Attachment_J.5_-_CDCS ROB_v12.0.pdf

Consolidated Debt Collection System (CDCS) Rules of Behavior (ROB) for General Users

Version 12.0

I. Introduction

As a user of Department of Justice (DOJ) Information Technology (IT) data and systems, you are the first line of defense in support of Department and Component IT security. As a knowledgeable user, you are the foundation of a successful security program. The Rules of Behavior (ROB) for General Users concern use, security, and acceptable level of risk for Department systems. The rules also highlight that taking personal responsibility for the security of an information system and the data it contains is an essential part of your job.

The intent of the ROB is to summarize for you, a user of DOJ IT resources, the applicable laws and requirements from various Federal and DOJ documents. These include, but are not limited to, the Office of Management and Budget (OMB) Circular A-130, OMB M-16-24, the Privacy Act of 1974, DOJ Order 0904 Cybersecurity Program, DOJ Order 0601 Privacy and Civil Liberties, DOJ Order 2740.1 (series), and the DOJ Cybersecurity Standard.

To remain compliant with all applicable laws, Federal regulations, and DOJ Standards, the Consolidated Debt Collection System (CDCS) Program Management Office (PMO) reserves the right to update these ROB at any time. Please direct all questions relating to the ROB to your Help Desk, Security Manager, or Supervisor.

Who is covered by these rules?

The following rules of behavior apply to all users of the CDCS whether Department of Justice (DOJ) employees, private counsel users, or contractors who have logical access to DOJ systems or provide information services to the DOJ – hereafter referred to as users. All users are required to review and provide signature or electronic verification acknowledging compliance with these rules to their respective Component cybersecurity representative. In addition to this ROB, users with escalated privileges on an information system (e.g., administrator) must also agree to and provide signature or electronic verification acknowledging compliance for the Privileged User ROB.

CDCS is a financial System of Record and, as such, must comply with the requirements of OMB Circular A- 123, Management Accountability and Controls, as well as the Federal Financial Management Improvement Act of 1996 (FFMIA), and OMB Circular A-127, Financial Management System Requirements. All individuals given access to the DOJ CDCS Information Systems must understand that these principles are based on Federal laws, regulations and DOJ Orders. As such, as indicated above there are consequences for non-compliance with principles of behavior.

What are the penalties for noncompliance?

Users will be held responsible for compromising Government information through negligence or willful acts. Users must use caution and follow all statutory and regulatory access, use, maintenance, and disclosure restrictions, as well as adhere to the DOJ and CDCS policies regarding the exchange of access-restricted information such as Federal Tax Information (FTI), Personally Identifiable Information (PII), controlled unclassified. Compliance with applicable laws, policies and standards will be enforced through sanctions commensurate with the level of infraction. Failure to comply with the rules and responsibilities listed in this ROB may result in appropriate sanctions, including but not limited to: remedial training; loss of access to information; loss of a security clearance; verbal or written warning; termination of employment;

or civil or criminal prosecution. In addition, activities that lead to or cause the disclosure of classified information may result in criminal prosecution under the U.S. Code, Title 18, Section 798, and other applicable statutes.

Unauthorized browsing or inspection of Federal Taxpayer Information (Internal Revenue Code Sec. 7213A) is punishable with a fine of up to $1,000 and/or up to one year imprisonment. Unauthorized disclosure of Tax Return information (Internal Revenue Code Sec. 7213) is a felony punishable with a fine of up to $5,000 and/or up to five years in prison. In addition to these penalties, any Federal employee convicted under Sec.

7213 or Sec. 7213A will be dismissed from employment.

Accountability

All users must be accountable for their actions and responsibilities related to information resources entrusted to them.

Users of Personal Information

Users must acquire and use PII only in ways that respect an individual's privacy and are in compliance with the Privacy Impact Assessment (PIA) for CDCS. The CDCS collects PII to track and correspond with debtors, as well as to locate and collect debtor assets. The personal information is necessary to properly track and collect fines and other debts owed to the Department of Justice, other Government agencies, and 3rd parties. All users must protect sensitive information from disclosure to unauthorized individuals or groups.

