Health Care Department Operations Manual

Cancel

Chapter 5 – Administrative

Article 3 – Information Technology

View All Sections >

5.3.14 Access Control

  • Policy

    • California Correctional Health Care Services (CCHCS) shall maintain appropriate access controls for all state assets as defined herein. The policy is aligned with the Access Control Family of the National Institute of Standards and Technology Special Publication 800-53, Revision 5.

  • Scope

    • This policy applies to all state employees and contracted personnel, known hereinafter as employee workforce; all information assets owned or operated by CCHCS, as well as information assets owned or operated by third parties on behalf of CCHCS.

  • Roles and Responsibilities

    • The Chief Information Officer shall:

      • Ensure all users of information assets are aware of this policy.

      • Review this policy annually and update accordingly.

      • Audit and assess compliance with this policy at least once every two years.

    • Owners of information assets and program management:

      • In collaboration with the Information Asset Custodians shall ensure that this policy is implemented, and implementation is reviewed at minimum annually.

      • Shall audit and assess user access rights and privileges to ensure alignment with individual job roles and functions on an annual basis.

    • Information Asset Custodians shall:

      • Implement user access and associated rights and privileges as requested and approved by owners of information assets.

      • In collaboration with owners of information assets, periodically review accounts with elevated privileges and verify that continued privilege account access is required.

      • In collaboration with owners of information assets shall ensure access technology and process controls are commensurate with the sensitivity or criticality of information assets under their purview.

      • Revoke or modify individual user access rights and privileges upon notification from the owners of information assets.

      • Maintain access records consistent with the retention schedule.

  • Management Commitment

    • CCHCS workforce shall adhere to CCHCS Information Security policies and procedures. CCHCS shall provide the necessary resources and training to support a secure environment.

  • Coordination Among Business Units

    • Health Care Regulations and Policy Section shall facilitate information security policy development, review and approval while ensuring cross functional participating from appropriate business.

    • This cross-organizational engagement ensures policy alignment with operational reality, clinical needs, security and privacy obligations coupled with federal and state mandates.

  • Compliance

    • Non-compliance with this policy may result in corrective or disciplinary action, up to and including termination as set forth in California Department of Corrections and Rehabilitation Department Operations Manual, Chapter 3, Article 22 and California Code of Regulations, Title 15, Chapter 1.

    • If compliance is not feasible, or if deviation from this policy is necessary to support a business function, the respective manager shall formally request an exemption as defined by the department Information Security Officer.

  • Policy Directives

    • Account Management

      • CCHCS shall implement suitable controls to monitor unauthorized changes to user access. Where feasible, unauthorized changes shall generate automated alerts to notify responsible individuals.

      • In the absence of automated monitoring and alerting, the CCHCS Information Security Officer shall review access record reports on a quarterly basis.

        • Access records include:

          • New user account creation requests.

          • User access revocation requests.

          • Active user lists.

          • User termination lists.

      • Records of all user account creations, deletions, and changes to user access and permissions shall be maintained for a period of at least 12 months.

      • The department shall develop a comprehensive identity and access management strategy based on statutory and organizational business requirements, including:

        • Supporting unique identification, individual user types and groups, job roles and access methods.

        • Limiting access to information assets and associated facilities to authorized users, processes, or devices, and to authorized activities and transactions.

        • Defining roles and assigning responsibilities pertaining to access control tools, technologies, and processes.

        • Developing and implementing standards, technologies, and processes to support its access control strategy.

        • Formally defining and documenting user account types and groups, and access use cases, commensurate with employment responsibilities.

        • Employing multi-factor authentication for remote access and risk-based user authentication methods to accommodate approved logical access use cases.

        • Ensuring publicly available or published access and authentication credentials, such as default credentials, anonymous credentials, and guest credentials, are not re-used and are replaced as a matter of standard procedure.

    • Access Enforcement

      • CCHCS shall:

        • Review and validate user access and associated access permissions and privileges at least every 12 months to ensure alignment with individual job roles and functions.

        • Implement suitable controls to monitor for unauthorized changes to user access. Where feasible, unauthorized changes shall generate automated alerts to notify responsible department individuals.

