FROM: Joe Michael, Chief Information Officer
SUBJECT: Data Classification and Microsoft 365 Information Governance Implementation
RECOMMENDATION:
title
Recommend that the Board approve a contract with Presidio to provide consulting and implementation services for the Data Classification and Microsoft 365 Information Governance Implementation Project in an amount not to exceed $224,500.00 and authorize the Chief Executive Officer to execute the agreement.
body
BACKGROUND:
At the July Board meeting, the Board approved a comprehensive expansion of SBCERA's cybersecurity program centered on Palo Alto security services. That approval directly supported the remediation of recent audit findings by adding capabilities SBCERA either did not have or could not previously integrate at the level required to address current security risks.
The proposed item addresses related audit findings from a different, but complementary, direction. Rather than acquiring another perimeter-security platform, this project focuses on the configuration, governance, and secure use of systems and services already within SBCERA's Microsoft environment. Staff is requesting authorization to obtain specialized consulting services to design and configure that environment in alignment with applicable National Institute of Standards and Technology (NIST) guidance, SBCERA's operational requirements, and the security controls appropriate for the information SBCERA creates, receives, stores, and transmits.
Data Classification and Governance
The foundation of the project is the creation of an enterprise data-classification framework and supporting data dictionary. Data classification is the process of identifying information by its business purpose, sensitivity, legal or regulatory requirements, and the potential impact of unauthorized access, disclosure, alteration, or loss. The framework will establish a manageable set of classification levels and clear handling requirements for each...
Click here for full text