Reporting

1. Report all security violations, incidents, and vulnerabilities immediately to your office’s DOSM

(District Office Security Managers) and the EOUSA Information Systems Security Officer (ISSO).

2. All security incidents regarding loss or theft must also be reported immediately to the Component

Security Programs Manager (SPM) and CDCS SPM.

II. User Responsibilities

A. General

1. Comply with all Federal laws and Department and component policies and requirements, including DOJ Orders, Policy Statements, and Standards. Use DOJ information and information systems for lawful, official use, and authorized purposes only.

2. Ensure individuals have proper clearance, authorization, and need-to-know before providing access to any DOJ information.

3. Read and accept the DOJ security warning banner that appears prior to logging onto the system or mobile device. The DOJ security warning banner must not be circumvented (i.e. bookmarking) in any way. Acknowledgment of this ROB also indicates consent to monitoring, recording, and collection of data on all DOJ devices for law enforcement purposes.

4. Consent to the monitoring and search of any IT equipment brought into, networked to, or removed from DOJ owned, controlled, or leased facilities consistent with employee and contractor consent obtained through logon banners and DOJ policies.

5. Screen-lock or log-off, and remove the personal identity verification (PIV) card from your computer when leaving the work area. Log-off when departing for the day.

6. Always keep your PIV card secure. When not in use for authentication and when away from the work area (i.e. especially when in public areas), keep your PIV card on your person and out of sight.

7. Do not generate, view, download, store, copy, or transmit offensive or inappropriate information in any DOJ medium, to include email messages, documents, images, videos, and sound files (e.g., graphic violence, pornography, hateful language, etc.), unless authorized for official purposes.

8. Do not access continuous data streams such as viewing streaming video or listening to streaming audio/radio on a website (e.g., YouTube, Netflix, Spotify) on Department computers and computer systems during working or nonworking hours, unless authorized for official purposes.

9. Adhere to Separation of Duties principles. Avoid conflict of interest in responsibilities, roles, and functions within CDCS application (e.g., duties of the System Administrator and Database Administrator should not be combined).

10. Do not use anonymizer sites on the Internet and bypass the Department security mechanisms designed to protect systems from malicious Internet sites unless authorized for official purposes.

11. Do not use Peer-to-Peer (P2P) technology (e.g., Bit Torrent) on the internet unless the Department’s Chief Information Officer (CIO) or designee approves a waiver from the Department policy.

12. Do not post Department or CDCS information on cloud-based services unless approved by the component CIO or designee.

13. Do not use cloud-based services that have not been approved for use by the Department (e.g., Drop Box, iCloud, Google Drive/Docs); use the Department’s approved file sharing solutions.

14. Do not post Department official business information on public websites or social media unless in accordance with applicable Departmental and Component level policies and explicitly authorized for your official duties (e.g., Public Affairs Office).

15. Do not post information on social media or public websites which allows unauthorized users to infer or obtain non-public information (e.g. system account information, sensitive personally identifiable information (PII), project status, etc.).

16. Upload only the user’s picture as a profile picture in Outlook. User’s picture must be in a professional pose from the shoulders up with the U.S. flag or a neutral background.

17. Protect and safeguard all DOJ information commensurate with the sensitivity and value of the data at risk, including encrypting all sensitive PII before sending to third parties outside of DOJ.

18. Protect and safeguard all DOJ information and information systems from unauthorized access:

unauthorized or inadvertent modification, disclosure, damage, destruction, loss, theft, denial of service; improper sanitization/or use.

19. Ensure that all DOJ data on authorized removable media (e.g., removable hard drives, thumb drives, CD/DVD) on mobile devices (e.g., smartphones and netbooks) laptops, and tablets is encrypted with a Department-approved solutions. Use only authorized removable media (e.g., Component approved thumb drives). For classified environments, follow the procedures required for those networks for data storage and transport.

