INSIDE

The Official Web Site ofthe State of South Carolina

Photo by Perry Baker, Courtesy of SC Department of Parks, Recreation and Tourism

sC.gov Portal rEPort 2014

Palmetto Pay .................................. 2

Agency Spotlight: New Online License Sales for DNR .......... 2

Security Incident Response: Don’t Rush the Notification Timeline ............... 3

Message From the General Manager

n July, SC.gov was selected to continue as the outsourced eGovernment provider for

the state of South Carolina following a competitive rebid process. The state awarded us a five-year contract that includes renewals that the state can exercise to extend the contract through July 2021. We appreciate the confidence that the state of South Carolina continues to place in us and look forward to continued success in providing eGovernment services to state agencies, local governments, and higher education institutions.

One of our most popular services is our payment processing, which includes credit card, debit card, and ACH payments made over the counter or online. We have grown from processing 27,000 payments for $5.5 million in 2006 to 1.32 million payments for $198 million in 2014. As an industry leader in payment processing, SC.gov will continue

I

| continued on page 4 |

The South Carolina Department of Consumer Affairs (SCDCA) Online Consumer Complaint Filing System, developed in partnership with SC.gov, has won the 2014 Digital Government Achievement Award. The Center for Digital Govern-

ment announced the winners, recognizing the Consumer Complaint System as best in class in the Government-to-Citizen, State Government category. The Digital Govern-ment Achievement Awards recognize outstanding agency and department websites and applications based on innovation, functionality, and efficiency. This award showcases the importance of real-time, accessible, online information and interactive services to the citizens and businesses of South Carolina.

Since the Online Consumer Complaint Filing System was launched to the public in January 2014, 60 percent of consumer complaints are now submitted online and submissions are resolved 50 percent faster. SC.gov was excited to build this applica-tion at no cost to the agency. The new online service provides an automated means for citizens to submit complaints, provides ease and expedience for businesses to respond, and has significantly reduced the agency’s copier, office supply, and postage expenses.

online Consumer Complaint Filing system Wins national award

“SCDCA and SC.GOV staff did a phenomenal job in the creation

of this cutting-edge Complaint System that is exceeding all

expectations of increasing efficiency and productivity.” — Carri Grube Lybarker, SCDCA Administrator

| continued on page 2 |

2 | SC.GOV PORTAL REPORT 2014

Palmetto PaySouth Carolina’s Premier Solution for Online Payments

New partners to Palmetto Pay in 2014 included the Department of Employ-

ment and Workforce, Department of Vocational Rehabilitation and Workers Compensation Commission, and several new municipal courts.

Palmetto Pay is SC.gov’s award-winning solu-tion to the need for a secure and convenient payment processor for South Carolina’s state and local governments. Since its inception in 2005, Palmetto Pay makes it easier to make online and over-the-counter (OTC) payments to state and local government agen-cies. Payments can be made via a desktop, laptop, tablet, or smartphone for services such as property taxes, traffic tickets, utility payments, etc. Built on the foundation of NIC’s self-funded model, Palmetto Pay is available at no cost to government partners. Each partner is provided with access to robust reporting options and excellent, 24/7 customer support. In 2013, SC.gov won the Center for Digital Government Best Fit Integrator Award for Palmetto Pay’s innovative and tailored payment processing solution.

Transaction volumes processed through Palmetto Pay continue to grow year over year. More than 130 state and local govern-ment entities use Palmetto Pay for online and OTC payments for more than 820 government services. By September, more than one million payments had been processed through Palmetto Pay in 2014.

Security is of the utmost importance to SC.gov. Palmetto Pay provides our partners and customers with the confidence that their payments are processed through a protected and secure channel. Committed to providing the highest level of payment

| continued on page 4 |

n November 2013 the South Carolina Department of Natural Resources (DNR) rolled out its new

DNR Online Customer Service Portal. This multichannel licensing system is the result of a long-standing partnership between DNR and SC.gov. This new license suite replaces an online license site in use since 2006. It also replaces the in-house sales system used by DNR for many, many years.

Citizens and those who visit South Carolina are offered added convenience with several new sales options available through the application. These options include commer-cial license sales through select point-of-sale agents, online boat registration renewals, and online lottery hunt applications.

