D.10- RULES OF BEHAVIOR.pdf

Attachment D.10- Rules of Behavior RFP 36C24225R0047

FY23 Text-Only Course Transcript Page 1

Contents Purpose of This Document Using Hyperlinks Within This Document Topic 1: Introduction

1.1 Welcome

1.2 Purpose of Taking This Course

1.3 Requirement for Health Professions Trainees

1.4 Types of VA Sensitive Information

1.5 Organizational and Non-Organizational Users

1.6 General Rules of Behavior

1.7 What to Expect and Course Completion

Topic 2: Handling VA Information

2.1 Introduction and Objectives

2.2 Protecting VA Sensitive Information

2.3 Scenario: Reducing the Use of Social Security Numbers

2.4 Proper Handling of Information

2.5 Scenario: Preventing Mismailing

2.6 Records Management Awareness

2.7 Summary

Topic 3: Protecting VA Electronic Resources

3.1 Introduction and Objectives

3.2 VA-Issued Electronic Resources

3.3 Scenario: Loss or Misuse of VA Equipment

3.4 Software Downloads

3.5 VA-Issued Mobile Device Safety

3.6 Handling VA-Issued Mobile Devices

3.7 Scenario: GFE, Personal Devices, and Personal Use

3.8 Summary

Topic 4: Accessing VA Information

4.1 Introduction and Objectives

4.2 Need-to-Know and Minimum Access

4.3 Scenario: Need-to-Know

4.4 Identification and Authentication

4.5 Scenario: Lost PIV Card

4.6 Scenario: Securing Workstations

4.7 Unsecured Wireless Connections

4.8 Scenario: Unsecured Wireless Connections

4.9 Summary

Topic 5: Safeguarding VA Electronic Information

5.1 Introduction and Objectives

5.2 Transmitting Data Securely

5.3 Guidelines for Emailing VA Sensitive Information

5.4 Use VA Email for VA Business

5.5 Scenario: Emailing VA Sensitive Information

5.6 Storing and Sharing VA Sensitive Information

5.7 Scenario: Storing and Sharing VA Sensitive Information

5.8 Identity Theft

5.9 Scenario: Mishandling VA Sensitive Information on Network Drives and SharePoint

5.10 Safeguarding External and Removable Media

5.11 Internet and Social Media Awareness and Safety

5.12 Limited Personal Use (VA Directive 6001)

5.13 Summary

Topic 6: Working Remotely

6.1 Introduction and Objectives

6.2 Connecting Remotely to the VA Network With GFE and Non-GFE

6.3 Protecting VA Sensitive Information When Working Remotely

6.4 Scenario: Disposing of VA Sensitive Information When Working Remotely

6.5 Scenario: Emailing VA Sensitive Information for Remote Use

6.6 Collaborating in a Virtual Environment

6.7 Summary

Topic 7: Reporting Incidents

7.1 Introduction and Objectives

7.2 Recognizing a Potential Incident

7.3 Reporting Incidents

7.4 Consequences for Causing an Incident

7.5 Insider Threat Awareness

7.6 Scenario: Recognizing Insider Threats and Social Engineering

7.7 Scenario: Recognizing Phishing Attempts

7.8 Summary

Topic 8: Course Summary and Rules of Behavior

8.1 Course Summary

8.2 Acknowledge and Accept ROBs

8.3 Completion

Appendix A: Organizational Rules of Behavior

1. COVERAGE

2. COMPLIANCE

3. ACKNOWLEDGEMENT

4. INFORMATION SECURITY ROB

5. ACKNOWLEDGEMENT AND ACCEPTANCE

Appendix B: Non-Organizational Rules of Behavior

1. COVERAGE

2. COMPLIANCE

3. ACKNOWLEDGEMENT

4. INFORMATION SECURITY RULES of BEHAVIOR

5. ACKNOWLEDGEMENT AND ACCEPTANCE

Appendix C: Glossary Appendix D: Privacy and Information Security Resources

Purpose of This Document This text-only course transcript is designed to accommodate users in any of the following circumstances:

• You are using a screen reader, such as JAWS, to complete course material and have difficulty with the interactions in the online version.

• You are experiencing difficulties accessing the online version due to computer network or bandwidth issues.

• You have completed the online version and want to print a copy of the course material for reference.

This version of the VA Privacy and Information Security Awareness and Rules of Behavior Text-Only Course Transcript is valid for fiscal year (FY) 2023 (October 2022 through September 2023).