20. Handle all Department data as Sensitive unless designated as Non-Sensitive by the Component Director.

21. Report any anomalous or unusual behavior, and discovered or suspected security incidents to an appropriate point of contact (POC) (e.g., CDCS SPM, Help Desk, Incident Response Representative, or Justice Security Operations Center (JSOC), jsoc@usdoj.gov).

22. Ensure that you complete any required training in accordance with current Department mailto:jsoc@usdoj.gov policies.

23. Follow all Department level and Component level policies related to user responsibilities for the recording of information into the Department’s recordkeeping systems, and comply with applicable records retention schedules.

B. Classified Systems/Information

1. Do not use portable electronic devices (e.g., smart watches, fitness trackers, laptops, mobile devices, and removable media except CD-R for music) in sensitive compartmented information facilities or areas where classified information processing is authorized.1

2. Properly mark and label classified and sensitive documents, electronic equipment, and media.

3. Do not process classified information on an unclassified system.

4. Send classified email only on systems or authorized devices with the appropriate level of security classification.

5. Operate information systems only in areas certified for the highest classification or sensitivity level of the information being processed. When not in use, classified items should be stored and contained in an approved security facility.3

6. Receive the proper security training before handling classified removable media. Transport classified removable media only when authorized.

7. Verify that each computer-readable data extract containing sensitive data has been erased within 90 days of origination unless its use is still required.

C. Hardware

8. Do not add, modify, or remove hardware, or connect unauthorized accessories or communications connections to DOJ resources unless specifically authorized.

9. Do not access the internal components of the computer or its hard drive from DOJ facilities, unless specifically authorized.

D. Software

10. Do not copy or distribute protected intellectual property without permission or license from the copyright owner (e.g., music, software, documentation, and other copyrighted materials). Only use DOJ- licensed and authorized software.

11. Do not install or update any software unless specifically authorized. Submit requests for system changes through the appropriate help desk or configuration management process.

12. Do not attempt to access any electronic audit trails that may exist on the computer unless specifically authorized.

1For additional information on authorized use of PEDs when working in spaces authorized to process classified information, please refer to DOJ Order 0904 (https://portal.doj.gov/sites/dm/dm/Directives/0904.pdf), DOJ Security Program Operating Manual (SPOM) Chapter 8 (http://dojnet.doj.gov/jmd/seps/spom/chapter8.pdf), and Intelligence Community Directive 503 (http://www.dni.gov/files/documents/ICD/ICD_503.pdf).

2For additional instruction on proper markings, please refer to the DOJ Security Program Operating Manual

(SPOM)

(https://dojnet.doj.gov/jmd/seps/spom.php).

3 For additional information on removable media, please refer to the DOJ Removable Media Requirements for Classified Systems (https://dojnet.doj.gov/jmd/seps/docs/removable_media_requirements.pdf).

13. Do not change any configurations or settings of the operating system and security-related software, or circumvent and test the security controls of the system unless authorized through the documented configuration management procedures.

E. Email Use

14. Limit distribution of e-mail to only those who are authorized and need to know the information to perform their job duties.

15. Do not open emails from suspicious sources (e.g., people you don’t recognize, know, or normally communicate with) and do not visit untrusted or inappropriate websites, unless authorized for official purposes. Download permissible files only from known and reliable sources and use virus-checking procedures prior to file use.

16. Do not auto-forward emails from your DOJ email account to or through a non-DOJ email system (e.g., Gmail, Yahoo, Outlook.com and Hotmail).

17. Comply with DOJ Policy Statement 0801.04, Electronic Mail and Electronic Messaging Policy Statement, on the appropriate capture of email.

18. Do not use personal email accounts for DOJ business except under exigent circumstances and in accordance with Policy Statement 0801.40, Electronic Mail and Electronic Messaging Policy Statement, and any Component-level policy related to the use of personal email accounts.

