[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-1-en-105":3,"doc-seo-357510-105":53,"doc-detail-357510-en":126},{"code":4,"msg":5,"data":6},0,"success",[7,14,19,24,29,34,39,44,49],{"id":8,"doc_module":9,"doc_module_name":10,"category_name":11,"show_sort_weight":12,"slug":13},11,1,"Template","Presentations",90,"presentations",{"id":15,"doc_module":9,"doc_module_name":10,"category_name":16,"show_sort_weight":17,"slug":18},12,"Resumes",80,"resumes",{"id":20,"doc_module":9,"doc_module_name":10,"category_name":21,"show_sort_weight":22,"slug":23},14,"Invoices",70,"invoices",{"id":25,"doc_module":9,"doc_module_name":10,"category_name":26,"show_sort_weight":27,"slug":28},15,"Posters",60,"posters",{"id":30,"doc_module":9,"doc_module_name":10,"category_name":31,"show_sort_weight":32,"slug":33},16,"Social Media",50,"social-media",{"id":35,"doc_module":9,"doc_module_name":10,"category_name":36,"show_sort_weight":37,"slug":38},17,"Forms",40,"forms",{"id":40,"doc_module":9,"doc_module_name":10,"category_name":41,"show_sort_weight":42,"slug":43},18,"Letters",30,"letters",{"id":45,"doc_module":9,"doc_module_name":10,"category_name":46,"show_sort_weight":47,"slug":48},21,"Paper Templates",5,"papers-templates",{"id":50,"doc_module":9,"doc_module_name":10,"category_name":51,"show_sort_weight":4,"slug":52},158,"General","general-158",{"code":4,"msg":54,"data":55},"ok",{"site_id":56,"language":57,"slug":58,"title":59,"keywords":60,"description":61,"schema_data":62,"social_meta":119,"head_meta":121,"extra_data":123,"updated_unix":125},105,"en","cyber-and-information-security-procedure-107-004-052_pr","Cyber and Information Security - Procedure 107-004-052_PR","","Enterprise Information Services (EIS) establishes agency procedures to comply with Statewide Policy 107-004-052, Cyber and Information Security. The procedure defines responsibilities and required actions for CSS assessments, including publishing the CSS Assessment Schedule, conducting security program assessments, participating in kickoff and exit briefings, delivering final reports, and maintaining POAM updates with monthly review and quarterly remediation status for critical and severe findings. It also specifies annual cybersecurity training in Workday and the workflow for identifying, disclosing, reviewing, and deciding on offshore or foreign computing services, including possible risk-mitigating conditions or discontinuation expectations.",{"@graph":63,"@context":118},[64,80,101],{"@type":65,"itemListElement":66},"BreadcrumbList",[67,71,74,77],{"item":68,"name":69,"@type":70,"position":9},"https://docshare.wps.com","Home","ListItem",{"item":72,"name":10,"@type":70,"position":73},"https://docshare.wps.com/template/",2,{"item":75,"name":36,"@type":70,"position":76},"https://docshare.wps.com/template/forms/",3,{"item":78,"name":59,"@type":70,"position":79},"https://docshare.wps.com/template/cyber-and-information-security-procedure-107-004-052_pr/357510/",4,{"url":78,"name":59,"@type":81,"image":82,"author":87,"headline":59,"publisher":90,"fileFormat":93,"inLanguage":57,"description":61,"dateModified":94,"datePublished":95,"encodingFormat":93,"isAccessibleForFree":96,"interactionStatistic":97},"DigitalDocument",{"url":83,"@type":84,"width":85,"height":86},"https://docshare.wps.com/thumbnails/cyber-and-information-security-procedure-107-004-052_pr/357510.png","ImageObject",442,249,{"name":88,"@type":89},"Bintang","Person",{"url":68,"name":91,"@type":92},"DocShare","Organization","application/pdf","2026-10-22","2026-09-23",true,{"@type":98,"interactionType":99,"userInteractionCount":47},"InteractionCounter",{"@type":100},"ViewAction",{"@type":102,"mainEntity":103},"FAQPage",[104,110,114],{"name":105,"@type":106,"acceptedAnswer":107},"What are the core responsibilities for CSS assessments in this