Privacy & Security - Ohio Policies

The State of Ohio is dedicated to providing technology, policy, standards, architecture, information, and solutions for enhancing the privacy and security of Ohio's data and systems. This website acts as a privacy and security knowledge center for state agencies.

• ORC 1347.15 Access rules for confidential personal information
• ORC 1347 Personal Information Systems
  
• NEW! Ohio Privacy Impact Statements and Assessments 2012 (.pdf)
• NEW! Privacy Threshold Assessment Template (.doc)
• NEW! Privacy Impact Assessment Template (.doc)
• NEW! Ohio Privacy Policies Framework (.pdf) Includes Complete Instructions and ORC 1347.15 policy and procedure templates
• NEW! Template Policy on Protecting Privacy (.doc)
• NEW! Procedure Template - Accessing  CPI (Paper) (.doc)
• NEW! Procedure Template - Incident Response for Invalid Access of Confidential or Sensitive PII (.doc)
• NEW! Procedure Template - Accessing CPI (Paper) (.doc)
• NEW! Procedure Template - Requesting for PI (.doc)
• NEW! Procedure Template - Accessing Sensitive Data (.doc)
• Interim Policy on Logging Access to Confidential Personal Information (.pdf)

• ORC 125.18 Office of Information Technology
• ORC 149.433 Exempting security and infrastructure records
• ORC 149.45 Internet access to social security numbers
• ORC 1306 Uniform Electronic Transactions Act
• ORC 1306.20 State Agency-Specific Provisions
• ORC 1306.21 Rules for state agency use of electronic records or electronic signatures
• ORC 1306.23 Exemptions to public records laws
• Administrative Rule on Electronic Signatures OAC 123:3-1-01 Use of Electronic Signatures and Records - Important additional information
• ORC 1347.12 Agency disclosure of security breach of computerized personal information data

• ITP-B.1 Information Security Framework
  
• ITP-B.2 Boundary Security
  
• ITP-B.3 Password-PIN Security
  
• ITP-B.4 Malicious Code Security
  
• ITP-B.5 Remote Access Security
  
• ITP-B.6 Internet Security
  
• ITP-B.7 Security Incident Response
  
• ITP-B.8 Security Education and Awareness
• ITP-B.9 Portable Computing Security
  
• ITP-B.10 Security Notifications
• ITP-B.11 Data Classification
• ITP-B.12 Intrusion Prevention and Detection
  

• ITP-E.1 Disposal, Servicing and Transfer of IT Equipment (.pdf)

Audit Checklist

• ITP-E.7 Business Resumption Planning (.pdf)
• IT Business Continuity Planning Guideline (replaces ITP-E.7)
• ITP-E.8 Use of Internet, E-mail and Other IT Resources (.pdf)

Audit Checklist

• ITP-E.30 Electronic Records (.pdf)

Audit Checklist

• ITP-F.4 Executive Branch Cabinet Agency Web Site Standardization(.pdf)

• ITB-2008.01 Encryption and Investigatory Needs (.pdf)

Statement of Responsibility (.doc)

• ITB-2007.02 Data Encryption and Securing Sensitive Data (.pdf)
• OEP-SEC.4002 Review of Sensitive Data Bulletin Exception Request (.pdf)

Sensitive Data Bulletin Exception Request Form (.doc)

• ITB-2007.01 Electronic Communication and Public Records (.pdf)
• ITB-2006.01 Public Records Requests Concerning IT and Telecommunications Systems (.pdf)