F. Mobile Computing & Remote Access Users4

19. Use mobile GFE (e.g., laptop, tablet, Smartphone) for official business and authorized use in accordance with the de minimis rule. Mobile GFE is for use by DOJ personnel only (no spouse or relative) and shall connect to DOJ networks through an approved DOJ remote access method.

20. Always keep GFE mobile devices, portable electronic devices and removable media secure. When not in use, keep GFE mobile devices, portable electronic devices and removable media in your physical presence and out of sight.

21. Do not bypass native mobile device operating system controls to gain increased privileges (i.e., jailbreaking or rooting the device).

22. Download and/or install only authorized applications and software on DOJ mobile devices, and only from DOJ-authorized sources.

23. Update all mobile devices, including applications and operating systems (e.g., iOS 12.1.3+) to the latest versions and in the timely manner.

24. Install DOJ-provided removable media, including memory (such as SD cards) and subscriber identity module cards, only on GFE mobile devices.

25. Immediately report lost or stolen devices (e.g., laptop, phone, tablet, thumb drive) to your appropriate POC (e.g., Help Desk, Incident Response Representative, Security Manager, Supervisor, or JSOC (jsoc@usdoj.gov)).

4 For additional information, please refer to the DOJ Mobile Device and Mobile Application Security Policy (https://dojnet.doj.gov/jmd/ocio/ocio-document_library/cs/2-DOJ_Policy_Instruction/Mobile-Device-Mobile- ApplSec-Supp-2017A.pdf).

26. Do not associate a personal gift or credit card with a government app store account (e.g. iTunes or Google Play). Authorized mobile application purchases should be made by the appropriate contracting officer or official designee (e.g., government purchase card holder).

27. Unless explicitly authorized by the CDCS SPM for mobile devices, follow these rules:

a. Do not connect non-DOJ mobile devices and/or accessories to DOJ networks, with the exception of Guest Networks.

b. Do not connect mobile GFE to non-DOJ information systems, to include personal computers.

28. Follow your organization’s telework guidelines when working remotely and/or remotely accessing DOJ information remotely.

29. Ensure the confidentiality of government information when using remote access from a non-GFE device (public or private). As per the DOJ Strong Authentication Plan5, this includes the following:

a. User must authenticate to a VDI solution with an approved LOA-4 credential.6 7

b. Unless explicitly authorized by the CDCS SPM for mobile devices: Non-GFE devices cannot be joined to the DOJ network domain via VPN.

30. Follow your organization’s telework guidelines when working remotely and/or remotely accessing DOJ information remotely.

31. Limit Short Message Service (SMS) messages to non-sensitive information if SMS is approved by the Authorizing Official.

32. Only connect to secure wireless networks where possible and take precautionary measures to prevent the compromise of DOJ data when insecure wireless networks must be used. (See the Secure Use of Wireless Networks FAQ at (http://dojnet.doj.gov/jmd/irm/itsecurity/ises_team.php)

G. Virtual Conferencing

33. Hosts and presenters must provide participants with advance notice if the virtual conference session is being recorded.

34. Do not access a virtual conference presentation using a privileged user account.

35. Limit presentation information to only that which is authorized for dissemination.

36. Delete all DOJ information on a provider’s web site immediately upon the end of a virtual conference.

37. Do not install any agents or other software designed to enhance or aid in virtual conferencing. Submit requests for system and software changes through the appropriate help desk or configuration management process.

38. Employ strong participant authentication mechanisms (e.g., multi-factor authentication, PIN creation, unique login credentials)

39. Users are provided with logging, auditing, and the appropriate/authorized meeting functions (e.g., upload, download, desktop sharing).

