state entity’s information management strategy representsone aspect of a well-defined overall Agency/state entity business strategy and istherefore closely aligned to its business strategy. If the Agency/state entity has not establisheda business strategy, Agency/state entity staff that are responsible for theAgency/state entity information management strategy must make assumptions based ontheir knowledge of the Agency/state entity’s overall mission, its program resourcesand priorities, and the changing nature of itsenvironment.

Ancillary Solicitation: An acquisition that may be necessary to achieve and/orsupport the primary procurement activities and objectives of an IT project. An IT project maybe supported by many AncillarySolicitations.

Assistive Technology: Any item, piece of equipment, software, or system that is designed to increase, maintain, or improve the functional capabilities of individuals with disabilities.

(Continued)

DEFINITIONS4819.2(Cont.1)

(Revised 07/2016)

Baseline(d): An approved time phased plan for project work against whichproject execution is compared to measure and manage cost and schedule performance.A project must be baselined in accordance with the milestones in the approvedProject Approval Lifecycle Stage 4 Project Readiness and Approval. A project may not bere- baselined unless an approved Special Project Report (SPR) isavailable.

Business Strategy: An Agency/state entity’s business strategy is its overall planfor accomplishing its mission in a changing environment with the resources itcan reasonably expect to be available. Such a strategy typically addresses theAgency/state entity’s statutory mission and historical role, the expectations of its keystakeholders (individuals and organizations that affect the Agency/state entity or thatthe Agency/state entity affects), the factors that are critical to its success asan organization, the Agency/state entity’s internal strengths and weaknesses, andthe political, social, economic, and technological forces in its environment that supportor constrain its programs. Business strategies articulate the key issues that mustbe successfully addressed by the Agency/state entity and identify the prioritiesand required resources for proposed actions. A strategy may have a time frame that isas short as a few months. However, most Agency/state entity business strategiespresent a three- to five-year perspective, with some Agencies/state entities finding it usefulto extend their strategic vision as much as ten to twenty years into the future.Strategic planning is not a one-time effort; it is a fundamental, continuing managementprocess that allows the Agency/state entity to respond in an effective manner to achanging environment.