procedure?","Question",{"text":108,"@type":109},"CSS publishes the assessment schedule, conducts agency security program assessments, and holds kickoff and exit briefings. The agency head and agency IT leader support assessments and receive final reports, while plan and milestones for remediation must be maintained through POAM updates.","Answer",{"name":111,"@type":106,"acceptedAnswer":112},"How often must the agency review and update POAM for findings and recommendations?",{"text":113,"@type":109},"The procedure requires plans of action and milestones (POAM) to be documented and reviewed at least monthly. Quarterly, the agency must deliver updated status on identifying and implementing remediations for outstanding critical and severe findings.",{"name":115,"@type":106,"acceptedAnswer":116},"What process does the agency follow for offshore or foreign computing services?",{"text":117,"@type":109},"The agency must identify current use as of the effective date and submit required disclosure elements using Attachment C. CSS reviews the request and makes recommendations to the State CIO, who decides to approve (possibly with risk-mitigating conditions) or disapprove (possibly with expectations to discontinue), followed by signed acknowledgement of the decision.","https://schema.org",{"og:url":78,"og:type":120,"og:title":59,"og:site_name":91,"og:description":61},"article",{"robots":122,"canonical":78},"index,follow",{"doc_id":124,"site_id":56},357510,1791307605,{"code":4,"msg":5,"data":127},{"doc_id":124,"user_id":128,"nickname":88,"user_avatar":129,"doc_module":9,"category_id":35,"category_name":36,"doc_title":59,"doc_description":61,"doc_content":130,"file_id":131,"file_url":132,"file_type":133,"file_size":134,"view_count":47,"is_deleted":4,"is_public":9,"is_downloadable":9,"audit_status":9,"page_count":135,"language":136,"language_code":57,"site_id":56,"html_lang":57,"table_of_contents":137,"faqs":138,"seo_title":139,"seo_description":61,"update_tm":140,"read_time":76},962085564381,"https://ap-avatar.wpscdn.com/davatar_6f874abed73319feea01a86fa6f0fab8","CYBER AND INFORMATION SECURITY \nNUMBER: 107-004-052_PR \nEFFECTIVE DATE: October 1, 2026 \nDIVISION: Enterprise Information Services (State CIO) \nPOLICY OWNER: Cyber Security Services INTERNAL/STATEWIDE: Statewide LAST REVIEWED DATE: July 28, 2026 \nSUPERSEDES: Procedure \\#107-004-052_PR (2/17/2026) \nPAGE NUMBER: Page 1 of 3 REFERENCE/AUTHORITY: \n• ORS 276A.300, 276A.303, 276A.306, 276A.323, 276A.326, 276A.329, 276A.332, 276A.335 \n• OAR 128-30 \n• Cyber and Information Security policy 107-004-052 \nAPPROVED SIGNATURE: \n_____________________________________________ \nTerrence Woods, State Chief Information Officer \nStatement \nThis procedure describes Enterprise Information Services (EIS) and agency responsibilities and actions that must be followed to comply with Statewide Policy 107-004-052, Cyber and Information Security. \nApplicability \nRefer to Statewide Policy 107-004-052, Cyber and Information Security, for applicability of this procedure. \nExhibits \n• Cyber Security Services (CSS) Assessment Schedule \n• Attachment A: CSS assessment findings and recommendations template \n• Attachment B: Plan of Action and Milestones template \n• Attachment C: Use of offshore or foreign computing services disclosure data elements \nDefinitions \nRefer to Statewide Policy 107-004-052, Cyber and Information Security, for definitions. \nProcedure \nASSESSMENTS \nRESPONSIBILITY STEP ACTION \nCyber Security Services (CSS) \nCSS \nAgency head and \nagency IT leader \nCSS \nAgency \nAgency head and \nagency IT leader \nCSS \nAgency \n1 \n2 \n3 \n4 \n5 \n6 \n7 \n8 \nBiennially, publish the CSS Assessment Schedule for two calendar years. \nSend assessment engagement letter to agency head and agency IT leader for agency assessments in the upcoming quarter. \nAttend CSS assessment engagement kickoff meeting with CSS. \nConduct assessment of agency security program. \nParticipate in CSS assessment of agency security program. \nAttend CSS assessment exit briefing where CSS will deliver and discuss findings and recommendations with the agency. \nDeliver final report to agency head and agency IT leader.