OAR 291-005-0015: General

(1) These rules cover the following assets of the department: (a) Any and all information regarding or related to the department’s business and mission, where that information is stored as data contained in or on any information system or is produced for display and review by that system. (A) Data may be recorded on different media, such as magnetic drives (hard disk drive (HDD) or floppy), optical disks (compact disk (CD) or digital versatile disk (DVD), semiconductor drives (solid state drives (SSD) or flash), and a variety of printed output, etc. (B) This data may be stored, processed, accessed, or displayed on any number of computer systems including, but not limited to, those owned and operated by the department, contractors, or consultants. Personally-owned devices are not authorized to store or process agency data. (b) The information systems equipment, including the computer hardware and software, peripheral devices, network components, data communications devices, terminals, stand-alone computers, and printers which are owned, leased, managed, or operated by the department to collect, store, process, maintain, disseminate, dispose of, or display information. (c) Access to and use of the department’s information systems. (2) These rules enable the agency to mitigate the potential loss of data from misuse of user accounts. Further prevention, mitigation, and remediation efforts are explained in agency policies and procedures as well as the State of Oregon Security Plan and State of Oregon Information and Cyber Security Standards.