Oregon Administrative Rules Chapter 128 - DEPARTMENT OF ADMINISTRATIVE SERVICES, OFFICE OF THE STATE CHIEF INFORMATION OFFICER
Oregon Administrative Rules (OAR) Chapter 128 is dedicated to the Department of Administrative Services (DAS), Office of the State Chief Information Officer (OSCIO). This chapter outlines the regulations, policies, and standards that govern information technology (IT) and information resources across Oregon's executive branch of state government.
The Oregon Department of Administrative Services (DAS) is a central agency responsible for providing various administrative and support services to other state agencies, including IT. Within DAS, the Office of the State Chief Information Officer (OSCIO) plays a critical role in setting the strategic direction for state IT.
Here's a breakdown of the key areas and purpose of OAR Chapter 128:
I. Core Purpose and Authority:
The overall purpose of this chapter is to:
Establish a robust IT governance program for the executive department.
Ensure the secure, efficient, and effective use of information resources across state agencies.
Provide guidance and standards for all aspects of IT, from planning and acquisition to operations and security.
The authority for these rules generally stems from Oregon Revised Statutes (ORS), particularly ORS 276A.203 and ORS 84.064, which define the duties and responsibilities of the State Chief Information Officer.
II. Key Divisions within Chapter 128:
Based on available information, Chapter 128 includes at least two significant divisions:
Division 10: Providing Broadband Services and Operations to Non-State Entities: This division likely addresses the rules and procedures for how the state's IT infrastructure, particularly broadband services, can be extended or made available to entities outside of direct state government. This could include local governments, non-profits, or other public service organizations.
Division 20: State Information Technology Asset Protection - Covered Vendors: This is a crucial division, especially in the current global security landscape. It focuses on identifying and mitigating risks associated with certain IT vendors. Key aspects include:
Defining "National Security Threat": These rules establish criteria for determining when a corporate entity (vendor) poses a national security threat due to its products or services. This can involve assessing risks related to data collection (biometric, contact, GPS, chat logs, photos, Browse history), potential access by foreign governments, or unresolved security vulnerabilities.
"Covered Vendors": The rules outline the process by which the State Chief Information Officer (CIO) designates a corporate entity as a "covered vendor" if their products or services pose an unacceptable risk to state information technology assets.
Public List of Covered Vendors: The State CIO is mandated to maintain a publicly accessible list of covered vendors, including information to identify the products and the date of designation.
Designation and De-designation Process: The chapter details the procedures for designating and potentially de-designating a vendor as a national security threat, including regular reviews and evaluation against established criteria.
III. Broader Responsibilities of the State CIO (as reflected in OAR 128 and related statutes):
Beyond the specific divisions, the OARs reflect the broader responsibilities of the State CIO and the OSCIO, which include:
Advising the Governor: Serving as the chief advisor on all matters related to information resources, IT, information systems, geographic information systems, and telecommunications.
IT Governance: Implementing and maintaining a comprehensive IT governance program for the executive department.
Rules, Policies, and Standards: Adopting and enforcing rules, policies, and standards for budgeting, planning, acquiring, installing, operating, and overseeing telecommunications and information technology.
Security: Taking all necessary measures to protect the availability, integrity, and confidentiality of information systems and the data they contain.
Procurement Oversight: Overseeing IT and telecommunications procurements.
Enterprise Strategy: Developing and updating an Enterprise Information Resources Management Strategy for the state.
Training and Collaboration: Promoting training programs in IT and fostering collaboration among various government entities regarding information systems.
In essence, OAR Chapter 128 serves as the regulatory backbone for how Oregon's state government manages its information technology, with a significant emphasis on security, vendor management, and strategic planning under the guidance of the State Chief Information Officer.
RELATED Blog
0 comments