The department shall develop an information security program that uses existing state standards and complies with applicable state and federal laws.