OIT INFORMATION

• About Us
• Customer Service
• Enterprise Services & Rates
• Policies, Standards & Procedures
• eGovernment
• Accessibility
• Security
• Project Management
• Architecture

Remote Hosting Policy

By Paul Sandlin, eGov Services, OIT

The State of Maine Remote Hosting Policy was recently approved by Richard Thompson, the Chief Information Officer for the State of Maine. The policy is intended to address the numerous vulnerabilities in the State’s web presence produced by the out sourcing of web hosting to commercial 3rd parties.

Agencies of the State of Maine have many options for hosting web applications and content. These options include InforME as well as several other internal Internet hosting environments. Generally speaking, these environments enjoy the collective security, consistency, and economies of the State as a whole. Even so, for various reasons agencies have found it necessary to obtain hosting services from outside providers. Frequently these arrangements are facilitated by non-technical staff who, seeking the best price for the services, are perhaps unaware of the costs of not paying due regard to potential risks and liabilities presented by sub-standard reliability and security.

Experience has shown that remote hosting arrangements are far more vulnerable to being hacked. These hacking events can range from simple defacements to the compromise of sensitive data. In the aftermath, agencies are subject to the expense of regaining control of their web presences, fixing corrupted content and even notifying members of the public who may have had their personal data compromised. In some ways these costs are minor compared to the costs borne by the State as a whole both in terms of its good name and the consequent damage to its ability to serve the public.

State services delivered online have the dual advantages that they are cheaper to offer and frequently more convenient for the public to use than traditional delivery. The combination makes it certain that the State will be delivering more of its services to the public online going forward. A key to being able continue to expand online services to the public is the preservation of their trust in our ability to reliably and discretely provide services. Any public failure by any State entity in its web initiative undermines the effectiveness of all online services.

It is for all these reasons that the Remote Hosting Policy was developed. The policy details the minimum levels of security, reliability and many other characteristics required for any remote hosting arrangement. All State requests for proposals and contracts which may result in the acquisition of these services are required to include language in accord with this policy. It is hoped that this policy will provide the guidance and structure to protect agencies that find themselves entertaining a non-state hosting arrangement.

Please direct any questions and comments to Paul Sandlin, eGovernment Services, Office of Information Technology, State House Station #138, Augusta, ME 04333, Telephone: (207) 624-9427.