Policy Advisory  Organization of Information Security Standard

Date:	01/01/2025
Organization:	Cybersecurity and Enterprise Risk Management
Referenced Sources:	MGL Chapter 7D, Section 2

The Organization of Information Security Standard reinforces the Commonwealth’s commitment to an effective information security governance program and outlines the controls necessary to safeguard the Commonwealth’s information assets and reduce risks posed by improper management of information.

Purpose

The purpose of this standard is to:

•Protect the Commonwealth’s information by establishing, implementing,
and managing risk-based administrative, technical and personnel
safeguards.

•Establish responsibility and accountability for information security in the 
organization.

•Comply with relevant laws, regulations and contractual obligations related to 
information security.