You should take the online version of this course if possible; however, if you complete the course using this text-only transcript, you must complete the following steps:

Print, initial each page of, and sign the Information Security Rules of Behavior (ROB) for your particular user type.

1. There are two versions of the ROB, one for Organizational Users and one for Non-Organizational Users. You must select the user group that applies to you, initial each page, and then sign the Acknowledgement and Acceptance section. Review the definitions of Organizational and Non-Organizational Users on the next page to determine your user group.

2. Contact your supervisor or Contracting Officer Representative (COR) to submit the signed ROB and to coordinate with your local Talent Management System (TMS) Administrator to ensure you receive credit for completion.

Using Hyperlinks Within This Document Throughout this document, you can access glossary terms, located in Appendix C, by selecting the available hyperlinks. To return to your place in the main document after selecting a hyperlink to an item in the appendix, select Alt +<left arrow> on your keyboard. Some browsers will not permit the Alt+<left arrow> navigation feature; therefore, it is recommended that you download the PDF to your desktop and then open the PDF in Adobe Acrobat.

Topic 1: Introduction

1.1 Welcome

Welcome to the VA Privacy and Information Security Awareness and Rules of Behavior training course.

1.2 Purpose of Taking This Course

The purpose of this course is to provide information security and privacy training to everyone at the Department of Veterans Affairs (VA).

Regardless of your role, you may encounter VA sensitive information and information systems, which everyone is obligated to protect. As an Organizational User or Non-Organizational User, you need to stay up to date on how to protect VA sensitive information. This course will help you learn the right way to access, use, and store VA information and protect VA systems, while thinking critically about your role in helping to protect Veteran data.

To do your part in helping VA uphold federal laws and keep the organization in good standing, you must take this course prior to gaining access to VA information or information systems. You must then take the course annually to maintain that access. Depending on your role and the information systems you have access to, you may be required to complete additional role-based information security and privacy training.

VA employees and contractors who have access to Protected Health Information (PHI) are also required to complete Privacy and HIPAA Training (VA TMS ID: 10203).

1.3 Requirement for Health Professions Trainees

As with any rule, there can be exceptions. If you are a Veterans Health Administration (VHA) Health Professions Trainee (e.g., student, intern, resident, or fellow), you are not required to complete this course. Instead, you are required to complete the following:

• First-time trainees must complete VHA Mandatory Training for Trainees (VA TMS ID: 3185966).

• Each subsequent year, trainees must complete VHA Mandatory Training for Trainees-Refresher

(VA TMS ID: 3192008).

1.4 Types of VA Sensitive Information

Federal agencies have over 100 different ways of describing sensitive unclassified information. This information is now referred to across the federal government as Controlled Unclassified Information (CUI). Sensitive information can be defined as information that is protected against unauthorized disclosure. VA handles this information frequently. Examples include medical records of Veterans, personal and financial records of employees, credit card information, and information related to VA’s security.

CUI includes Sensitive Personal Information (SPI), Federal Tax Information (FTI), Personally Identifiable Information (PII), and PHI. You are responsible for keeping all sensitive information safe.

• Controlled Unclassified Information (CUI) – VA is in the process of implementing the CUI Program to fulfill the requirements in Title 32 Code of Federal Regulations Part 2002 (32 CFR 2002). The CUI Program will change marking practices and clarify safeguarding and dissemination controls to help you better understand your role in the protection of CUI.

For more information regarding the CUI Program, refer to the VA CUI Intranet site. You can also email the CUI team. A link to this site and the email address can be found in the Resources section.

When it’s time for you to transition to CUI practices, you will be formally notified and trained.

Source: 32 C.F.R Part 2002 and Executive Order 13556

• Sensitive Personal Information (SPI) – SPI, with respect to an individual, means any information about the individual maintained by an agency, including the following:

‒ education, financial transactions, medical history, and criminal or employment history ‒ information that can be used to distinguish or trace the individual's identity, including name, Social Security number, date and place of birth, mother's maiden name, or biometric records. Used to reference Federal Tax Information, Personally Identifiable Information, and Protected Health Information.

FTI, PII, PHI, and Credit Cardholder Data (CHD) all fall into this category.

Source: 38 U.S.C. § 5727, VA Handbook 6500.2, OMB Circular A-130, VA ESO - Payment Card Industry SharePoint

‒ Federal Tax Information (FTI) – FTI includes tax returns or data about those returns that can come directly from the Internal Revenue Service (IRS) or other secondary sources like other federal agencies.

Source: VA Handbook 6500.2

‒ Personally Identifiable Information (PII) –PII is information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual.

Source: OMB Circular A-130

‒ Protected Health Information (PHI) – The Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule defines PHI as individually identifiable health information transmitted or maintained in any form or medium by a covered entity, such as VHA. This is another subcategory of SPI.

Note: VHA uses the term PHI to define information that is covered by HIPAA but, unlike individually identifiable health information, may or may not be covered by the Privacy Act of 1974 or Title 38 VA Confidentiality Statutes as updated. In addition, PHI excludes employment records held by VHA in its role as an employer. Please see the Resources section for more on the updates to Title 38 section 7332.

Source: 45 CFR § 160.103; VA Directive 6066

‒ Credit Cardholder Data (CHD) – SPI includes financial data involved in processing, storing, and transmitting the payment card transactions of Veterans, their families, and VA employees. This data must be safeguarded to comply with the PCI Data Security Standard (DSS). Please visit the VA Enterprise Security Operations (ESO) Payment Card Industry SharePoint for additional Personal Identity Verification (PIV) Card Issuing (PCI) DSS guidance. The link to this SharePoint site can be found in the Resources section.

Source: 38 U.S.C. § 5727; VA Handbook 6500.2; OMB Circular A-130; VA ESO - Payment Card Industry SharePoint

1.5 Organizational and Non-Organizational Users

There are two types of authorized users at VA: Organizational Users and Non-Organizational Users.

Organizational Users are VA employees, contractors, researchers, students, volunteers, and representatives of federal, state, local, or tribal agencies not representing a Veteran or claimant.

Non-Organizational Users are any information system users not clearly identified as an Organizational User. This includes people with a Veteran or claimant power of attorney.

You need to be aware of the impacts of data breaches, which are the result of severe privacy incidents.

These impacts can include loss of trust in VA and exposure of Veterans’, colleagues’, and employees’ data. Stay diligent in following VA’s ROBs, which are the minimum compliance standard for all VA staff.

The ROBs provide guidance for Organizational and Non-Organizational Users on how to protect VA sensitive information and safeguard VA systems. This guidance will help you accomplish your day-to-day duties securely.

You reduce the risk of compromising privacy and information security when you follow the ROBs, keeping privacy and security awareness at the forefront of your mind.

1.6 General Rules of Behavior

The VA ROBs are sets of rules that outline the responsibilities and expected behaviors of people who use VA information systems. Most ROBs apply to specific situations like accessing VA computer resources or working remotely. Other ROBs are more general.

Be sure to read and follow the rules that apply to your user type. Many of these rules are presented during the course. They will help you determine the right course of action when you have challenges.

The ROBs will be presented at the end of the course for you to acknowledge and accept.

Organizational Users ROBs

• I WILL comply with all Federal statutes, regulations and policies applicable to VA information security, information privacy/disclosure and records management.

• I WILL NOT have any expectation of privacy in any information I access, create, receive or maintain, or in my activities while accessing or using VA information systems as I understand that all activity is logged for security purposes.

• I WILL complete mandatory security and privacy awareness training within designated time frames and complete any additional role-based security training required for my role and responsibilities.

• I WILL understand that authorized VA personnel may review my conduct or actions concerning VA information and information systems and take appropriate action.

• I WILL sign VA Information Security ROBs required for access or use of specific VA systems.

• I WILL comply with any requirement to sign a non-VA entity’s ROB to conduct VA business.

• I WILL obtain approval from the Office of Public and Intergovernmental Affairs before establishing a VA social media account.

Non-Organizational Users ROBs

• I WILL comply with all Federal statutes, regulations and policies applicable to VA information security, information privacy/disclosure and records management policies.

• I WILL NOT have any expectation of privacy in my activities while accessing or using VA information systems, as I understand that all activity is logged for security purposes.

• I WILL complete mandatory security and privacy awareness training within designated time frames.

• I WILL understand that authorized VA personnel may review my conduct or actions concerning VA information and information systems and take appropriate action.

• I WILL sign specific VA Information Security ROBs required for access or use of specific VA or non-VA systems.

• I WILL obtain approval from the Office of Public and Intergovernmental Affairs (OPIA) before establishing a VA social media account.

1.7 What to Expect and Course Completion

During this course, you can expect to gain a better understanding of your roles and responsibilities for protecting VA information and information systems. You will also learn how you can help with records management. In addition, this course may satisfy the annual mobile device training requirement, if you have completed this course at the time the mobile device is requested. Most importantly, you will explore how the ROBs apply in your day-to-day work as you use your problem-solving skills to promote VA’s mission of service to the Veteran.

