What other authority does the state have which supports the notification requirement?

State policy was adopted to require the reporting of security incidents involving personal, confidential, or sensitive information maintained in paper documents and other media types. Refer to State Administrative Manual Section 540 (PDF), Budget Letter 06-34 (PDF), Information Security Notification and Reporting, and Management Memo 06-12 (PDF), Protection of Information Assets, for additional requirements and details.