By providing this application through the SC.gov partnership, DNR has benefited from a cost avoidance of $1,407,515 for software and hardware costs. DNR staff time processing paper applications and renewals has been significantly reduced.

The initial release of the DNR Online Customer Service Portal added the Lottery Hunt Online Application process, allowing hunters to apply for multiple state hunts online. Paper applications processed were reduced by 77 percent, saving the agency valu-able operational time and expense.

In the first 12 months, more than 1,996,456 licenses and other privileges for the

Department of Natural Resources have been sold through the application.

“With more and more of our hunters and anglers adopting new technologies like smartphones and tablets, it only made sense to give them a system that is conve-nient, easy to use, and fits their outdoor lifestyle. This is part of DNR’s continued efforts to transform how we can serve our customers more efficiently and effectively, by providing our state’s hunters and anglers with additional features and functionality through the convenient and secure DNR Online Customer Service Portal,” said Scott Speares, Assistant Deputy Director of Outreach and Support Services with the SC Department of Natural Resources.

In 2015, DNR will begin offering many recreational licenses with a 365-day valid period instead of the current July-June valid dates. This change, along with the enhance-ments of the new online licensing portal, will bring even more value to those who hunt and fish in South Carolina. n

agency spotlight

New Online License Sales for DNR

Photo by Perry Baker, Courtesy of SC Department of Parks, Recreation and Tourism

SCDCA’s online Complaint System offers quick and easy submission, tracking, and searching from desktop, laptop, or mobile device. After creating an account, consumers can submit, and businesses can respond

to, complaints electronically as well as add comments and monitor the status. The Consumer Complaint System also functions as a public information tool, allowing consumers, media, and other interested parties to search complaints on businesses of interest. n

online Consumer Complaint Filing system Wins national award| continued from page 1 |

I

SC.GOV PORTAL REPORT 2014 | 3

One of the primary concerns when dealing with a security breach is notification to appropriate impacted

parties. And, as security breaches and compro-mised personal information have become nearly a constant in news headlines, there are an increasing number of laws and regulations related to notification in the event of a security breach. In fact, 19 states either introduced or considered security breach legislation in 2014. In 2014, the Florida Information Protection Act of 2014 was passed, requiring notice to be provided to affected individuals as soon as possible, but no more than 30 days after discovery of the breach. The previous law had a 45-day requirement. Also this year, Kentucky became the latest state to enact security breach legislation, leaving only a few states without any laws requiring notification of secu-rity breaches involving personal information.

In connection with any crime scene, whether it is a cybercrime scene or a physical crime scene, notification about the incident is important. In a physical crime scene, it can take days or even weeks to collect toxicology reports or receive conclusive autopsy findings. In general, the public understands and appre-ciates the time required to collect, analyze, and report the findings of physical crime scene evidence. However, we are seeing something quite different in a cybercrime scene scenario, where expectations are continually being set for companies and cyberforensics profes-sionals to provide immediate and detailed information about a security incident. With a cybercrime, much like with a traditional crime scene, a thorough review of the evidence is essential and a necessary part of the process before any conclusions can be drawn. Despite the expectation, it is advisable to use caution and avoid communicating information too quickly, as this information may eventually

turn out to be erroneous or inaccurate. Accord-ingly, do not rush evidence collection and analysis simply to provide immediate informa-tion to the public. Accuracy is paramount, and it is not appropriate to jump to conclusions or make assumptions when you are in the midst of a security breach. Understand state breach notification laws and notification requirements set by federal law, or industry standards, such as the Payment Card Industry’s Data Security Standard. In addition, make sure sufficient facts have been gathered before making a public statement. Providing too much infor-mation that turns out to be inaccurate could

complicate your ability to effectively manage the breach and your credibility. While it is not always avoidable (i.e., you must comply with the law), guard against misstating informa-tion by rushing the notification timeline or you may run the risk of having to recant and explain earlier statements provided.

In connection with a physical crime scene, a command post is often established to serve as a location for team meetings as well as the location from which media updates are communicated. In addition, a team is formed and specific roles and responsibilities are assigned regarding the reporting of updates. Setting up a command post may also be a good idea for managing a security breach, depending on the magnitude of the issue. This can go hand in hand and be leveraged with executing on a thorough incident response plan, which should serve as the guide for

handling a security breach, including specific roles and responsibilities for multiple teams, notification, and communication.