        • Ensure that access for non-active workforce members is deactivated before or immediately after termination, as appropriate.

        • Define and document all auditable system events related to data and information access that shall be recorded.

        • Ensure audit and security records are securely stored and protected against tampering; audit and security records shall be maintained for the period defined in the records retention schedule.

        • Ensure that access restrictions and monitoring capabilities for cloud services are clearly defined and implemented.

      • Before IT infrastructure network access, users shall be identified and authenticated.

      • Access to information assets and associated permissions shall be approved by the respective information asset owner.

    • Information Flow Enforcement

      • CCHCS shall ensure that information assets enforce approved authorizations for controlling the flow of information within the system and between interconnected systems that are consistent with applicable federal laws, executive orders, directives, policies, regulations, standards, and guidance.

    • Separation of Duties

      • User access and permissions shall be based on the principles of least privilege and separation of duties.

    • Least Privilege

      • As needed, IT support personnel and network administrators shall require specific privileges to perform their duties.

      • For all administrators and privileged account holders, CCHCS shall:

        • Identify and document all administrators and privileged account holders.

        • Ensure that administrative and privileged access is granted to users through established or approved local provisioning processes.

        • Ensure that administrative and privileged access is granted to users through established or approved local provisioning processes.

        • Review and validate the continued business need for all administrator and privileged accounts on an annual basis or when staffing, resource, or job function changes occur.

        • Ensure access control management systems are configured to capture and record audit and security information related to access events.

    • Unsuccessful Logon Attempts

      • CCHCS shall enforce a limit of the number of consecutive invalid logon attempts by a user and automatically lock the account after that limit has been reached.

    • System Use Notification

      • The CCHCS system shall display a system use notification to users before granting access providing privacy and security notices consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines and stating that:

        • Users are accessing a California Government system.

        • System usage may be monitored, recorded, and subject to audit.

        • Unauthorized use of the system is prohibited and subject to criminal and civil penalties; and

        • Use of the system indicates consent to monitoring and recording.

      • The system shall retain the notification message or banner on the screen until users acknowledge the usage conditions and take explicit actions to log on to or further access the system. For publicly accessible systems:

        • Display system use information before granting further access to the publicly accessible system.

        • Display references, if any, to monitoring, recording, or auditing that are consistent with privacy accommodations for such systems that generally prohibit those activities; and include a description of the authorized uses of the system.

    • Device Lock

      CCHCS shall:

      • Ensure that required device-lock controls for information assets are implemented and are consistent with applicable laws, executive orders, directives, policies, regulations, standards, and guidance.

      • Retain the device lock until the user re-establishes access using established identification and authentication procedures.

    • Session Termination

      • CCHCS shall automatically terminate a user session after periods of user inactivity, targeted responses to certain types of incidents, or time-of-day restrictions on system use.

    • Permitted Actions Without Identification or Authentication

      • CCHCS shall identify user actions that can be performed on the system without identification or authentication, consistent with organizational mission and business functions, and document and provide supporting rationale in the security plan for the system, and user actions not requiring identification or authentication.

    • Remote Access

      • CCHCS shall:

      • Establish and document usage restrictions, configuration and connection requirements, and implementation guidance for each type of remote access allowed.

      • Authorize each type of remote access to the system prior to allowing such connections.

      • Employ automated mechanisms to monitor and control remote access methods.

      • Implement cryptographic mechanisms to protect the confidentiality and integrity of remote access sessions.

      • Route remote access through authorized and managed network access control points.

      • Authorize the execution of privileged commands and access to security-relevant information via remote access only in a format that provides assessable evidence and for department needs; and document the rationale for remote access in the security plan for the system.

      • Ensure that access restrictions and monitoring capabilities for cloud services are clearly defined and implemented.

    • Wireless Access

      • CCHCS shall:

      • Establish configuration requirements, connection requirements, and implementation guidance for each type of wireless access.

      • Authorize each type of wireless access to the system prior to allowing such connections.

      • Protect wireless access to the system using authentication of users, devices and encryption.

    • Access Control for Mobile Devices

      • CCHCS shall:

      • Establish configuration requirements, connection requirements, and implementation guidance for organization-controlled mobile devices, to include when such devices are outside of controlled areas.

