Office of the Chief Information Security Officer
Office of the Governor
8 CCR 1501-5
Rules in support of the Colorado information security act 
1.1	Authority
The authority to promulgate rules is 24-37.5-403(2)(b), C.R.S. and is intended to be consistent with the requirements of the State Administrative Procedures Act, section 24-4-101 et seq. (the “APA”), C.R.S. and the Information Security Act, sections 24-37.5,401 - 406 (the “Act”), C.R.S.
1.2	Scope and Purpose
A.	This regulation shall govern every State agency ("Agency") as defined in C.R.S 24-37.5-102(5).  "State agency" means every state office, whether legislative, executive, or judicial, and all of its respective officers, departments, divisions, commissions, boards, bureaus, and institutions.
B.	This regulation does not apply to state-supported institutions of higher education, the department of higher education, the Colorado commission on higher education, or other instrumentality thereof.
1.3	Applicability
The provisions of this section shall be applicable to all state agencies that manage and administer IT systems intended to store, process, or transmit data.
1.4	Definitions

ACSP – Agency Cyber Security Plan
Access Control - Access controls are typically logical controls designed into the hardware and software of a computing system. Identification is accomplished both under program control and by using physical controls.
CCSP – Colorado Cyber Security Program
Change Control - Process for controlling modifications to hardware, firmware, software and documentation to ensure the information system is consistently available to users and the system and data it contains are protected from improper modification before, during, and after the system implementation.
Configuration Management - Process for consciously configuring hardware, firmware, software, and documentation to ensure the information system is protected against improper use or unintended failure before, during and after system implementation. 
Cyber Security Incident - Any event, suspected event, condition, and/or vulnerability that could pose a threat to the confidentiality, integrity, or availability of systems, applications, or data.  
Enclave - A security Enclave is a logical boundary surrounding all resources that are controlled and protected. The protected resources are called a domain (or enclave or protected subnetwork). There may be overlapping domains of varying protection, so that the most sensitive resources are in the innermost domain, which is the best protected. Protecting the security perimeter may be physical controls, identification and authentication, encryption, and other forms of access control.
Event - An event is any observable security occurrence in a system and/or network. 
Firewall - A method of guarding a private network by analyzing the data and applying access control rules.
General Support System - is an interconnected information resource under the same direct management control that shares common functionality.  
Information Security Officer (ISO) – a role delegated to a knowledgeable employee or contractor within an agency, responsible for supporting the agency cyber security plan.
Information Security Operations Center (ISOC) – statewide cyber security monitoring and analysis team responsible for security operations for shared state services.
Individual Accountability - requires individual users to be held accountable for their actions after being notified of the rules of behavior in the use of the system and the penalties associated with the violation of those rules.
Intrusion Detection - Intrusion detection is the process of identifying attempts to penetrate a system and gain unauthorized access.
Major Application or Major Information System - is an application that requires special attention to security due to the risk and magnitude of the harm resulting from the loss, misuse, or unauthorized access to, or modification of, the information in the application.  
Patch – Otherwise known as a software update. A patch is a piece of code that is added to software in order to fix a bug or problem. It is used most frequently as a temporary correction between two version releases.
POA&M - Plan of Action and Milestones: consists of agency remediation plans to close compliance gaps and mitigate known risks to communications and information resources.
Remote Access - Remote access is the ability to get access to a computer or a network from a remote distance. In corporations, people at branch offices, telecommuters, and people who are traveling may need access to the corporation's network.
Risk - is the possibility of harm or loss to any software, information, hardware, administrative, physical, communications, or personnel resource within an automated information system or activity.
Risk Assessment – A process used to identify and evaluate risks and their potential effects
Risk Management - is the ongoing process of assessing the risk to automated information resources and information, as part of a risk-based approach used to determine adequate security for a system by analyzing the threats and vulnerabilities and selecting appropriate cost-effective controls to achieve and maintain an acceptable level of risk.
Security Incident - Means an accidental or deliberate event that results in or constitutes an imminent threat of unauthorized access, loss, disclosure, modification, disruption, or destruction of communication and information resources.
