Data Management - The CIO's Guide to Oracle Products and Solutions - page 203

1. The IT systems will need to identify, publish, and keep the appli-

cable policies current.

2. Data elements will need to be secured.

3. Access control will have to be categorized, but this need may
vary depending on the data and the audience.

4. Compliance to policies will have to be monitored.

5. The organization will have to make the requirements for security,

confidentiality, and privacy clear to everyone.

6. Education on issues of privacy and confidentiality will have to
become a routine part of normal business processes.

7. The capabilities of data access will have to be audited.

8. There should be an understanding that part of the stewardship
role interprets security, confidentiality, and privacy.

9. All access requests for data that is not publicly available should
be made to the steward of the data.

10. There must be a means to publish and implement changes to the
status of data's access requirements.

Guideline 6: The enterprise architecture must reduce integration com-
plexity to the greatest extent possible.

1. The number of vendors, products, and configurations in the
state's environment will need to be reduced.

2. The enterprise must maintain configuration discipline.

3. The architecture will, in some instances, sacrifice performance
and functionality.

4. The architecture will rely on components supplied by vendors,
which will make the enterprise more vulnerable.

5. The cost of vendor dependency will need to be factored in when
figuring the total cost of ownership.

6. Determination of “the greatest extent possible” includes consid-
eration of how reducing complexity can negatively impact the
ability to provide critical client services.

Guideline 7: Consider reuse of existing tools and infrastructure before
investing in new solutions

1. Software license agreements and system development contracts
should be written to allow for reuse across the enterprise.