Baseline Workstation Security Configuration Standard

The purpose of the Baseline Workstation (computers used for work related reasons including but not limited to Desktops, laptops, phones, tablets, iPads, etc.) Security Configuration Standard is to establish a minimum baseline configuration for workstations within the Diocese that is adaptable for all office rectories, parishes, and schools. The Diocese of Paterson and local laws require workstations used within our organization have a minimum level of security which is outlined within this document.

The purpose of this Standard is to establish a standard for the secure use and protection of all workstations within the Diocese of Paterson.

The scope of this Standard includes all workstations within any of the Diocese of Paterson facilities, any workstation that has access to a diocesan network, or any workstation that stores any nonpublic diocesan information.

• 4.1 Antivirus
  • 4.1.1 All workstations must be able to support an anti-virus currently approved by the Diocese of Paterson.
  • 4.1.2 All workstations are required to have their anti-virus up-to-date with the latest patches, enabled, and must be always running (this can be done through options within the anti-virus eg enable auto-update)
  • 4.1.3 Updates must be checked for and downloaded daily (this can be done through options within the anti-virus eg enable auto-update)
  • 4.1.4 Full-scans of the workstation must be done weekly.
• 4.2 Logging
  • 4.2.1 All logs must be compliant with the Information logging standard.
• 4.3 Backups
  • 4.3.1 Backups of all sensitive information related to the Diocese must follow the 3-2-1 rule.
    • 3 copies must be made in 2 separate storage medias and 1 must be offsite.
  • 4.3.2 Differential/Incremental backups must be performed daily with full backups being done weekly.
  • 4.3.3 All employees must be mindful of which data they are backing up and must be in accordance with Data governance laws which includes but is not limited to: HIPAA, FERPA, CIPA.
• 4.4 Encryption
  • 4.4.1 All portable workstations must have Full Disk Encryption (FDE) enabled.
• 4.5 Logoff/Lock Policy
  • 4.5.1 All workstations must have a rule set up to automatically either log the user off or to lock the device after 15 minutes of non-use.
  • 4.5.2 Users must lock or logoff the workstation before leaving a workstation unattended.
• 4.6 Patch Management
  • 4.6.1 All workstations must run the most modern Operating System (OS) and attempt to be running the most modern version of the current OS.
• 4.7 Active Directory (If the location is using active directory)
  • 4.7.1 All compatible workstations with Microsoft Active Directory (AD) must be added as members to the correct departmental AD Organizational Unit.

• 5.1 Compliance Measurement
  The DoP Technology team may verify compliance to this Standard through various methods, including but not limited to, business tool reports, internal and external audits, and feedback to the Standard owner.
• 5.2 Exceptions
  All devices should be compliant with cyber insurance standards and local/federal governance standards. Any exception/outliers should be approved by the DoP Technology team in advance.
• 5.3 Non-Compliance
  An employee found to have violated this Standard may be subject to disciplinary action, up to and including termination of employment.

• 6.1 Chancery.rcdop.org