TO:
Agency Chief Information Officers (AIO)
Agency Information Security Officers (AISO)
Chief Information Officers (CIO)
Information Security Officers (ISO)
SUBJECT:
SIMM 5335-A – Security Event Notification and Response Standard update
BACKGROUND:
In 2021, the California Department of Technology (CDT), released the Security Event Notification and Response Standard, SIMM 5335-A, in support of SAM 5335, Information Security Monitoring and SAM 5345, Vulnerability Management and Threat Management. Each Agency/state entity is responsible for continuous monitoring of its networks and other information assets for vulnerabilities and signs of attack, anomalies, and suspicious or inappropriate activities. Agencies/state entities shall continuously identify, investigate reports of, and remediate vulnerabilities affecting their information technology (IT) assets before they can be exploited per SAM Sections 5335, 5335.1 and 5335.2. The California Department of Technology (CDT) Office of Information Security (OIS), Security Operation Center (SOC), provides continuous monitoring of the California Government Enterprise Network (CGEN) and will notify customers when it detects security events.
PURPOSE:
The purpose of this Procedures/Standards update is to announce:
- SIMM 5335-A has been updated to include a Low Notification category for sections B, D, E, and G.
REFERENCES:
The following reference materials are associated with this Procedures/Standards Update. SIMM is available on the CDT’s website located at https://cdt.ca.gov/policy/simm/.
- SIMM 5335-A
- SAM 5335 & 5345