<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Franklin Gothic Book";
panose-1:2 11 5 3 2 1 2 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
p.xmsotitle, li.xmsotitle, div.xmsotitle
{mso-style-name:x_msotitle;
margin:0in;
text-align:center;
font-size:12.0pt;
font-family:"Times New Roman",serif;
font-weight:bold;}
p.xmsonospacing, li.xmsonospacing, div.xmsonospacing
{mso-style-name:x_msonospacing;
margin-top:0in;
margin-right:31.7pt;
margin-bottom:0in;
margin-left:0in;
text-autospace:none;
font-size:11.0pt;
font-family:"Franklin Gothic Book",sans-serif;}
p.xmsolistparagraph, li.xmsolistparagraph, div.xmsolistparagraph
{mso-style-name:x_msolistparagraph;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.EmailStyle24
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:32393478;
mso-list-template-ids:1448511072;}
@list l0:level1
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:"Courier New";
mso-bidi-font-family:"Times New Roman";}
@list l0:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:1.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:"Courier New";
mso-bidi-font-family:"Times New Roman";}
@list l0:level3
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:1.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:"Courier New";
mso-bidi-font-family:"Times New Roman";}
@list l0:level4
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:2.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:"Courier New";
mso-bidi-font-family:"Times New Roman";}
@list l0:level5
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:2.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:"Courier New";
mso-bidi-font-family:"Times New Roman";}
@list l0:level6
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:3.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:"Courier New";
mso-bidi-font-family:"Times New Roman";}
@list l0:level7
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:3.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:"Courier New";
mso-bidi-font-family:"Times New Roman";}
@list l0:level8
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:4.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:"Courier New";
mso-bidi-font-family:"Times New Roman";}
@list l0:level9
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:4.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:"Courier New";
mso-bidi-font-family:"Times New Roman";}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="xmsotitle" align="left" style="margin-top:12.0pt;text-align:left"><i><span style="font-weight:normal">Sharing the following correspondence from State CIO, Terrence Woods, that we are distributing to local governments through various channels.
<o:p></o:p></span></i></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="702" style="width:526.5pt;border-collapse:collapse">
<tbody>
<tr style="height:72.45pt">
<td width="136" valign="top" style="width:101.7pt;padding:0in 5.4pt 0in 5.4pt;height:72.45pt">
<p class="MsoNormal" style="line-height:105%"><o:p> </o:p></p>
<p class="MsoNormal" style="line-height:105%"><img width="121" height="87" style="width:1.2569in;height:.9027in" id="Picture_x0020_3" src="cid:image001.png@01D86B93.022BA950"><o:p></o:p></p>
</td>
<td width="566" valign="top" style="width:5.9in;padding:0in 5.4pt 0in 5.4pt;height:72.45pt">
<p class="MsoNormal" style="line-height:105%"><b><o:p> </o:p></b></p>
<p class="MsoNormal" style="line-height:105%"><b>Cinnamon Albin<o:p></o:p></b></p>
<p class="MsoNormal" style="line-height:105%">Cyber Security<o:p></o:p></p>
<p class="MsoNormal" style="line-height:105%">Enterprise Information Services<o:p></o:p></p>
<p class="MsoNormal" style="line-height:105%">Cyber Security Services (CSS)<o:p></o:p></p>
<p class="MsoNormal" style="line-height:105%">Cell: (971)707-1966<o:p></o:p></p>
</td>
</tr>
<tr>
<td width="702" colspan="2" valign="top" style="width:526.5pt;padding:0in 5.4pt 0in 5.4pt">
<p class="MsoNormal" style="line-height:105%"><i><span style="color:#2E74B5">“Ensuring user-friendly, reliable and secure state technology systems that serve Oregonians.”<o:p></o:p></span></i></p>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal"><o:p> </o:p></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="702" style="width:526.5pt;border-collapse:collapse">
<tbody>
<tr>
<td width="702" valign="top" style="width:526.5pt;padding:0in 5.4pt 0in 5.4pt">
<p class="MsoNormal"><o:p> </o:p></p>
</td>
</tr>
</tbody>
</table>
<div style="border:none;border-bottom:solid windowtext 1.0pt;padding:0in 0in 1.0pt 0in">
<p class="xmsotitle" align="left" style="text-align:left"><i><span style="font-weight:normal"> </span></i><o:p></o:p></p>
</div>
<p class="xmsotitle" align="left" style="text-align:left"><i><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;font-weight:normal"> </span></i><o:p></o:p></p>
<p class="xmsonospacing"><span style="font-size:12.0pt;font-family:"Times New Roman",serif">The Cybersecurity and Infrastructure Security Agency (CISA) issued
<a href="https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.cisa.gov%2Femergency-directive-22-03&data=05%7C01%7Ccinnamon.s.albin%40das.oregon.gov%7C02bc7a6e360d46497c3e08da39e67b36%7Caa3f6932fa7c47b4a0cea598cad161cf%7C0%7C0%7C637885959315155198%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=5q5oRom7kSKvcW9J2WMuNl0dYJCmxhO7jKYtExH54n8%3D&reserved=0">
<i>Emergency Directive 22-03 (ED 22-03) Mitigate VMware Vulnerabilities</i></a> May 18, 2022, requiring federal civilian executive branch agencies running specific VMware products to apply VMware updates or remove the products from agency networks until the
update can be applied. In partnership with the Governor’s Office, I have directed the same mitigation actions for all state agencies with a targeted completion date of May 20, 2022. I encourage you to follow the CISA guidance for your own organizations.
