Chapter 4 – Information Technology

42030.4 Policy Directives

• The department shall:

  • Ensure all data sharing complies with privacy laws, confidentiality, and security regulations. A partial list of applicable data sharing agreement requirements can be found in the reference section of this policy.

  • Evaluate all DSA or BUCP requests to ensure they comply with legal, ethical, and privacy requirements.

  • Ensure all DSA requests are documented using the department standards.

  • Ensure any structural changes that would change the meaning or intent of a DSA be approved by the Office of the Information Security Officer, Chief Privacy Officer, and Office of Legal Affairs to determine risk handling and mitigation options.

  • Ensure a DSA or BUCP has been signed, defining terms and conditions, prior to providing the data requester with access to department data.

  • Ensure the department monitors the DSA or BUCP lifecycle, once the agreement is signed, by:

    • Documenting in the enterprise repository.

    • Identifying all active and inactive DSAs or BUCPs, data assets, data mapping and data lineage.

    • Terminating data sharing or access to data upon natural expiration of the DSA or BUCP unless an updated agreement is in progress.

  • Ensure department data and information assets are used solely for their intended purpose.

  • Ensure that all reports produced by the department Information Asset Custodians be used only for internal purposes and shall not be shared with external entities without first obtaining approval by the appropriate authorized entity.

  • Ensure appropriate security controls are implemented.

  • Transfer data in a secure manner, ensuring encryption and the use of secure channels.

  • Grant access to data and reports with the approval by Owners of Information Assets.

  • Immediately report any breaches or deviations by following the department’s incident response policies, processes and procedures.