Florida Digital Bill of Rights (FDBR) 2-3.002(3): Rule 2-3.002(3): administrative security practices

A controller must maintain effective organisational controls; designate a qualified individual responsible for the data security practices; document compliance, including breaches; regularly test and monitor key controls, systems and procedures to detect actual and attempted attacks; limit system access to authenticated and authorised users; manage permissions using least privilege and separation of duties; verify identities and manage the whole user access life cycle; train authorised users in security and in recognising when the collection purpose has been met; and keep training current on threats.