One of the first things an incident response plan should establish is identification of the incident response team members. Often, team members identified in the plan include the highest leadership levels within the organiza-tion, communications personnel, security and IT professionals, and frontline operations employees. The plan should also clearly define the roles and responsibilities of each incident response team member, including specific action items with associated timelines. Finally,

on an annual basis, the plan should undergo a comprehensive review and modifications should be made, where appropriate, and employees should be trained on how to effec-tively carry out the plan. This will help ensure that the plan is up to date and that incident response team members are prepared should a security incident occur. This will also help alleviate any pressure to report findings imme-diately as the plan should be followed to guide the communication timeline.

Again, even as new legislation continues to tighten security breach notification timelines that you will be expected to follow, it is not advisable to rush the communication process during a security incident. The best response will stem from taking the necessary time to gather and analyze the cybercrime scene evidence, as well as following a detailed inci-dent response plan.

security Incident response: Don’t rush the notification timeline

“ With a cybercrime, much like with a traditional crime scene, a thorough review of the evidence is essential and a necessary part of the process before any conclusions can be drawn.”

© 2015 Trozzolo.com

InsIghts is published by South Carolina Interactive. Your questions and comments are welcome. Please contact us at:

1301 Gervais Street, Suite 710 | Columbia, SC 29201(803) 771-0131 | SC.gov | http://scinteractive.sc.gov

Focus on solutions South Carolina Self-Funded eGovernment

e are thrilled about our continued long-standing partnership and eager to help advance the future of the state’s official website, SC.gov, and eGovernment services in South Carolina.The SC.gov portal team provides state and local governments in South Carolina

five enterprise services that are the foundation of its self-funded business model: Palmetto Pay, Palmetto Site Builder, Palmetto Event Registration, MyEvents2Go, and Palmetto Online Storefront. All five of these solutions, as well as custom online application development, provide cost-effective eGovernment solutions to state and local governments in South Carolina.

Palmetto Online Storefront and MyEvents2Go are SC.gov’s newest enterprise offerings intro-duced in 2014. Both applications are available 24/7, allow for branding customization, and do not require any setup or maintenance costs.

Palmetto Online Storefront allows agencies, divisions, counties, or municipalities to sell items online. Items can be added and available for sale in minutes, with tax and shipping calculations. Robust reporting options are available to partners, and customers can pay securely by credit card, debit card or electronic check.

If you are having an event and want to provide instant access to information and stay connected with attendees during events, meetings, and conferences, then MyEvents2Go is a great fit. Attendees are able to download and save multiple events, add agenda items to their calendars, and view events on multiple devices in minutes. Organizers can edit agenda and menu items, display speaker bios, and feature sponsors, local information, and more.

SC.gov’s enterprise eGovernment services allow citizens and businesses the convenience of inter-acting with state and local governments 24/7/365, whether it is to make a payment, visit a website, register for an event, view event agendas on their devices, or purchase items from agencies online. With SC.gov’s unique self-funded model these services are offered at no cost to government enti-ties, making SC.gov a valuable resource for eGovernment solutions and saving the state more than $14.8 million since 2005. Currently, SC.gov works with 164 partners to maintain and support more than 50 apps and 977 services. We are committed to South Carolina and looking forward to forging new partnerships to provide more interactive government services in the coming years. For more information visit http://scinteractive.sc.gov. n

W

Palmetto Pay

processing security, Palmetto Pay now supports payments through encrypted card swipes. The use of a card swipe with encryption adds an additional layer of protection for our partners and their customers.

For more information about Palmetto Pay including features, benefits, statis-tics, and partner references, please visit http://scinteractive.sc.gov.

to enhance our systems with improved functionality and new innovative features.

SC.gov worked diligently with the SC Department of Consumer Affairs (DCA) to create a world-class online consumer complaint filing system that won the 2014 Digital Government Achievement Award. The system was launched to the public in January 2014 and 60 percent of consumer complaints are now submitted through the online system instead of by paper. This application exemplifies what the self-funded model is all about.

We are excited about continuing to provide efficiency and innovation to the South Carolina citizens, businesses, and governments through our secure enter-prise and customized eGovernment services for many years to come.

Ken Oliphant

Message From the General Manager| continued from page 1 |

| continued from page 2 |