An official website of the State of Georgia.
How you know
Local, state, and federal government websites often end in .gov. State of Georgia government websites and email systems use “georgia.gov” or “ga.gov” at the end of the address. Before sharing sensitive or personal information, make sure you’re on an official state website.
Call 1-800-GEORGIA to verify that a website is an official website of the State of Georgia.
NIST Families with Georgia PSGs Referenced
To see the NIST control statements: http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf
Domain Name and SSL Certificate supplemental document for SA-03-007 Georgia.Gov Domain Name.
Guidelines for technology project management when there is greater than $100,000 investment
Guidelines for project financial management
Guidelines to Use Social Media
Guidelines for handling media used for data backup and for records archiving
Guidelines for website use and construction in GaGov
Guidelines for Statement of Responsibilities for a Project Integrator
Guidelines for seeking GTA's Endorsement of Technology
Guidelines for mobile device management
Provides guidance for using the enterprise service bus
In an effort to increase the success rate of large Information Technology initiatives, Georgia has established best practices for the planning and implementation of these investments.
The guideline necessary for State of Georgia projects to comply with Project Assurance schedule review criteria.
Provides a set of certifications for statewide cybersecurity positions.
To provide state agencies and employees with detailed processes and procedures that will assist in working from a remote (virtual) environment.
Rules, Regulations and Procedures Governing the Acquisition and Use of Telecommunications Services and Equipment
Provides for sharing of data among agencies
Management of business data through its lifecycle
Establish the decision-making authority for large IT initiatives/projects (hereafter referred to as “IT Projects”) within the state enterprise.
ITIL is the basis for IT infrastructure management, service delivery and support
Establishes accountability for all hardware and software acquired using public funds
Defines appropriate use IT resources
Establishes the process for detecting and responding to security incidents
Commits the State of Georgia to protecting information systems and data from unauthorized disclosure, modification, use, or destruction
Establishes use of passwords as primary authentication mechanism
Establishes the State’s intent to rely on electronic data as a form of official record and adherence to proscribed records retention requirements
Each agency is responsible for establishing access control measures that limits access (logical and/or physical) to only those individuals that are authorized to obtain it.
Establishes a need to increase user security awareness through an awareness and training program
Provisions for third-party access to state facilities and information systems
Provides for inventory and classification of state data and information processing systems
Physical security is an essential element to the overall security of IT resources
Provides for identity verification of IT employees and contractors
Requirements for a formal change management process
Requirements for a formal IT lifecycle management program
Establishes requirements over outsourcing data processing facilities
Requires separation of production from development and test environments
Requires protections against malicious software
Requires log management practices
Requires protection from risks associated with remote access
Requires the use of cryptographic controls
Requires plans to maintain continuity of essential state government operations and services
Requirements protection of system media from unauthorized disclosure, modification, destruction or loss
Requires network security controls
Requires security controls on public facing systems
Agencies shall periodically review and continuously monitor the management, operational and technical security controls for all information systems to assess their effectiveness to determine the extent to which they are operating as intended and comply with federal, state, enterprise and agency s
Requires protection of information traversing networks
Requires a risk-based approach to information security management
Improves how security controls are managed within the State’s shared-service environment. The Security Control Policy addresses this business challenge by establishing clearer lines of delineation between security controls, ownership and the overall responsibility of execution.
Agencies shall use Multi-Factor authentication (MFA) for all network access to privileged accounts as outlined in NIST Special Publication 800-53 Revision 4 and required in federal regulatory requirements.
To provide guidance to State agencies on identifying, assessing, selecting and implementing risk management processes and controls throughout the enterprise to manage IT supply chain risk.
The purpose of an Enterprise Multi‐Factor Authentication (MFA) Policy is to enable a means of strong authentication for all users with access to information systems resources while ensuring ease of use and adoption for the user(s).
Governance of cloud-based provisioning according to risk.
Third party intellectual property displays on Georgia.Gov
Naming and approval of web sites
Use, placement and removal of links on Georgia.Gov
Procedural requirements for placing applications into Production
Standard IP based protocols
Standard desktop clients
Requires a Deployment Certification
Requires and defines software currency
Design techniques to support branding of State of Georgia websites
Administering Enterprise and Agency open contracts for telecommunications systems and long distance services
Requires to use GTA contracts for assurance services for projects with budgets of $1 million or greater
Project management methodology for technology projects valued at $100,000 or more
Specifies GTA and agency responsibilities concerning State oversight of information technology (IT) investments with respect to State and agency strategic goals, and with enterprise policies and standards.
