About
Department leadership and managers are responsible for establishing a “tone from the top” and assigning appropriate staff to ensure that cybersecurity internal controls are developed, tested, 更新并定期培训所有员工，以防止由于网络事件造成的业务中断和数据或财务损失.
政府财务和运营审计现在评估数据可靠性和网络安全内部控制，作为正常政府运作的标准组成部分.
Enterprise Security Standards are now included as part of a department’s Internal Controls and have compliance responsibilities at all levels of the organization.
Tone from the Top – Cybersecurity is a top priority
Cybersecurity compliance in not solely an “IT” or technology function, but is a series of controls, operations, procedures and training that apply to all employees at all levels in a department.
领导层和管理者有责任从高层建立一种强有力的基调，确定网络安全内部控制是所有业务的基础，是组织的首要任务.
Assign Key Staff to Ensure Cybersecurity Compliance
As part of cybersecurity preparedness, 领导层和管理者必须在组织的所有级别指派适当的员工，以确保遵守要求的网络安全和数据保护内部控制.
Cybersecurity internal controls require collaboration across the organization including IT, HR, Legal, Policy, Fiscal, Budget, Payroll, Program and Operations staff and extend to any contractor or 3rd party supporting operations.
Internal controls should include:
- Enterprise information security policies and standards
- Telework guidance and advisories
- Ransomware preparedness and mitigation
- 对处理个人身份信息的业务和其他实体的遵从义务
- Other unique data privacy standards
a. Credit card payment standards (if accepting credit cards)
b. Health care privacy (HIPAA) (health and medical records)
c. Protecting student privacy (FERPA)