36 Miss. Code. R. 1-11.2
Each agency must adopt the following guidelines for password administration:
A. Automated password
input must not be allowed, except for simplified/single sign on systems that
have been approved by ITS
B.
Passwords must not be stored in clear text on hard drives or any other
electronic media. If stored on electronic media, passwords must be classified
as sensitive. Refer to Chapter 9 of the ESP for details regarding data
encryption.
C. Access to
password-protected systems must be timed out after an inactivity period of
thirty (30) minutes or less.
D.
Passwords for administrative accounts and accounts with access to sensitive
data must be treated with a higher level of security, including:
1. Requiring password changes every thirty
(30) days
2. Consideration of
two-factor authentication
E. Third-party support accounts must be
disabled or deleted when not in use.
F. Immediately revoke access when an account
owner leaves or is terminated.
Notes
State regulations are updated quarterly; we currently have two versions available. Below is a comparison between our most recent version and the prior quarterly release. More comparison features will be added as we have more versions to compare.
No prior version found.