SDLC – System Development Life Cycle: a process that each agency deploys to manage the acquisition, development, deployment, maintenance and replacement of systems.

1.5	State Agency Cyber Security Planning

A.	It is the policy of State of Colorado to prohibit unauthorized access, disclosure, duplication, modification, diversion, destruction, loss, misuse or theft of sensitive electronic information assets.  
1.	Each public agency in the State of Colorado shall maintain a Cyber Security Plan to control risks associated with access, use, storage and sharing of sensitive citizen and State electronic information, and document the program details in an Agency Cyber Security Plan (ACSP).  An Agency Cyber Security Plan shall include the following sections, at a minimum:
a.	Agency Mission Objectives
(1)	Mission Statement: Summarize or insert the Agency Mission Statement
(2)	Concept of Operations: Describe the operational goals of the Cyber Security Program, and the conceptual functions that are implemented to achieve these goals.
(3)	Roles and Responsibilities: Identify responsibilities for implementing, monitoring, and managing the Cyber Security Program, specifically including the responsibilities of the Executive Director, Agency ISO, Security Staff, Agency IT staff, Agency Human Resources staff, and Agency staff.
b.	Information Technology Environment
(1)	Network Environment, Enclaves, and Perimeters: Describe the current network environment in detail, including characterizing of network segments into Security Enclaves, and identify the perimeters of each Security Enclave.
(2)	Critical Systems: List Agency critical systems by name, function, and the network segments they reside on.
(3)	General Support Systems: Define general support systems as they pertain to the environment (e.g., Active Directory Domains/Forests, NIS+ domains, or Email systems).
c.	Risk Management
(1)	Risk Assessment Methodology: Describe the methodologies used for formal and informal System-level and Agency-wide Risk Assessments, and the process for initiating a Risk Assessment, mitigating unacceptable risk, approving residual risk, and updating existing Risk Acceptance.  Include the identification of the individual responsible for accepting residual risk.
(2)	Risk Assessment Responsibilities: Identify any responsibilities in the Risk Management function that are outside the scope of the Roles and Responsibilities section of the ACSP.
(3)	Risk Assessment Frequency: Identify the maximum length of time between System-level and Agency-wide Risk Assessments.
(4)	Project Lifecycle: Describe how the Risk Management strategy is integrated into System, Network, and Application engineering project lifecycles, specifically identifying control points that trigger Risk Management activities.
(5)	Vendor Management: Describe the role of Risk Management in the assessment, selection, and management of IT service providers or vendors.
d.	Security Program
(1)	Network Operations: Describe standards for Network Operations as they pertain to Network Access Controls, Perimeter Security, Network Administration, Monitoring and Reporting, and Network Device Inventory.
(2)	System and Application Security: Describe standards for System and Application Security as they pertain to Access Controls, System Administration and Engineering, Change Control and Configuration Management, Patch Management, Malicious Code, Monitoring and Reporting, and System Backups.
(3)	Access Controls: Describe standards for Hiring, Termination, and Transfer of staff and how it relates to user account administration.  Include a description of the process used to approve system access requests based on need-to-know and describe how “least-privilege” is achieved in the environment.
(4)	Change Control and Configuration Management: Describe the components of Change Control and describe the integration of the Cyber Security Program as it relates to Change Control.  Describe the minimum standards for configuration management as it relates to System, Network and Application engineering.
(5)	Physical Security: Describe the requirements for physically securing the Agency’s Sensitive Areas.
(6)	Data Handling and Disposal: Describe the procedures used to achieve the goals of the CCSP Data Handling and Disposal Policy.
(7)	Personnel Security: Describe the process for and frequency of performing background checks on IT and Security staff
(8)	Acceptable Use: Identify the required elements of the Agency’s Acceptable Use Policy and the responsibilities for ensuring all users have received and acknowledged it.