5 https://dojnet.doj.gov/jmd/ocio/ocio-document_library/cs/2-DOJ_Policy_Instruction/doj-strong-authentication-plan.pdf 6 PIV card readers must be tested and approved by GSA, and therefore listed on the Approved Products List on the Federal ICAM site -https://www.idmanagement.gov/IDM/IDMFicamProductSearchPage 7 Procurement of PIV card readers must comply with DOJ Procurement Guidance (PGD) 14-03 http://dojnet.doj.gov/jmd/irm/itsecurity/ises_team.php

H. Travel Users

40. Adhere to the Department requirements and recommendations regarding foreign travel and mobile devices in the DOJ Mobile Device and Mobile Application Security Policy.8

41. Your Component CIO/AO, or equivalent, shall notify the appropriate Component POC in advance of foreign travel with the dates and location(s) of travel when you intend to bring a mobile device to a general-risk country. Your Component POC will then notify JSOC (jsoc@usdoj.gov). The DOJ Chief Information Security Officer must approve the use of laptops for any foreign travel and mobile devices to countries designated as high-risk. 9The user’s Component CIO/AO, or equivalent, shall notify the appropriate Component POC (in advance) of foreign travel. Dates and location(s) of travel will be provided for when the user intends to bring a mobile device to a general-risk country. The user’s Component POC will then notify JSOC (jsoc@usdoj.gov). The DOJ Chief Information Security Officer (CISO) must approve the use of laptops and mobile devices in countries designated as high- risk.

42. Inspect computers, smartphones, and any other media that have been transported outside the United States for compromise prior to any physical or logical connection to any DOJ.

43. Minimize the information on your information system to what is required to perform a particular mission while traveling and destroy copies of sensitive data when no longer needed.

44. Shut down devices when not in use or no longer needed. If the device is needed but not the associated network capability, turn off/disable the network/wireless network functionality.

45. Assume all communications (including cellular services) are intercepted and read when on travel in a foreign country.

46. Keep your remote access token separate from the laptop/tablet (preferably on you) when possible.

47. Power down IT devices when possible and not needed. If the IT device is needed but not the associated network capability, turn off/ disable the network/wireless network functionality. (See the Secure Use of Wireless Networks FAQ at http://dojnet.doj.gov/jmd/irm/itsecurity/ises_team.php)

48. In a foreign country or airline, assume your transmissions (including cellular services) and conversations are being intercepted, read, and/or heard.

49. When possible, keep your remote access token separate from the laptop/tablet (preferably on your person).

I. Personally Identifiable Information (PII)

50. TRAINING:

a. Complete mandatory privacy training as part of the on-boarding process and annually thereafter, as

8 For additional information on traveling with a mobile device, please refer to the DOJ Mobile Device and Mobile Application Security Policy (https://dojnet.doj.gov/jmd/ocio/ocio-document_library/cs/2- DOJ_Policy_Instruction/Mobile-Device-MobileAppl-Sec-Supp-2017A.pdf).

9For additional information on foreign travel requirements, please refer to the DOJ IT Resources Outside U.S.

Territory Waiver Request form (https://dojnet.doj.gov/jmd/ocio/ocio-document_library/cs/2- DOJ_Policy_Instruction/foreign_travel_it_resources_1_2.pdf).

http://dojnet.doj.gov/jmd/irm/itsecurity/ises_team.php required by and within the timeframe set by applicable component policy.

b. Complete role-based privacy training as required by applicable policy, including when the staff member performs specialized privacy roles and responsibilities.

c. Complete Cybersecurity Awareness Training or similar security training at least annually.

d. Adhere to all PII training and procedures that are specific to your position.

51. NO EXPECTATION OF PRIVACY:

a. Know that DOJ information systems include computers, computer networks, and all devices and storage media attached to a (n) DOJ network or to a computer on such network.

b. Understand and consent to having no expectation of privacy regarding any communications transiting, stored on, or traveling to or from DOJ information systems.

c. Understand and consent that the Government routinely monitors communications occurring on DOJ information systems for any lawful government purpose including, but not limited to, monitoring network operations, quality control, employee misconduct investigations, law enforcement investigations, and counterintelligence investigations.

d. Understand and consent that, at any time, the Government may for any lawful government purpose monitor, intercept, search, and seize communications or information transiting, stored on, or traveling to or from DOJ information systems.

e. Understand and consent that any communications or information transiting, stored on, or traveling to or from DOJ information systems may be disclosed or used for any lawful government purpose.