(Attachment A) \nDocument plans of actions and milestones (POAM) and review at least monthly. Quarterly, deliver updated status of identifying and implementing remediations of findings and recommendations for outstanding critical and severe findings. Required POAM elements are defined in Attachment B. \nNote: CSS may meet with the agency quarterly or as needed to provide consultation for remediation of findings. \nANNUAL TRAINING \nRESPONSIBILITY STEP ACTION \nCSS \nAgency \nChief Human Resource Office and agencies as applicable \nUsers \n1 \n2 \n3 \n4 \nUpdate and upload annual cybersecurity training in Workday. \nCoordinate with CSS for scheduling training for users. \nSchedule training in Workday for all users. \nComplete annual cybersecurity training by December 31 of each year. \nOFFSHORE AND FOREIGN SERVICES \nRESPONSIBILITY STEP ACTION \nAgency \nAgency \nCSS \nState CIO or \n1 \n2 \n3 \n4 \nIdentify current use (as of the effective date of statewide policy 107-004-052) of offshore or foreign computing services. Provide the information detailed in Attachment C (Use of offshore or foreign computing services disclosure data elements) by submitting to this form. \nReview request and make recommendations to State Chief Information Officer. \nMake decision on request. \ndelegated EIS authority CSS \nAgency \n5 Respond to agency submission with decision. \nDecision to approve offshore or foreign computing services maybe accompanied by conditions for risk mitigating controls. \nDecision to disapprove offshore or foreign computing services may be accompanied by expectations for discontinuing offshore or foreign computing services. \n6 Return decision communication with signature \nacknowledgement by responsible role. \nAttachment A: CSS assessment findings and recommendations template \nFindings and Recommendations \nFinding 1: \nFinding Ti","cbCairTiAt0SV56C","https://ap.wps.com/l/cbCairTiAt0SV56C","pdf",293166,8,"English","# Statement\n# Applicability\n# Exhibits\n# Definitions\n# Procedure\n## Assessments\n## Annual Training\n## Offshore and Foreign Services","[{\"question\":\"What are the core responsibilities for CSS assessments in this procedure?\",\"answer\":\"CSS publishes the assessment schedule, conducts agency security program assessments, and holds kickoff and exit briefings. The agency head and agency IT leader support assessments and receive final reports, while plan and milestones for remediation must be maintained through POAM updates.\"},{\"question\":\"How often must the agency review and update POAM for findings and recommendations?\",\"answer\":\"The procedure requires plans of action and milestones (POAM) to be documented and reviewed at least monthly. Quarterly, the agency must deliver updated status on identifying and implementing remediations for outstanding critical and severe findings.\"},{\"question\":\"What process does the agency follow for offshore or foreign computing services?\",\"answer\":\"The agency must identify current use as of the effective date and submit required disclosure elements using Attachment C. CSS reviews the request and makes recommendations to the State CIO, who decides to approve (possibly with risk-mitigating conditions) or disapprove (possibly with expectations to discontinue), followed by signed acknowledgement of the decision.\"}]","Cyber and Information Security - Procedure 107-004-052_PR | PDF",1790130224]