Chapter 4 – Information Technology

41021.9 Compliance

• The department shall comply with the information security and privacy policies, standards and procedures issued by the California Department of Technology (CDT), Office of Information Security (OIS). In addition to compliance with the information security and privacy policies, standards, procedures, and filing requirements issued by the OIS, the department shall ensure compliance with all security and privacy laws, regulations, rules, and standards specific to and governing the administration of their programs. Program administrators shall work with their general counsel, ISOInformation Security Officer, and privacy program officer or coordinator to identify all security and privacy requirements applicable to their programs and ensure implementation of the requisite controls.

• Non-compliance with this policy may result in disciplinary or adverse action as set forth in DOMDepartment Operations Manual, Chapter 3, Article 22, Employee Discipline.

• The consequences of negligence and non-compliance with state laws and policies may include departmental and personal:

  • Loss of delegated authorities.

  • Negative audit findings.

  • Monetary penalties.

  • Legal actions.