52. COLLECTION OF PII:

a. Know that “PII” means information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other information that is linked or linkable to a specific individual.

PII can be in any medium or form, including paper, oral, and electronic.

b. Limit the collection of PII to that which is legally authorized, relevant, and reasonably deemed necessary for the proper performance of your responsibilities.

c. Know that Social Security numbers (SSNs) are singular personal identifiers, and their use poses unique privacy risks, including the risk of identity theft. Special procedures apply to the collection, use, and disclosure of SSNs in some instances; for example, you need to coordinate any disclosure of SSNs outside DOJ with your Senior Component Official for Privacy (SCOP)10 to ensure that such disclosure is authorized by law. See DOJ Memo on Minimizing the Use and Disclosure of Social Security Numbers and Protecting Personally Identifiable Information in Motion (2012).

d. Collect no information describing how any individual exercises rights guaranteed by the First Amendment unless expressly authorized by statute or by the individual about whom the information is maintained or unless pertinent to and within the scope of an authorized law enforcement activity.

e. Follow applicable Department and Component-level policies related to responsibilities for the recording or inputting of information into the Department’s official recordkeeping systems.

10 List of all the DOJ SCOPs: https://dojnet.doj.gov/privacy/scop.php

76. ACCESS AND USE OF PII: Limit the access and use of PII to that which is legally authorized, relevant, and reasonably deemed necessary for the proper performance of your responsibilities.

77. MAINTENANCE OF PII:

a. Protect and safeguard PII from loss, compromise, or unauthorized access commensurate with the sensitivity and value of the information and applicable policy. For example, encrypt Social Security numbers when sending via email to any email address outside of the Department.11

b. Comply with applicable records retention schedules including requirements to destroy, delete, or purge information, and requirements to preserve or produce it.12

c. Use only authorized and appropriate techniques to erase, delete, or purge PII, or dispose of media containing PII.

d. Do not use personally owned information technology such as computers or removable media to store government related work or Department PII.

78. DISCLOSURE OF PII:13

a. When considering whether to disclose PII (including PII within emails) to a DOJ recipient, ensure the recipient has a need-to-know that information to perform his or her job duties, and that such sharing complies with DOJ policy and the law.

b. When considering whether to disclose PII (including PII within emails) to a non-DOJ recipient, follow applicable DOJ and/or component policy and the law, which may also involve keeping an accounting of the date, nature, and purpose of the disclosures, and the name and address of the person or agency to whom the PII is disclosed. Need-to-know may not be sufficient justification, by itself, for PII disclosure to a non-DOJ recipient.

c. Disclose PII to members of the public including individuals or the media only as allowed by the scope of duties, applicable DOJ and/or component policy, and the law.

d. Do not post information, including PII, on any social media or public website that allows unauthorized user(s) to infer or obtain non-public information.

79. BREACH:

a. Know a “breach” is the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where: (1) a person other than an authorized user accesses or

11 See Department policy memoranda from DOJ CIO and CPCLO regarding protecting PII and sensitive PII at https://dojnet.doj.gov/jmd/ocio/ocio-document_library/cs/4 DOJ_%20IT_Memoranda/Data_Loss/Safeguarding%20PII%20Memo.pdf, and https://dojnet.doj.gov/privacy/docs/safeguarding sens-pii.pdf.

12 For disposal guidance, please refer to Record Management, DOJ Order 0801 (https://portal.doj.gov/sites/dm/dm/Directives/0801.pdf).