      • Authorize the connection of mobile devices to organizational systems.

      • Employ full-device encryption, container-based encryption to protect the confidentiality and integrity of information on mobile devices.

    • Use of External Systems

      • CCHCS shall:

      • Establish and identify controls consistent with the trust relationships established with other organizations owning, operating, and maintaining external systems, allowing authorized individuals to:

        • Access the system from external systems.

        • Process, store, or transmit organization-controlled information using external systems.

      • Prohibit the use of specified external systems.

      • Permit authorized individuals to use an external system to access the system or to process, store, or transmit organization-controlled information only after:

        • Verification of the implementation of controls on the external system as specified in the organization’s security and privacy policies and security and privacy plans.

        • Retention of approved system connection or processing agreements with the organizational entity hosting the external system.

      • Restrict the use of organization-controlled portable storage devices by authorized individuals on external systems.

    • Information Sharing

      • CCHCS shall:

      • Enable authorized users to determine whether access authorizations assigned to a sharing partner match the information’s access and use restrictions for information sharing situations.

      • Employ automated mechanisms to assist users in making information sharing and collaboration decisions.

    • Publicly Accessible Content

      • CCHCS shall:

      • Designate individuals authorized to make information publicly accessible.

      • Train authorized individuals to ensure that publicly accessible information does not contain nonpublic information.

      • Review the proposed content of information prior to posting onto the publicly accessible system to ensure that non-public information is not included.

      • Review the content on the publicly accessible system for non-public information and remove such information, if discovered.

    • Access Control Decisions

      • CCHCS shall establish procedures and implement mechanisms to ensure access control decisions are applied to each access request prior to access enforcement.

  • References

    • Statewide Information Management Manual, Section 5305-A, Information Security Program Management Standard

    • State Administrative Manual, Section 5305.4, Personnel Management

    • State Administrative Manual, Section 5305.7, Risk Assessment

    • State Administrative Manual, Section 5315, Information Security Integration

    • State Administrative Manual, Section 5335, Information Security Monitoring

    • State Administrative Manual, Section 5335.1, Continuous Monitoring

    • State Administrative Manual, Section 5335.2, Auditable Events

    • State Administrative Manual, Section 5355, Endpoint Defense

    • State Administrative Manual, Section 5355.1, Malicious Code Protection

    • State Administrative Manual, Section 5360, Identity And Access Management

    • State Administrative Manual, Section 5360.1, Remote Access

    • State Administrative Manual, Section 5360.2, Wireless Access

    • State Administrative Manual, Section 5365.1, Access Control for Output Devices

    • National Institute of Standards and Technology, Special Publications 800-53, Access Control, AC-1, AC-2 (1)(2)(3)(4), AC-3, AC-4, AC-5, AC-6 (1)(2)(5)(9)(10), AC-7, AC-8, AC-11, AC-12, AC-14, AC-17(1)(2)(3)(4), AC-18(1), AC 19(5), AC-20(1)(2), AC-21, AC-22, AC-24

    • National Institute of Standards and Technology, Special Publications 800-53, Audit & Accountability, AU-3, AU-6, AU-7, AU-8, AU-9, AU-10, AU 11, AU-13

    • National Institute of Standards and Technology, Special Publications 800-53, Awareness & Training, AT-2

    • National Institute of Standards and Technology, Special Publications 800-53, Identification & Authorization, IA-1, IA-2, IA-3, IA-4, IA-5, IA-6, IA-7, IA 8, IA-9, IA-10, IA-11

    • National Institute of Standards and Technology, Special Publications 800-53, Risk Assessment RA-1, RA-2, RA-3

    • California Department of Corrections and Rehabilitation, Department Operations Manual, Chapter 3, Article 22

    • California Department of Corrections and Rehabilitation, Department Operations Manual,, Chapter 4, Article 45, Section 49020.6.1, 49020.7.1, 49020.9, 49020.10

    • California Government Code, Section 11549.3

  • Policy Control
    Executive Sponsor: Chief Information Officer, CCHCS Information Technology Services Division
    Effective: 03/28/2022
    Revised: 09/16/2026