WIXLIB

USG INFORMATION TECHNOLOGY HANDBOOKVERSION 2.9.25/1/2020SENSITIVEAbstract: USG Information Technology Handbook’s purpose is to primarily set forth the essentialstandard components USG organizations must follow to meet statutory or regulatory requirements ofthe federal government and state of Georgia, BOR policy, and IT best practices. Secondly, it is designedto provide new IT professionals within the USG the necessary information and tools to performeffectively. Finally, it serves as a useful reference document for seasoned professionals at USGorganizations who need to remain current with changes in federal and state law, and BOR policy

USG Information Technology Handbook 2.9.2SensitiveUniversity System of GeorgiaPage iSensitive

USG Information Technology Handbook 2.9.2University System of GeorgiaIntroductionThe University System of Georgia (USG) comprises public institutions of higher learning, a UniversitySystem Office, Georgia Public Library System (GPLS), Shared Services Center (SSC), Georgia Archives, andGeorgia Film Academy; hereinafter referred to as USG organizations. These USG organizations representthe rich diversity of a state system spanning the spectrum of educational and research offerings. Thismanual respect the value of the diversity of USG organizations while providing guidance with regards toinformation technology (IT) operations within the USG.Version ControlDateNameVersionDescription of Change04/18/2016Revised cost estimate05/02/2016PDF, structure and format.2.0Initial redesign referenced in a new structure and format.05/17/2016System-level password informationadded.2.1Section 5.12.3 – added a statement about system-levelpasswords in bullet point number 4.05/27/2016Updated flow chart2.2Section 3.1 – updated “Recommended Process Flow Chart” addedto match content.05/27/2016Introduction to the IT Handbook2.2Section Introduction – updated entire section.11/1/2016Department title changed2.3As of Nov. 1, 2016, the department name changed toCybersecurity.11/3/2016Revised Domain Name System2.3Section 5.13 – content in section was updated and revised.11/3/2016Domain Name System Guidelines2.3Section 5.13 – added link to the revised Domain Name System(DNS) Guidelines.11/3/2016Addition to USG organizations2.3Section Introduction – Georgia Film Academy added to the list ofUSG organizations.11/17/2016Clarification of information system owner2.4Section 1.3.2 – added clarification of information system ownerroles and responsibilities within the framework of people,process and technology.11/17/2016Spending limits updated2.4Section 4.1 – updated spending limits for purchases in excess of 1 million.05/15/2017Revised section for consistency in formatand content. Added title.2.5Section 1.2 – added the correct title to 1.2.1.05/15/2017Revised section for consistency in formatand content.2.5Section 1.3 – deleted a misplaced word.05/15/2017Revised section for consistency in formatand content. Changed location ofdefinitions.2.5Section 3.0 – added definitions from 3.1 and deleted definitionsalready stated in Introduction section.SensitiveSection 4.1 – added a statement in IT Procurement Policies.P a g e iiSensitive

USG Information Technology Handbook 2.9.2University System of Georgia05/15/2017Revised section for consistency in formatand content. Changed location ofdefinitions.2.5Section 3.1 – moved definitions to 3.0.05/15/2017Revised section for consistency in formatand content. Deleted exceptions.2.5Section 3.2 – deleted exceptions to log management standard.05/15/2017Revised section for consistency in formatand content. Added ac curate titles anddeleted standard.2.5Section 3.3 – provided accurate title for ISO and deletedmanagement of USG continuity of operations planning standard.05/15/2017Revised section for consistency in formatand content. Deleted table.2.5Section 5.3 – added “USG organizations” as stated in theIntroduction section, changes made to the USG IncidentResponse and Reporting Standard and deleted IncidentCategories and Reporting Timeframes table.05/15/2017Revised section for consistency in formatand content.2.5Section 5.10 – added content for clarification.09/07/2017Reviewed and revised entire Section 5 forconsistency of content2.6Section 5 – Added “USG organizations” as stated in theIntroduction section and other minor editorial changes removingpolicy and standard where appropriate.09/07/2017Incorporated revisions in Section 5 byUniversity of North Georgia2.7Section 5 – Incorporated minor editorial changes recommendedby University of North Georgia.01/02/2019Revised Section 5.10 to align with theNIST framework and FIPS.2.8Revisions to required security reporting activities withcorresponding due dates. Changed ISPR to CPR and revisedcomponents. New sub section “Remediation and MitigationTracker” added.03/18/2019Migration2.9Migrated to MS Word format, Export to PDF. Relocated Section 9to the BPM. Value added Appendix: References, Glossary,Acronyms, and Index. Updated BOR policy reference from section11 to section 10.02/24/2020Incident Management2.9.1Section 5.3 – Updated language, added baseline requirementsand template to submit a plan for review.02/24/2020Awareness Training2.9.1Section 5.9 – Updated language to align with Section 5.10.02/22/2020Required Reporting2.9.1Section 5.10 – Updated language and diagram to include biannualawareness training requirements.02/22/2020Multifactor Authentication2.9.1Section 3.1.2 – Added section to standardize MFA deploymentacross the USG enterprise.04/30/2020Strike “Section”2.9.2Section 3.1.2 –Standardized MFA deployment heading.04/30/2020Strike “Compliance Dates ” move to“Compliance” table pg. 182.9.2Section 3.1.2 – moved compliance information to table.04/30/2020Strike extra space and add “All recoveryplanning must include lessons learnedand update recovery strategies.”2.9.2Section 3.3.1 – editorial change, and CSF alignment.SensitiveP a g e iiiSensitive