<o:p></o:p></span></p>
<p class="xmsonospacing"><span style="font-size:12.0pt;font-family:"Times New Roman",serif"> <o:p></o:p></span></p>
<p class="xmsonospacing"><span style="font-size:12.0pt;font-family:"Times New Roman",serif">The emergency directive is in response to observed or expected active exploitation of a series of vulnerabilities (CVE 2022-22954, CVE 2022-22960, CVE-2022-22972, CVE-2022-22973)
in the following VMware products: <o:p></o:p></span></p>
<p class="xmsolistparagraph" style="margin-left:.75in;text-indent:-.25in;mso-list:l0 level1 lfo2">
<![if !supportLists]><span style="font-size:10.0pt;font-family:"Courier New""><span style="mso-list:Ignore">o<span style="font:7.0pt "Times New Roman"">
</span></span></span><![endif]>VMware Workspace ONE Access (Access), <o:p></o:p></p>
<p class="xmsonospacing" style="margin-left:.75in;text-indent:-.25in"><span style="font-size:12.0pt;font-family:"Times New Roman",serif">o VMware Identity Manager (vIDM),
<o:p></o:p></span></p>
<p class="xmsonospacing" style="margin-left:.75in;text-indent:-.25in"><span style="font-size:12.0pt;font-family:"Times New Roman",serif">o VMware vRealize Automation (vRA),
<o:p></o:p></span></p>
<p class="xmsonospacing" style="margin-left:.75in;text-indent:-.25in"><span style="font-size:12.0pt;font-family:"Times New Roman",serif">o VMware Cloud Foundation,
<o:p></o:p></span></p>
<p class="xmsonospacing" style="margin-left:.75in;text-indent:-.25in"><span style="font-size:12.0pt;font-family:"Times New Roman",serif">o vRealize Suite Lifecycle Manager (impacted VMware products).
<o:p></o:p></span></p>
<p class="xmsonospacing"><span style="font-size:12.0pt;font-family:"Times New Roman",serif"> <o:p></o:p></span></p>
<p class="xmsonospacing"><span style="font-size:12.0pt;font-family:"Times New Roman",serif;color:black">These required actions apply to agency assets in any information system, including an information system used or operated by another entity on behalf of
an agency, that collects, processes, stores, transmits, disseminates, or otherwise maintains agency information.</span><span style="font-size:12.0pt;font-family:"Times New Roman",serif"><o:p></o:p></span></p>
<p style="margin-bottom:7.5pt;background:white"><span style="font-size:12.0pt;font-family:"Times New Roman",serif;color:black">For information systems hosted in third-party environments, each agency is responsible for maintaining an inventory of its information
systems hosted in those environments and obtaining status updates pertaining to, and to ensure compliance with, this directive.</span><span style="font-size:12.0pt"><o:p></o:p></span></p>
<p class="xmsotitle" align="left" style="text-align:left"><span style="font-weight:normal">Sincerely,</span><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="893" style="width:9.3in;margin-left:5.4pt;border-collapse:collapse">
<tbody>
<tr style="height:72.45pt">
<td width="269" valign="top" style="width:2.8in;padding:0in 5.4pt 0in 5.4pt;height:72.45pt">
<p class="MsoNormal" style="line-height:105%"><img border="0" width="81" height="57" style="width:.8402in;height:.5972in" id="Picture_x0020_2" src="cid:image002.jpg@01D86B94.78982B80"><span style="color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal" style="line-height:105%"><b><span style="color:#1F497D">Terrence Woods<o:p></o:p></span></b></p>
<p class="MsoNormal" style="line-height:105%"><span style="color:#1F497D">State Chief Information Officer<o:p></o:p></span></p>
<p class="MsoNormal" style="line-height:105%"><span style="color:#1F497D">Enterprise Information Services<o:p></o:p></span></p>
<p class="MsoNormal" style="line-height:105%"><span style="color:#1F497D">Executive Assistant: Dagny George<o:p></o:p></span></p>
<p class="MsoNormal" style="line-height:105%"><u><span style="color:#0563C1"><a href="mailto:Dagny.george@oregon.gov"><span style="color:blue">Dagny.george@oregon.gov</span></a></span></u><span style="color:#1F497D"> | 971.707.0233<o:p></o:p></span></p>
</td>
<td width="624" style="width:6.5in;padding:0in 0in 0in 0in;height:72.45pt">
<p class="MsoNormal" style="line-height:105%"> <b> </b><o:p></o:p></p>
</td>
</tr>
</tbody>
</table>
<p class="xmsotitle" align="left" style="text-align:left"><o:p> </o:p></p>
</div>
</body>
</html>