(9)	Online Privacy: Include the Agency’s Online Privacy Notice
e.	Incident Warning, Advisory, and Response
(1)	Cyber Security Warnings and Advisories: Describe the process for evaluating both Vendor and ISOC-issued Cyber Security Warnings, Patch Announcements, and Security Advisories and describe the standard for recording the response, including time frame for response, acceptable responses, and responsibilities for evaluating the Warning or Advisory.
(2)	Cyber Security Incident Response Plan Summary: Provide a summary of the Agency’s Incident Response Plan, including naming the individual(s) who lead the team.
f.	Training and Awareness
(1)	Methodology: Describe the methods for delivering Initial and Refresher Training to staff.  Describe any differing levels of Cyber Security Training that are provided to individuals holding specific job responsibilities (end user, system administrator, security administrator, and managers), if applicable.  Describe methods of providing periodic security awareness notices to Agency staff, and the responsibilities for issuing these notices.
(2)	Frequency: Identify the required frequency for Refresher Training and Security Awareness Notices.
(3)	Content Updates: Identify the role or individual responsible for providing updated training content and awareness notices.
g.	Self-Assessment: Describe the required elements of the Cyber Security Self-Assessment Process, the roles and responsibilities in carrying out the Self-Assessment, and the integration of the Self-Assessment results into a program improvement process.
h.	Metrics and Reporting: Describe the types of metrics that are being collected by the Agency Cyber Security Program and how they are being used to evaluate the effectiveness of the Program.
i.	Plan Approval and Maintenance: Identify the frequency of the ACSP updates and the roles that are responsible for making and approving the updates.  The Agency Executive Director and the Agency CIO are required approval authorities for the ACSP.
2.	To carry out the ACSP, the Agency shall delegate the position of Information Security Officer to an Agency staff member or contractor who has appropriate Cyber Security experience and Agency IT environment knowledge.
3.	Annually, on or before July 15th of each year, each agency shall submit their ACSP to the state CISO for his or her review.  The state CISO shall review and approve, conditionally approve, or disapprove each ACSP based on evaluation of the Plan and supporting documentation.
a.	Each Agency shall submit an approval package to the CISO, consisting of:
(1)	Cover letter requesting ACSP approval
(2)	Agency Cyber Security Plan (ACSP)
(3)	Agency-wide Risk Assessment
(4)	Agency Disaster Recovery Plan Summary
(5)	Agency Disaster Recovery Plan test results
(6)	Agency Self-Assessment results
(7)	Agency Cyber Security Plan of Action and Milestones (POA&M)
Documents numbered 2 through 7, above, are not public records pursuant to Sections 24-72-202 (6) (b) (X), C.R.S. and 24-72-202 (6) (b) (XII), C.R.S.  Each such document and any supporting materials shall be labeled "Confidential" and "Not a Public Record."
b.	The cover letter is an assertion to be signed by the Executive Director that either states that the Agency is compliant with the Colorado Cyber Security Program or that the Plan of Action and Milestones contains active initiatives that will bring the Agency into compliance.  
c.	The Plan of Action and Milestones is a high-level plan that describes the Cyber Security initiatives under way within the Agency.  The POA&M must include a description of initiatives, initiative priority ranking, estimated cost to the agency, major project milestones, and dates of initiation and completion.  This document shall be amended by the agency and maintained during the course of the year to reflect progress on the projects identified therein.  The POA&M may be updated by the Agency at any time throughout the year, and may be amended by the CISO at his or her discretion.
d.	The State CISO will review the submission to ensure it meets the requirements of the Colorado Cyber Security Program.  The CISO will issue one of the three following responses:
(1)	The ACSP is approved with no changes to the submitted documents.
(2)	The ACSP is conditionally approved, with the requirement to implement, continue, or complete the initiatives in the Agency Plan of Action and Milestones.  This response also may include the requirement to add specific initiatives to the Agency Plan of Action and Milestones as determined by the CISO.
(3)	 The ACSP is denied approval.  This response result in discontinuation or suspension of the public agency’s communication and information technology resources pursuant to 24.37-5.404(4), C.R.S.