New Mexico Administrative Code

A. A user management process shall be established, documented and provided to all IT staff of the agency which outlines and identifies all aspects of user management including the generation, distribution, modification, and deletion of user accounts. This process shall ensure tha…

Password protocols shall be developed consistent with state standards and implemented to ensure all authorized individuals accessing agency resources follow 1.12.11 NMAC Enterprise Architecture. Such password protocols shall be mandated by automated system controls whenever possi…

A. Connecting any computing device not owned by the state of New Mexico to a state network or to any state computing device is prohibited unless authorized in writing by the agency CIO. B. Installation of any software, executable or other file to any state computing device is pro…

A. All state owned computing devices that are, or will be, accessible from outside the agency network shall be scanned by DoIT, DoIT-approved contractor or DoIT-approved agency IT staff for vulnerabilities and weaknesses prior to installation on the state network and following an…

All state computing infrastructures that provide information through a public network, either directly or through another dedicated circuit, and that provide information externally (such as through the world-wide web), shall be subject to annual independent penetration analysis a…

A. Software and any other mechanism to prevent intrusions shall be implemented across agency systems to prevent as well as detect the introduction of malicious code. The introduction of malicious code can cause serious damage to networks, workstations, and business data. B. Agenc…

A. Systems that process or store sensitive or confidential information or services that provide support for critical services shall undergo technical security reviews by agency system administrators to ensure compliance with implementation standards and rules as promulgated by Do…

A. All state owned portable computing resources and removable media shall be secured to prevent compromise of confidentiality or integrity of information. All portable computing devices and removable media must be protected by a password. B. No portable and removable media comput…

A. Users are prohibited from sending documents containing sensitive and confidential information via fax unless allowed by law. B. Users are prohibited from using fax services to send or receive sensitive and confidential information. C. Users are prohibited from using third-part…

Connecting any dial-up modem to any computer systems which are also connected to the agency's local area network, to the state network, or to another internal communication network shall first be approved in writing by the agency CIO.

NMSA 1978 Section 9-27-6 F (3) and 9-27-6 I (1).

A. Sensitive and confidential information shall not be available through a server accessible to a public network without appropriate safeguards in place as approved in writing by the agency CIO in consultation with the agency legal counsel. The agency ISO shall implement safeguar…

This section is limited to the IT infrastructure and the data and applications of the local agency environment. A. A threat and risk assessment shall be performed by the agency to determine the criticality of business systems and the time frame required for recovery in the event …

A. Log-on banners shall be implemented on all state IT systems to inform all users that agency systems are only for agency business and other approved uses consistent with agency policy, to inform that users their activities may be monitored, and to inform the user that they have…

A. Consistent with applicable law, the agency reserves the right to monitor, inspect, and search at any time, all agency information systems and equipment used by agency users. Since agency computers and networks are provided for state business purposes, agency staff and any cont…

In the event of a lost or stolen IT asset, the user shall: A. immediately report the incident to the user's supervisor; B. immediately report the incident to the DoIT help desk at (505)827-2121 or EnterpriseSupportDesk@state.nm.us; a state IT asset incident form must be completed…

Permanent.

April 14, 2010, unless a later date is cited at the end of a section.

The purpose of this rule is to establish security operation management practices for executive branch agencies and any other state entity which utilizes the state information technology (IT) infrastructure in the operation of their information technology (IT) systems and infrastr…

Defined terms apply to this rule and all other rules promulgated by the secretary and adopted by the information technology commission. A. "Act" means the Department of Information Technology Act, NMSA 1978 9-27-1 et seq. B. "Agency" means an executive branch agency of the state …

A. All agency IT technical operations shall have documented security operating instructions, management processes, and formal incident management procedures in place that define roles and responsibilities of individuals who operate or use agency IT technical operations and facili…

Segregation of duties is required to reduce the risk of accidental or deliberate damage to the state or agency IT system through misuse by a person or persons. In small agencies in which separation of duties is difficult to achieve, with the approval of DoIT, the agency shall imp…

Department of Information Technology ("DoIT")

These additional rules apply to assistance grant programs. A. Authorization. An assistance grant is authorized if the: (1) total available program funding does not exceed $2,500,000, (2) funding source specifies the grantee or subrecipient; (3) funding source requires program fun…

These rules apply when a person seeks to challenge any action or inaction authorized, taken, required or governed by these rules, by a funding source or by any state or federal law that governs a program and is not, by law or agreement, within the exclusive subject matter jurisdi…

A sponsoring body may unilaterally terminate an award only as authorized by, and subject to the requirements of, these rules. A. Uncured material default. A sponsoring body may terminate an award based on a grantee's uncured failure to comply with or satisfy a material term of an…

These rules apply to the development, award and administration of grant programs within the jurisdiction of DoIT, the Office of Broadband Access and Expansion ("OBAE"), the Connect New Mexico Council ("Council"), or to any public body administratively attached to DoIT, directly o…

Paragraphs A and B of Section 9-27-6 NMSA 1978; Paragraph C of Section 63-9K-4 NMSA 1978;

Permanent.

April 11, 2023, unless a later date is cited at the end of a section.

These rules establish standards and practices for the development, challenge, application, award and administration of subject grant programs.

These rules are subject to all applicable statutory definitions in Section 63-9K-2 NMSA 1978 and in Section 9-27-3 NMSA 1978, and to these supplemental definitions: A. "Application" means the compilation of information and materials that comprise a formal request to receive an aw…

These rules govern all subject grant programs: A. Program administrator. A sponsoring body shall designate at least one person to serve as the program administrator for each grant program. The sponsoring body for a program shall notify applicants and grantees (as applicable) of a…

These additional rules apply to a merit based grant program. A. Merit requirement. Unless the rules applicable to an assistance grant program apply, a grant program shall be merit based. B. General merit standards. A merit based grant program shall be designed and conducted in a …

Information Technology Commission.

This rule applies to all executive state agencies.

NMSA 1978 Section 15-1C-5.

Permanent.

June 15, 2000, unless a later date is cited at the end of a section.

The purpose of this rule is to establish requirements regarding state agency electronic mail systems.

As used in this rule, third-party relay means that feature of an Internet electronic mail system that enables any mail sender on the Internet to transfer messages using any mail server on the Internet installed with the feature, regardless of the mail server's location.

State agencies operating Internet electronic mail systems shall disable the third party relay feature and shall take any other steps necessary to ensure that electronic mail originating from outside state agencies is not relayed by state-owned mail servers.

A. An agency seeking an exemption from the requirements of this rule shall file a written request with the CIO. The request shall state the grounds for the exemption request and shall include any information available to support the request. The CIO shall respond to the request w…

Information Technology Commission.

BMAC will provide high-level management oversight for the shared broadband circuit network including, but not limited to, provision of new services and changes in direction, service level, or attributes of broadband circuit service.

ISD-OC will: A. provide administrative management of all broadband circuits leased by state agencies, including control of billing and contracts; B. provide technical management of all shared broadband circuits; C. participate in the negotiation of all new agreements for broadban…

The CIO will: A. participate in the negotiation on behalf of the state all new agreements for broadband circuit service; B. participate in the negotiation of renewal agreements for broadband circuit service in conjunction with agencies as individual agency contracts for broadband…