Practical, realistic scenarios that put privacy and security at risk are presented during this course. For each scenario, you will have the chance to identify the best action to take. Then you’ll get feedback to help you understand the best action to take as well as the related ROBs that apply to the situation.

After reviewing all the topics in the course, you will select your user type and then print, initial each page of, and sign the Information Security Rules of Behavior (ROB). This is required to achieve completion credit for this course. After completing these requirements, contact your supervisor or Contracting Officer Representative (COR) to submit the signed ROB and to coordinate with your local Talent Management System (TMS) Administrator to ensure you receive credit for completion.

Topic 2: Handling VA Information

2.1 Introduction and Objectives

Veterans, their families, and your colleagues depend on you to show good judgment when you access or handle VA sensitive personal information. Treat the information of others and VA with the same care that you would your own, adopting a mindset of ongoing learning and smart decision-making.

When you have completed this topic, you will be able to do the following:

• Recognize your role in protecting VA information that you handle

• Identify common problems when handling VA information.

This topic will provide you with situations and information on properly handling VA sensitive information as we get the gears turning to raise privacy and security awareness across the organization.

2.2 Protecting VA Sensitive

Information It is your duty to protect VA sensitive information, such as SPI, which includes personal information and health information. This information can be as simple as names and addresses or as significant as a medical diagnosis or Social Security numbers.

The requirements and safeguards in place do not apply just to Veterans, but also to your fellow VA colleagues, contractors, and anyone else who uses VA systems and services.

Disclose VA sensitive information only at the right times to the right people. This includes sending information to other federal agencies and partners, whether by email or regular mail. Before disclosing or releasing information to a second or third party, you must be authorized to do so for official business purposes. The intentional theft of VA sensitive information is a constant threat that employees must be aware of, especially when working remotely and using web-based collaboration tools like Microsoft Teams. When using these tools, take care that you don’t share SPI with people who aren’t authorized to receive it. If you are unsure, check with your supervisor, Information System Security Officer (ISSO), or Privacy Officer (PO) before sending the information.

To help reduce the use of Social Security numbers, they should not be collected or used as the primary identifier for Veterans except where law permits. Before collecting Social Security numbers or any other form of SPI, you should talk to your PO and supervisor. They will help decide whether there is a business need that meets the policy for acceptable use, in accordance with VA Handbook 6507.1, Acceptable Uses of the Social Security Number (SSN) and the VA SSN Review Board. Then consult with your local ISSO to ensure that all proper security controls are in place.

2.3 Scenario: Reducing the Use of Social Security

Numbers Scenario

A provider is asking you to mail them a Return to Work Letter for a Veteran patient. When you print the letter from the Electronic Health Record (EHR) system, you notice that it contains the patient's full Social Security number. What should you do?

Determine the best answer from the options provided.

A. Send the letter as-is. The Social Security number is an important identifier.

B. Remove the Social Security number or shorten to last four digits before mailing. Provide only necessary identifiers.

Feedback

The correct answer is B.

Social Security numbers should not be sent by mail or used as the primary identifier for Veterans and employees or VA staff except where law permits.

If the use of Social Security numbers is not required to fulfill an official function or mission, it should be eliminated as part of the ongoing reduction and removal effort.

Wherever possible, try to use alternative identifiers, such as date of birth, address, phone number, and others. Talk to your PO and supervisor for further guidance.

Per the Social Security Number Fraud Prevention Act of 2017, don’t include SSNs on any document sent by mail unless authorized by the head of the agency in accordance with the regulations.

Additional guidance is outlined in the Paperwork Reduction Act (PRA) and Consolidated Appropriations Act.

For information on the privacy requirements of these acts, reach out to the VA Privacy Service. For information on data requests and survey requirements, reach out to the Office of Research & Development and the Enterprise Records Service. These offices can help you decide whether there is a business need grounded in law that meets the guidelines for acceptable use, as defined in Directive 6309, Collections of Information and Directive 6507, Reducing the Use of Social Security Numbers.

Rules of Behavior

Organizational Users

I WILL comply with all Federal statutes, regulations and policies applicable to VA information security, information privacy/disclosure and records management.

I WILL protect VA sensitive information from unauthorized disclosure, use, modification, or destruction and use encryption products approved and provided by VA to protect sensitive data.

I WILL protect VA sensitive information aggregated in lists, databases or logbooks and include only the minimum necessary VA sensitive information to perform a legitimate business function.