USG Information Technology Handbook 2.9.2University System of Georgia04/30/2020Add “, or dependent” and add bullet 1“Create, implement, maintain and testbackup and recovery plan .”2.9.2Section 3.3.1 – editorial change, and CSF alignment.04/30/2020Add bullet 2 “, and to provide timelycommunication.” And add bullet 3 “Thecommunication controls ensure thatinformation .”2.9.2Section 3.3.1 – editorial change, and CSF alignment.04/30/2020Add “continuous”2.9.2Section 5.1.1 – editorial change, and CSF alignment.04/30/2020Add bullet 3 “expected dataflowdiagrams,” and add bullet 4 “expecteddataflow diagrams,”2.9.2Section 5.1.2 – editorial change, and CSF alignment.04/30/2020Editorial corrections #6, and add“Principle of Least Function ”2.9.2Section 5.1.2 – editorial change, and CSF alignment.04/30/2020Add list “i. – v.” to # 5 and add “incidentalert thresholds” to #62.9.2Section 5.3.1 – editorial change, and CSF alignment.04/30/2020Add “continuous,” add “5.5.2 - Event data(logs) shall be collected and correlatedfrom sources and sensors.”2.9.2Section 5.5 and 5.5.2 – editorial change, and CSF alignment.Add “both internal and external to theorganization” and add definition “RiskRegister”04/30/2020Add “Continuously monitor ” and add “,which includes:” and list “a. – d.”2.9.2Section 5.5.5 – editorial change, and CSF alignment.04/30/2020Renumber Figure to 4/relocate referenceto bottom2.9.2Section 5.10.1 – editorial change.04/30/2020Add “principle of lease function ”2.9.2Section 5.11.7 – editorial change, and CSF alignment.04/30/2020Rebrand section title to “Domain NameSystem Management”2.9.2Section 5.13 – editorial change.04/30/2020Rebrand section title to “InformationProtection Management.” Strike space in1st paragraph, strike “of this manual”,and add “program’s protection processeswill:”. Add “To improve the protectionprocesses, ensure ” and add“information protection/”2.9.2Section 5.14 – editorial change, and CSF alignment.04/30/2020Add “or protocols” and “or protected”and strike “Information & ePrivacy”2.9.2Section 5.14.5 – editorial change, and CSF alignment.Information, in all forms, is a strategic asset to USG organizations and the USG as a system. It is theresponsibility of the Vice Chancellor and Chief Information Officer (VC/CIO), under Board of Regents(BOR) Policy 10.2 to establish, “the procedures and guidelines under which the acquisition,development, planning, design, construction/renovation, management and operation of USGtechnology facilities and systems shall be accomplished.” Part of this responsibility is to prepare aSensitiveP a g e ivSensitive

USG Information Technology Handbook 2.9.2University System of Georgiamanual of Information Technology (IT) standards and best practices to be followed by USGorganizations.The hierarchy of USG IT policies and procedures is as follows:1. BOR Policy Manual is the top-level set of Board approved policies from which all lower-level USGdocuments flow. Section 7.14 covers Identity Theft and Section 7.15 describes the RiskManagement Policy including objectives and oversight. Compliance Policy is covered in Section7.16 and defines applicability and implementation. Section 10, Information, Records &Publications Technology, covers all aspects of USG information technology including generalpolicy, IT project authorization and information security.2. USG Information Technology Handbook is a standard containing the IT requirements andrecommendations that establish acceptable IT practices for USG organizations.3. USG Organization Policies and Procedures establish the detailed practices and tools used by USGorganizations to meet the standards set forth in the USG Information Technology Handbook.4. Program or Project Policies and Procedures establish the detailed practices and tools toimplement the standards and best practices set forth in the USG Information TechnologyHandbook or USG organizations’ policies and procedures.This USG Information Technology Handbook serves several purposes. Primarily, it sets forth the essentialstandard components USG organizations must follow to meet statutory or regulatory requirements ofthe federal government and state of Georgia, BOR policy, and IT best practices. Secondly, it is designedto provide new IT professionals within the USG the necessary information and tools to performeffectively. Finally, it serves as a useful reference document for seasoned professionals at USGorganizations who need to remain current with changes in federal and state law, and BOR policy.This document provides direct links to reference information identifying the underlying source of someprocedures and to provide broader understanding of the basis for others. Thus, the InformationTechnology Handbook, while focusing on USG standards, also offers ready access to important policies,statutes and regulations that will aid the IT officer in his or her daily performance of duties.Governance, Compliance and AuthorityThe USG chief information officer fully supports this standard. USG Cybersecurity is responsible formanaging and administering this standard for all USG organizations. Authority to create this standardoriginates from the BOR Policy Manual §§ 7.14 - 16, and 10.4 as well as the USG’s Appropriate UsagePolicy.This document is subject to periodic review and revision. The current online version supersedes allprevious versions.ScopeThis standard applies to USG organizations.Implementation and ApplicabilityA system wide approach to IT operations and cybersecurity compliance shall be adopted by USGorganizations. It is expected that cybersecurity processes will be embedded into each organization’sSensitivePage vSensitive