13 For additional guidance on PII, please refer to Cybersecurity Program, DOJ Order 0904 (https://portal.doj.gov/sites/dm/dm/Directives/0904.pdf) and Privacy and Civil Liberties, DOJ Order 0601 (https://portal.doj.gov/sites/dm/dm/Directives/0601.pdf).

potentially accesses PII or (2) an authorized user accesses or potentially accesses PII for an other than authorized purpose.

b. Report all suspected or confirmed breaches of PII to your supervisor, CDCS SPM, and component-level Security Operations Center or DOJ Justice Security Operations Center (jsoc@usdoj.gov) as applicable, as soon as possible without unreasonable delay, but no later than 1 hour after discovery, and consistent with DOJ Instruction 0900.00.01, Reporting and Response Procedures for a Breach of Personally Identifiable Information.

J. CDCS Security Rules

80. INTEGRITY:

a. Do not introduce unauthorized, inaccurate, or false information into CDCS.

b. Do not use system privileges to misuse or exploit information in CDCS.

c. Do not alter files or data improperly. If files or data appear to be altered improperly or are missing, notify your System Manager and the CDCS SPM.

81. AVAILABILITY:

a. Plan for contingencies such as disaster, loss of information, and disclosure of information by preparing alternate work strategies and recovery mechanisms.

b. Make backups of hard drive files on a regular basis.

c. Complete transactions and save records before stepping away from your workstation. Log out of the application if you will be away for a period of time.

82. MANAGERS:

a. Notify your staff’s security personnel and the CDCS Help Desk within 24 hours whenever an employee or contractor is no longer supporting the CDCS program.

b. Assist departing employees in completing the CDCS Exit Checklist for the complete return of all issued government property and the removal of information system access held in the name of the departed.

c. Counsel terminating employees on non-disclosure of confidentially-sensitive information.

d. Terminate access within 24 hours of notification to information and computer systems immediately in the event of employee separation.

e. Escort employee off the premises when there is likelihood of sabotage, as with an unfriendly termination or separation.

f. Keep an inventory of all computer equipment and software you have in your office.

g. Track all security incidents occurring within your area of responsibility.

83. PRIVATE COUNSEL:

a. Personally Identifiable Information (PII) must be safeguarded at all times and stored on the provided encrypted storage device.

b. Safeguarding the removable media (e.g., hard drives) is extremely important because of the sensitivity of the data stored within.

c. Files stored on the flash drives (i.e., encrypted storage device) must never be transmitted over standard e-mail or electronically transmitted over any non-secured transmission facilities.

d. Lost or stolen devices must be reported to DOJ immediately.

e. JSRA Tokens and thumb drives must be returned to DOJ immediately upon termination of an employee or private counsel contract.

f. Private Counsel are required to abide by all regulations provided in this document and specified contractual obligations.

84. WORK AT HOME AND PRIVATE COUNSEL USERS:

a. Work at home users may not use personally-owned hardware, software, or network connectivity for any work purposes without prior Department of Justice approval.

b. All on-site safeguards for handling PII apply to off-site work.

c. Do not disclose or distribute JSRA Token IDs or PIN.

III. Statement of Acknowledgement

I understand that the CDCS PMO and central System Administrators will regularly review system logs and conduct spot-checks to determine if I am complying with policies and controls placed on the use of CDCS resources.

I acknowledge that I have read the CDCS Rules of Behavior, understand my responsibilities and agree to comply with the Rules delineated herein. I acknowledge that any violation of these Rules may be cause for disciplinary action.

I acknowledge receipt and understand my responsibilities as identified above. Additionally, I acknowledge my responsibility to access, collect, and use, maintain, and protect PII in accordance with these rules of behavior and applicable laws, regulations, and policies. I will comply with the DOJ Cybersecurity, Component and Privacy ROB for General Users, Version 12. I acknowledge that failure to comply with the ROB may result in appropriate sanctions, including but not limited to: remedial training; verbal or written warning; loss of access to information systems; loss of a security clearance; termination of employment;

or civil or criminal prosecution.

Signature Date

11.0.0.20130303.1.892433 SignatureField1: