Mississippi Administrative Code

All data center facilities must be physically protected in proportion to the criticality of the business functions and associated systems, assets, and infrastructure. A. Any computing resource connected to an agency LAN or to the State Network must be placed in an area that can b…

Agencies with larger computer installations must: A. Protect access with an access control system, normally a card access system. B. Establish procedures for granting, modifying, and revoking access. C. Establish procedures for recording information (date, time, etc.) to track ac…

Agencies with smaller computer installations must: A. Protect access with locked rooms, at minimum. B. Establish procedures for granting, modifying, and revoking access. C. Establish procedures for recording information (date, time, etc.) to track access. Notes 36 Miss. Code. R. …

Agencies should adhere to the following miscellaneous physical security guidelines: A. Each agency should locate alternate space that meets the same physical security requirements for a business recovery site. This site should be accessible 24/7/365. B. Backup and recovery materi…

The following policies address security and data integrity measures required for implementing and securing wireless local area networks that reside within the state network. A. Any unauthorized and/or neglectful installations of wireless networks that expose the state's network i…

At minimum, the following security standards and network configurations are required for the deployment and operation of all wireless network installations: A. The placement of wireless LAN Access Points (WAP) must be strategically located to minimize the interception of wireless…

Each agency must adhere to the following policies for mobile devices with sensitive data. A mobile device is defined as any electric and/or battery operated device that can be easily transported and that has the capability for storing, processing, and/or transmitting data includi…

Each agency must determine if hardware/media contains any sensitive data prior to disposal (scrap, destroy, transfer or rental/lease return). If hardware/media contains sensitive data, one of the following methods must be used prior to disposal. A. Physical Destruction This is th…

Each agency must erase all data and configuration information, regardless of the classification of data, prior to disposal (scrap, destroy, transfer, or rental/lease return) of hardware. Notes 36 Miss. Code. R. 1-15.2 Miss. Code Ann. § 25-53-1 to § 25-53-25

Each agency must perform security assessments on all new applications to ensure key application security and privacy requirements are met. Code in the application and supporting infrastructure must be tested for common errors that can compromise the integrity of the production en…

Each agency must document their application security assessment process/results prior to deploying new applications. Agencies must include all application assessment documentation to ITS as part of the submission package satisfying the mandatory third-party security risk assessme…

Application security assessments must performed when an application is modified or updated. ITS recommends that agencies perform application assessments on a regular basis. A. Follow-up application security assessment documentation must be submitted to ITS as part of the submissi…

Agencies must adhere to the following policies for removable media regardless of classification of the data being stored. A. Removable Media is defined as a device or media that is readable and/or writeable by the end user and is able to be moved from computer to computer without…

Guest/public users must not be permitted access to the state network resources. A. Any agency wishing to provide Internet access to a guest user must utilize one of the following approved methods:1. Installing separate equipment and a separate circuit for guest users. Contact ITS…

Applications that pose a risk to the security of the State Network will not be permitted, including file transfer within Internet chat and peer to peer (P2P) file sharing programs. Notes 36 Miss. Code. R. 1-2.2 Miss. Code Ann. § 25-53-1 to § 25-53-25.

Each agency should consider developing an acceptable use policy (AUP) that defines the proper use of state resources by agency users. The AUP can protect users, partners, and agencies from illegal or damaging actions by individuals, either knowingly or unknowingly. Improper use o…

Each agency must develop a policy that defines the use of personal devices (i.e. mobile devices, minis, laptops, personal computers) on state systems. At minimum, this policy must require those devices to be subject to the same security requirements as state owned devices. It is …

Each agency must report all information security incidents to the ITS Information Security Division (ISD) as soon as possible. Information security incidents result from a validation of an information security event. Information security events are defined as any violation of com…

Data must be properly managed from its creation, through authorized use, to proper disposal. This data classification policy provides a high-level guideline to state agencies for the purpose of understanding and managing data and information assets with regard to the level of pro…

Each agency is required to "harden" their servers. A. Regularly installing all service packs, patches, and updates after appropriate integration testing. B. Disabling all unnecessary services, devices, and accounts. C. Enabling appropriate logging and routine log activity review …

Proper physical location of the server must be considered. Refer to chapter 12 of the ESP for more information about physical access. Notes 36 Miss. Code. R. 1-5.2 Miss. Code Ann. § 25-53-1 to § 25-53-25.

Internet-facing servers that reside on the State Network must be properly secured to preserve the integrity of the network. Inbound connections from the Internet or any third party network will be made using HTTP or HTTPS through enterprise reverse proxy devices in the ITS DMZ. N…

To increase security and limit spam and emailed viruses, ITS has implemented and maintains mail relays on the inside and outside of the firewall. All mail bound for state domain email addresses must come through the outside mail relay and be "relayed" to the inside mail relays. T…

Each agency must establish policies to help employees use email properly, to reduce the risk of intentional or inadvertent misuse, and to ensure that official records transferred via electronic mail are properly handled. Principle priorities include the following: A. Email commun…

Agencies are required to have a virus prevention program that includes: A. Maintaining virus scanning software on all servers and workstations. B. Keeping virus signature files and scanning engines updated on a schedule relevant to the system. Workstations must be updated at leas…

ITS will monitor for network activity that indicates the presence of malicious code and upon detection will perform the following actions: A. For isolated infections, ITS will block access to the state network for infected workstations or servers and notify the agency contact. On…

ITS will maintain a perimeter firewall between the State Network and the Internet. This firewall will provide address-translation to public space for state agencies. A. Inbound connections from the Internet will be restricted to only ports TCP 80 and TCP 443, for only HTTP and HT…

Each agency is required to implement a firewall at the perimeter of their network, to secure the LAN from any traffic originating within the State Network. Each agency should define a rule set for their firewall that is as restrictive as possible, permitting the minimum services …

Firewalls must only be managed using secure protocols such as SSH or HTTPS, and management should be allowed only from selected agency workstations. Notes 36 Miss. Code. R. 1-8.3 Miss. Code Ann. § 25-53-1 to § 25-53-25.

Firewall event logging must be enabled and the logs maintained for at least 30 days. Notes 36 Miss. Code. R. 1-8.4 Miss. Code Ann. § 25-53-1 to § 25-53-25.

ITS requires that all sensitive data be encrypted using industry standard algorithms Triple DES, AES, or SSL/TLS when traveling to/from un-trusted networks and/or entities. Notes 36 Miss. Code. R. 1-9.1 Miss. Code Ann. § 25-53-1 to § 25-53-25.

If an agency Internet-facing server gathers or transmits sensitive data, the application must use, at minimum, SSL for the transaction. The agency must acquire the Certificate Authority signed certificate for this server from ITS. Notes 36 Miss. Code. R. 1-9.2 Miss. Code Ann. § 2…

Each agency should consider encrypting the transmission of all sensitive data. Notes 36 Miss. Code. R. 1-9.3 Miss. Code Ann. § 25-53-1 to § 25-53-25.

Each agency must encrypt sensitive data stored on any of their local systems. Agencies must also ensure that any sensitive data on systems located offsite is properly encrypted. Notes 36 Miss. Code. R. 1-9.4 Miss. Code Ann. § 25-53-1 to § 25-53-25.

The following products and services fall within the purview of the WCC and the scope of these purchasing guidelines and procedures: Technology Examples Radio Frequency Voice: 2-way radio products and services Data: Public safety and emergency services data Cellular Voice: Standar…

In June 2007, the Commission executed a turnkey agreement with Motorola for the implementation of a statewide digital trunked land mobile radio system to be known as the Mississippi Wireless Information Network (MSWIN). The Commission also sponsored and facilitated the establishm…

To help achieve its legislated goal of effective wireless communication interoperability throughout the state, the Commission has set price thresholds for the review of wireless initiatives outside these statewide contracts prior to any procurement commitment by the purchasing en…

The Commission has delegated certain wireless procurements below defined cost thresholds to the purchasing entity and has also established a Wireless Communication Commission Procurement Review Committee ("Committee") to review purchases prior to or in lieu of full Commission rev…

For wireless purchases requiring review and approval by the Committee or the full Commission, agencies and institutions under ITS purview should complete the applicable ITS Procurement Request Form. Local governments and other governing authorities not under ITS purview should co…

A "state of emergency" or "local emergency" as defined in Miss. Code Ann. § 33-15-5(f) and (g), must exist for such a procurement to be considered an emergency purchase by the Commission. In accordance with Miss. Code Ann. § 33-15-17(b) (1972), as interpreted by the Mississippi A…

For assistance with a wireless procurement, contact the ITS Procurement Help Desk at 601-576-HELP (576-4357). Notes 36 Miss. Code. R. 101-1.7 Mississippi Code Ann. 25-53-171(4) Amended 7/23/2015

Proposals, books, records, papers, or other documentary materials, regardless of physical form or characteristics, in use, prepared, possessed or retained by the WCC for use in the conduct of its business are public records under Mississippi law and are subject to disclosure to a…

All requests for information under the Public Records Act and other submissions must be submitted in writing to: Executive Officer Mississippi Wireless Communication Commission 412 East Woodrow Wilson Avenue, Mail Stop 6601 Jackson, MS 39216-1405 RE: PUBLIC RECORDS REQUEST Please…

"Working Days" as used herein means Monday through Friday but excludes State recognized holidays mandated by Mississippi Code Annotated, Section 3-3-7, other holidays identified in holiday proclamations published or distributed by the Mississippi Secretary of State, and any other…

The WCC receives certain information from Third Parties that may be confidential. In compliance with Mississippi Code Annotated Section 25-61-9(1), trade secrets or confidential commercial or financial information is not released until notice has been given to the party submittin…

Payment for information requested must be made in advance and must be sufficient to cover the actual costs for the WCC and/or the customer agency/institution to furnish the information. Such costs include, but are not limited to, staff and/or counsel time to evaluate and research…

Standard Documents: Printed Copy of RFPs $25, plus actual cost of reproducing any oversized diagrams or other special Copy of RFPs on CD in Microsoft Word format $25 for word document; any oversized diagrams or other special attachments will be reproduced on paper or Paper copy o…