Law / United States / 
Mississippi
Enterprise Security Program, state agency heads' data and IT security duties
Enterprise Security Program, Miss. Code Ann. section 25-53-201(1) to (3)
In force.
A sector security regimes rule binding government bodies.
- Obligation class
- Security, Governance
As of .
What it requires
- This binds each state agency's executive director or agency head; the Department of Information Technology Services sets the security standards and policies state agencies implement to the extent that they apply.
- Be solely responsible for the security of all data and IT resources under the agency's purview, wherever they reside, including at a third-party location and in transit between locations.
- Ensure an agency-wide security program is in place, designate an information security officer to administer it, and ensure the agency adheres to the requirements of the Enterprise Security Program to the extent that they apply.
- Develop, implement and maintain written agency policies and procedures to ensure the security of data and IT resources, and implement policies and standards that keep the agency's data and IT resources in compliance with state and federal law to the extent that they apply.
- Implement appropriate cost-effective safeguards to reduce, eliminate or recover from identified threats to data and IT resources, and ensure that internal assessments of the security program are conducted.
- Include all appropriate cybersecurity requirements in the specifications for the agency's solicitations of state contracts for procuring data and information technology systems and services.
- Participate in annual information security training designed specifically for the executive director or agency head.
These lines are LexLint's reading of the law's text, as of .
What this law does
The Enterprise Security Program provides for the coordinated oversight of the cybersecurity efforts across all state agencies, including cybersecurity systems, services and the development of policies, standards and guidelines. The Department of Information Technology Services establishes and maintains the security standards and policies for all state data and IT resources that state agencies shall implement to the extent that they apply.
Each state agency's executive director or agency head shall be solely responsible for the security of all data and IT resources under its purview, ensure that an agency-wide security program is in place, and designate an information security officer to administer it. Each agency head shall ensure the agency adheres to the requirements established by the Enterprise Security Program, to the extent that they apply.
Each agency head shall develop, implement and maintain written agency policies and procedures to ensure the security of data and IT resources. Each agency head shall implement appropriate cost-effective safeguards to reduce, eliminate or recover from identified threats to data and IT resources. Each agency head shall ensure that internal assessments of the security program are conducted.
Each agency head shall participate in annual information security training designed specifically for the executive director or agency head.