Identity and access management
Verified identities, role assignments, privileged access, session controls, review, revocation, and credential lifecycle.
Protect the network, govern the data, preserve the institution.
A statewide security and data-governance framework for Olympus Command and the STEAD digital ecosystem.
The STEAD Cybersecurity, Data Governance, and Resilience framework defines how identity, access, records, integrations, devices, facilities, analytics, continuity, vendors, and incident response remain secure, accountable, and recoverable.
Public security boundary: This page describes
governance principles only. Restricted
configurations, network diagrams, credentials,
detection logic, vulnerabilities, incident
procedures, system locations, and defensive
architecture remain within controlled technical
documentation.
Security purpose
A connected correctional system must remain secure even when individual components fail.
STEAD relies on connected facilities, command systems, workforce records, resident records, healthcare, education, asset management, communications, analytics, and digital twins.
That connectivity increases operational awareness, but it also creates responsibility. Every identity, device, integration, vendor, dataset, and automated process must remain governed throughout its lifecycle.
Security is therefore designed as a permanent operating discipline—not a one-time technology project or a final approval obtained before launch.
01
Zero assumed trust
Every user, device, service, and request
must be identified, authorized, and logged.
02
Least-privilege access
People and systems receive only the access
required for legitimate duties.
03
Data minimization
Collect, retain, share, and expose only what
is necessary for defined public purposes.
04
Resilient local operation
Facilities preserve essential functions
during network, platform, or vendor disruption.
05
Continuous verification
Monitoring, testing, review, and
corrective action continue after deployment.
Core security domains
Eight domains protect the statewide digital ecosystem.
Segmentation and secure connectivity
Controlled zones, encrypted communications, isolated functions, monitored interfaces, and resilient facility links.
Data classification and governance
Ownership, purpose, quality, sensitivity, retention, correction, sharing, archival, and lawful destruction.
Endpoint and asset security
Inventory, configuration, updates, health, encryption, monitoring, maintenance, replacement, and secure disposal.
Secure platforms and integrations
Approved development, testing, interfaces, logging, change control, dependencies, secrets, and vulnerability management.
Detection and response
Monitoring, alerting, triage, containment, recovery, evidence, notification, investigation, and after-action review.
Backup and operational resilience
Recovery objectives, tested backups, alternate communications, manual procedures, local continuity, and restoration priorities.
Vendor and supply-chain security
Due diligence, contractual controls, access boundaries, breach duties, audit rights, dependencies, transition, and exit.
Security principle
A secure system is not one that never fails. It is one that can detect, contain, recover, and learn.
Correctional operations cannot depend on the assumption that every device, network, vendor, credential, or software component will remain available and uncompromised.
STEAD therefore combines prevention with containment, continuity, recovery, and verified correction.
The institution must remain capable of maintaining custody, safety, healthcare, communications, accountability, and lawful authority during a major cyber or technology disruption.
Data-governance controls
Every dataset requires a defined purpose, owner, and lifecycle.
Authorized use
Data is collected and used only for defined, lawful, documented institutional purposes.
Responsible data steward
Every major dataset has an accountable owner for quality, access, retention, and correction.
Sensitivity and handling
Public, internal, restricted, clinical, personnel, legal, security, and other classes receive appropriate controls.
Accuracy and completeness
Validation, source tracking, duplicate review, correction, timeliness, and known limitations remain documented.
Need-based permissions
Access reflects role, location, authority, purpose, sensitivity, and current assignment.
Lifecycle and lawful disposal
Records remain available only as long as law, operations, oversight, and documented purpose require.
Controlled exchange
Internal and external sharing requires authorization, minimum necessary disclosure, logging, and enforceable restrictions.
Error review and remedy
Material inaccuracies can be challenged, investigated, corrected, and traced through the audit record.
Cyber incident and resilience cycle
Eight stages preserve command and continuity during disruption.
Define authority and continuity
Plans, roles, backups, alternate procedures, contacts, exercises, and decision rights remain current.
Identify abnormal conditions
Monitoring, reports, alerts, health checks, and behavioral indicators surface potential incidents.
Assess severity and impact
Determine affected systems, facilities, data, operations, safety, legal duties, and response priority.
Limit operational spread
Isolate affected components, restrict access, activate local continuity, and preserve essential services.
Restore trusted operation
Rebuild, validate, restore data, test services, reconnect in stages, and verify operational safety.
Meet legal and governance duties
Inform responsible leaders, affected parties, oversight bodies, partners, and authorities as required.
Establish cause and responsibility
Preserve evidence, determine scope, identify failure paths, review controls, and document decisions.
Correct the underlying condition
Update architecture, policy, training, contracts, monitoring, continuity, and statewide standards.
STEAD Cybersecurity, Data Governance, and Resilience
A connected correctional system must remain secure, lawful, recoverable, and understandable.
STEAD protects the Olympus ecosystem through governed identity, least-privilege access, secure connectivity, data stewardship, resilient local operations, continuous monitoring, vendor controls, tested recovery, and transparent corrective accountability.