Law / United States / 
Oregon
State agencies, cooperation with the state information security program, training and metrics
In force since .
A sector security regimes rule binding government bodies.
- Obligation class
- Security, Governance
As of .
What it requires
- This duty binds every state agency in the executive department, meaning an agency as defined in ORS 183.310 other than the Secretary of State, the State Treasurer, the Attorney General, the Oregon State Lottery and the public universities listed in ORS 352.002. It does not bind a private business.
- Cooperate with the office of Enterprise Information Services in the implementation of a continuing statewide agency-by-agency risk-based information technology security assessment and remediation program.
- Cooperate in the development of, and follow, the plans, rules, policies and standards the State Chief Information Officer adopts with regard to the unification of agency information technology security functions in the state.
- Conduct and document the completion of annual information technology security awareness training for all agency employees.
- Report security metrics using the methodologies the office of Enterprise Information Services develops, and participate in the activities that office coordinates to better understand and address security incidents and critical cybersecurity threats to the state.
These lines are LexLint's reading of the law's text, as of .
What this law does
All state agencies must cooperate with the office of Enterprise Information Services in the implementation of a continuing statewide agency-by-agency risk-based information technology security assessment and remediation program. All state agencies must cooperate in the development of, and follow, the plans, rules, policies and standards adopted by the State Chief Information Officer with regard to the unification of agency information technology security functions in the state.
All state agencies must conduct and document the completion of annual information technology security awareness training for all agency employees. All state agencies must report security metrics using methodologies developed by the office of Enterprise Information Services. All state agencies must participate in activities the office of Enterprise Information Services coordinates to better understand and address security incidents and critical cybersecurity threats to the state.
A state agency in this section is an agency, as defined in ORS 183.310, in the executive department, and the executive department excludes the Secretary of State, the State Treasurer, the Attorney General, the Oregon State Lottery and the public universities listed in ORS 352.002.