Requires project expenditures shall be planned and tracked
Agencies must develop and maintain an IT strategic plan
Requires a Project Charter for IT projects
Agencies select and authorize SDLC’s for their use
The Performance Lifecycle Framework for investments in information technology
Minimum processes to manage IT investments using the Enterprise Performance Lifecycle
Formal investment reviews at predetermined points in IT investment lifecycle
Requires a Request for Exemption from a PSG
Requirements to create and operate Enterprise Applications
Requires a project integrator on complex projects
Establishes requirements for GTA's authorization of technology procurement
This standard offers a list of important components for an agency to consider inserting in a service agreement for cloud services. By no means does this list cover all situations that may be included in a service agreement; but those listed here areoften overlooked by State agencies.
Data Stewardship Requirement for Constituent Data
the keystone enterprise standard to guide governance of managing IT provisioning (SaaS, Paas, IaaS, etc.) according to risk.
Provides direction regarding the acquisition, use, distribution and redistribution of commercial, public domain, and State-authored software and Software Licenses.
All digital properties managed by state entities shall be accessible according to WCAG 2.0 (Level AA) Compliance standards.
Instant Messaging Controls
Standards for appropriate use and monitoring of IT resources
Standards for categorizing personal information
Electronic records are 1)relied upon as official records and 2) must adhere to records retention requirements and 3) must be protected from unauthorized destruction, modification or disclosure.
Requirements for information security incident response and reporting
Requirements for creating an information security program and infrastructure
Minimum standards for an information security management organization
Establishes standards for protecting passwords
Establishes standards for creating and using strong passwords
Fixes accountability for content and transfer of information through electronic communications
Requires managed access to state facilities and information resources
Standards for appropriate use and security of email
Requires all employees and contractors to attend annual security awareness training
Establishes security requirements for conducting business with contractors, outsourcing vendors and/or other third-parties
Impact Level definitions and standards of information assets
Incorporates facilities security into overall protection of IT assets
Minimum security requirements for computer operations centers
Standards for verifying identities of state personnel and contractors
Requires a formal lifecycle management program for systems in development or operations
Requires that changes to operational systems be controlled and monitored
Requires agencies to document system operational procedures
Requires data and system owners to create and maintain system security plans
Establishes requirements for separating operational environments from test/development environments
Requires agencies to establish criteria for accepting a system from development to operations
Establishes controls to protect systems against malicious software
Establishes statewide standard on disposition of surplus electronic media
Establishes standards for sanitization and disposal of all electronic media subject to vendor return
Requires monitoring and analyzing systems logs to record events and detect anomalies
Security requirements for telework and remote access to state information systems
Requires protection of systems from risks associated with remote access
Minimum security requirements for wireless network implementation
Minimum requirements for the use of cryptographic controls
Adopts the NIST risk management framework
Requires IT systems to be assessed by an independent third-party
Establishes physical, logical, and environmental protection requirements for system media.
Requires third-party adherence to established State security requirements
Requires plans to sustain or recover/restore critical operations in the event of a system disruption or disaster
Requires backup and recovery procedures for critical software and data
Requires network boundary protection
Requires control and monitoring of network sessions
Requires control and management of web services
Annual reporting requirements
No expectation of privacy shall be assumed when accessing non-public State information resources and assets
Rules of appropriate use and all other governance regarding information and data security apply to non-State issued technology devices used to access non-public State information and technology resources
Requires all data to be processed, stored, transmitted and disposed in the geographical United States
In accordance with the Information Security Control Policy, each agency operating within a shared-service environment is responsible for ensuring that applicable NIST 800-53 (rev. 4) security controls are implemented and operated effectively.
Establishes criteria for blocking network traffic from IP addresses and IP address ranges at the boundary of the state network.
Specifies a reliable PIV system within which a common identity credential can be used to verify a claimed identity and to gain physical and logical access to state controlled facilities and information systems.
Establish a common set of security protocols across all State digital properties (i.e. agency web pages) to ensure the protection of sensitive information.
Establishes an enterprise Cybersecurity Cabability Maturity Model to provide a structure for State agencies to baseline current capabilities in cybersecurity while establishing a foundation for consistent evaluation.
This standard establishes minimum security requirements for teleworking and remotely accessing state information systems while traveling internationally.
Establishes restrictions on third-party vendors, software and services.
The primary focus of the Vulnerability Disclosure Program (VDP) is to securely accept, triage and rapidly remediate vulnerabilities submitted by our security research community.