1240LT26R0008-0001 Pinyon Instructions for External Partners.docx

Quick Reference Guide Pinyon Instructions for External Partners

Contents

Instructions to the External Partner Collaborating in a Pinyon External Folder This link provides directions for FS Pinyon users on how to setup an external collaboration folder in Pinyon that may be used for collaboration with partners outside the Forest Service: Pinyon External Collaboration Agreement.

1. Once the external collaboration folder has been setup, the co-owner of the Forest Service external folder will send a collaboration invitation to the External User’s email address. The external user’s email should be the email the external partner uses for either their current or existing Enterprise Box account or what they plan to use to setup a free Box account.

2. The External User should then logon to their email account and click on Accept Invite in the email invitation.

3. This will take them to the Box website. If the External User already has a Box account with the email address the invitation was sent to, then they must login to their existing Box account. Otherwise, they will need to sign up for a free Box account with the same email address the invitation was sent to using an online form and answering a few questions to complete the setup of their account.

4. Select For Work and click Next

5. On the Collaborate with Others screen, click Skip this and go straight to Box.

6. Once their Box account is setup, they will need to accept the invitation in Box by clicking See Invitations and then click on Accept.

7. External users will then see a FS Terms of Service agreement that they will need to read and accept by clicking the Agree and Accept button.

8. External Users should then click Yes when prompted with the following screen:

9. This should successfully make them a collaborator on the folder shared by the Forest Service employee.

Box Desktop Tools for Edit Capability (if supported) If supported by their organization, external collaborators may download Box Tools to allow editing from the Box web application. These tools are downloaded directly from the Box website. See the directions for How to install Box Tools.

In addition, Box for Office includes Box functionality for key Office products—Microsoft Word, Excel, PowerPoint, and Outlook—in a single app. See the directions for How to install Box for Office.

Third-Party Access Terms of Service and Rules of Behavior The U.S. Forest Service (USFS) offers online collaboration and storage in the USFS Pinyon System. This Service (“USFS Pinyon System”) is subject to the follow terms.

Subject to your acceptance of these Terms of Service (and Rules of Behavior contained within) you are allowed use of the USFS Pinyon System. Use of the USFS Pinyon System constitutes acceptance to these terms as well as any relevant USFS Forest Service policies and agreements.

If you are using the Services on behalf of an organization, you are agreeing to these Terms for that organization. These Terms of Service are not meant to replace any current formal Forest Service Interagency Data Sharing, Joint Venture or other agreements created, used, or required in the normal course of Forest Service business. These terms of service augment such agreements for the specific purpose of using Pinyon as the mechanism of sharing documents and information and does not supersede any formal agreements.

Laws and departmental mandates on data security and privacy shall take precedence over policies listed in these terms and rules of behavior below. The applicable laws and regulations are listed here:

· NIST Special Publication 800-53, Recommended Security Controls for Federal Information Systems and Organizations

· NIST Special Publication 800-53A, Guide for Assessing the Security Controls in Federal Information Systems and Organizations

· Privacy Act of 1974 (5 USC 552a)

Rules of Behavior for Third Parties Accessing Forest Service Pinyon:

1. The third party shall ensure they do not share with others or post to public websites(including but not limited to social media and networking sites) any Controlled Unclassified Information (CUI) including Personally Identifiable Information (PII) or sensitive data that is shared with them through this agreement.

2. The third party shall ensure they do not share with others or post to public websites (including but not limited to social media and networking sites) any data that is shared with them through this agreement without explicit permission from the content Custodian. The exception would be any data that has already been earmarked or identified as public.

3. The third party shall be solely responsible for ensuring its nominated Pinyon collaborators are not security risks, and upon request from the Forest Service (FS), the third party will provide the FS with any information reasonably necessary for the FS to evaluate security issues.

4. The third party understands that only FS individuals may be named as Co-Owners to a shared folder.

5. The third party will promptly inform the FS in writing of any relevant employee changes. This includes the rotation and resignation of employees so that the FS Content Custodian can remove their access.

6. The third party is solely responsible for ensuring that all usernames and passwords are not shared with others and not used by unauthorized individuals. The third party must immediately contact the FS if they suspect these details have been compromised.

7. The third party will be held responsible for all activities performed on the FS Pinyon environment while logged in under their usernames and passwords.

8. The third party must ensure at all times that all computer devices used by them to connect to the FS Pinyon environment have reputable up to date anti-virus software and the appropriate security patches installed.

9. Should the business requirements necessitate the third party to transport FS information outside of Pinyon in the form of digital media like mobile devices, computers, removable storage and/or non-digital media like paper & microforms, the third party must ensure that only the absolute minimum amount of information as is absolutely necessary is put on those media. The third party must verify that all sensitive data written to removable digital media (i.e. Thumb drives and portable hard drives) is encrypted (FIPS compliant) and place removable digital media contain said sensitive data into a locked container for transportation. When hand carrying non-digital (print/hardcopy) media containing sensitive information, safeguard the media from disclosure. This includes precautions against oral disclosure, prevention of visual access to the information, and precautions against release of the material to unauthorized personnel. Note: The sensitivity of media may require overnight storage in a safe with a Combination lock.

10. Make sure that all media containing sensitive information is properly marked Controlled Unclassified Information (CUI), and the information is securely deleted when it is no longer required. Controlled Unclassified Information (CUI) markings must be used on any non-digital formats that contain CUI. Additionally, if the information is no longer needed then it must be securely deleted using media sanitation industry best practices. These practices include, but are not limited to, destroying paper using cross cut shredders, burn micro-forms, factory reset mobile devices and destroy them by burning the device in a licensed incinerator, overwrite removable storage media by using agency-approved and validated overwriting technologies/methods/tools and destroying it by burning in a licensed incinerator.

11. Should the business requirements necessitate the third party to print or store FS information in non-digital formats, the third party must ensure that only the absolute minimum amount of information as is absolutely necessary is stored, properly protected from unnecessary distribution or exposure, and the information is securely deleted when it is no longer required. Controlled Unclassified Information (CUI) markings must be used on any non-digital formats that contain CUI.

12. The third party must ensure that all mobile computer devices used by them to connect to the FS Pinyon environment are used in such a way that information belonging to the FS is not displayed to unauthorized individuals or the general public.

13. When the third party is connected to the FS Pinyon environment, they should not leave their computer devices unattended.

14. Only information and documents applicable to the original purpose of the shared space will be stored on the FS Pinyon environment. No non-FS related information will be stored in the FS Pinyon environment.

15. All third-party computer devices used to connect to the FS Pinyon environment, upon request by FS, will be made available for inspection for any related security incidents. The third party must ensure all software is scanned and cleared of all viruses and other forms of malicious software before it is shared in the Pinyon environment. The third party will be held responsible for all disruptions and damage caused to the FS network, information systems, applications or equipment which is traced back to infected software shared by the third party.

16. The third party agrees that all information (digital or non-digital versions) shall not be copied, divulged, or distributed to any other party without the prior approval of the FS.

17. The third party must report all actual and suspected security incidents to the FS immediately.

18. The FS reserves the right to monitor all third-party activity while connected to the FS Pinyon environment and revoke the third parties access privileges at any time.

19. The third party agrees to participate in annual FS audits of the external folders and agreement, as requested.

20. Any violations of these Rules of Behavior by the third party, may lead to the withdrawal of FS Pinyon information, technology resources to that third party and/or the cancellation of any contract(s) between the FS and the third party Updated 6/8/2021 AED Page 1 of 7 image2.png image3.png image4.png image5.png image6.png image7.png image1.png image8.png