Chapter 4 – Information Technology

42030.6 Role and Responsibilities

• Department Chief Information Officer (CIO) or designee is responsible for:

  • Ensuring all users of department information assets are aware of this policy and acknowledge their individual responsibilities.

  • Ensuring this policy is reviewed annually and updated accordingly.

  • Auditing and assessing the department’s compliance with this policy at least once every two years.

• Department Information Security Officer (ISOInformation Security Officer) shall:

  • Assist owners of information assets and Information Asset Custodians in the identification of data security controls and processes.

  • Participate in incidents involving data security.

  • Review and sign all department DSAs.

  • Maintain a repository of all signed department DSAs.

• Department Owners of Information Assets and Program Management:

  • Shall ensure that roles and responsibilities for data sharing are defined, documented, and implemented.

  • In collaboration with Information Asset Custodians shall establish and maintain an inventory of all information assets under their direct control.

  • In collaboration with Information Asset Custodians shall use the categorization of information assets in determining the required level of protection for the data and information asset.

  • Are responsible for initiating a DSA or BUCP, and for retaining a copy of all executed agreements.

  • Shall work with the data requester to complete all required sections within the department’s DSA template or BUCP.

• Department Information Asset Custodians shall:

  • Assist Owners of Information Assets in identifying data sharing controls commensurate with the classification of the data.

  • Document, implement, monitor, and maintain the DSA or BUCP lifecycle as defined by Owners of Information Assets.

  • Develop and implement tools, technologies, processes, and procedures to support, monitor and maintain data sharing agreements.

  • Participate and provide assistance with incident response activities pertaining to the security of department data as directed and guided by Information Security Coordinators, the ISOInformation Security Officer, the Chief Privacy Officer and Owners of Information Assets, as appropriate.

• Department of Legal Affairs:

  • Shall be available to provide review of any DSA variance request (that would change the meaning, intent, or exceed the Owners of Information Assets or Information Asset Custodian’s risk tolerance) to determine risk handling and mitigation options.

• Department Users of department data shall:

  • Be aware of and adhere to all department information security and privacy policies, and applicable privacy laws.

  • Adhere to all data sharing and exchange policies, standards, and processes, and applicable privacy laws.