2.4 Proper Handling of Information

There are three formats of VA information: physical (e.g., paper), electronic, and verbal. Here are some best practices for keeping VA sensitive information secure:

• Always store paper documents containing VA sensitive information securely when not in use.

• When mailing sensitive documents, make sure that the envelopes are addressed correctly and contain only contents intended for that recipient to avoid mismailing incidents.

• Store electronic files and documents containing VA sensitive information on properly secured shared drives.

• Be careful where and when you talk about VA sensitive information. For example, discussing VA sensitive information in the elevator or at lunch in a cafeteria is a privacy and security risk.

You never know who might be listening. To avoid these situations, make sure you are in an area where you can’t be overheard (e.g., a meeting room) when discussing sensitive information.

• Be careful when you are speaking with Veterans in person or on the phone. If you are speaking in person, take precautions so that your conversation can’t be overheard by others. If you are speaking with a Veteran over the phone, verify they are in a location where they can give you sensitive information without being overheard.

• When working remotely, make sure to clear your work area and secure any documents containing VA sensitive information before screensharing, turning on video, or leaving the room.

2.5 Scenario: Preventing Mismailing

Scenario

You're preparing to mail out sensitive documentation to Veterans. As you finish stuffing the envelopes, you realize there's an empty one left over. What should you do?

Determine the best answer from the options provided.

A. It's probably just a duplicate. Go ahead and mail everything out as-is.

B. You may have accidentally double-stuffed one of the envelopes. Go back and check each one to avoid a privacy incident.

Feedback

The correct answer is B.

When manually preparing documents for mailing, you should always be cautious. Take the time to make sure the name on each envelope matches the name on the documentation inside the envelope.

Also, make sure that only necessary information appears on the envelope for mailing purposes.

Mismailing is one of the top ten reported privacy incidents that continue to affect VA. It carries the potential for identity theft, invasion of privacy, and loss of trust in VA's ability to protect the sensitive information entrusted to us. Use only officially authorized methods and approved systems for transferring and mailing sensitive documents on behalf of VA, as outlined in VA Directive 6609, Mailing of Sensitive Personal Information. If there is an incident or a suspected incident, report it to your supervisor, your local ISSO, and the PO.

Rules of Behavior

Organizational Users

I WILL NOT make unauthorized disclosure of VA sensitive information through any means of communication including but not limited to verbal communications, email, text messaging, instant messaging, online chat, social media, websites, and collaboration tools/platforms.

Non-Organizational Users

I WILL NOT disclose information protected by VA’s privacy statutes or regulations without appropriate legal authority. Unauthorized disclosure of this information may have an adverse effect on agency operations, agency assets and individuals including myself.

2.6 Records Management Awareness

VA business records are managed according to federal standards. As a VA employee, it is your responsibility to know proper records management to comply with the Federal Records Act of 1950.

Federal records come in many formats. You should become familiar with what could be a record.

Determining whether a particular document is a record or nonrecord does not depend on whether it is an original or a copy. For example, several copies of a single form may each have record status if each serves a separate administrative purpose and each is maintained in a different filing system. A single set of publications should be designated as a record copy, as distinguished from copies found elsewhere or stocks of the same publication. Documentary materials are records when they meet both of the following criteria:

• They were made or received by a federal government agency while transacting agency business, and

• They are appropriate for preservation either as evidence of the agency's organization, functions, and activities or because of the value of the information they contain. (Source: Records Management for Everyone [VA TMS ID: 4192704])

Consult with your supervisor or Designated Records Management Official if you are creating, transporting, storing, or disposing of materials that might be records. A Records Control Schedule (RCS) describes the requirements needed to maintain and dispose of federal records.

VA records may also include emails and text messages, so be careful about deleting them. Refer to Memorandum VAIQ 7581492, Proper Use of Email and Other Messaging Services, for more guidance.

There are specific ROBs that apply to records management. They are as follows:

• I WILL comply with all Federal statutes, regulations and policies applicable to VA information security, information privacy/disclosure and records management.

• I WILL NOT have any expectation of privacy in any information I access, create, receive or maintain, or in my activities while accessing or using VA information systems as I understand that all activity is logged for security purposes.

Note that VA is transitioning to a new Electronic Health Record (EHR) system—the software that stores health information and tracks all aspects of patient care—over a 10-year period scheduled to end in 2028. The new system connects VA medical facilities with the Department of Defense, the U.S. Coast Guard, and participating community care providers, allowing clinicians to easily access a Veteran’s full medical history in one location. The VA EHR Modernization (EHRM) Integration Office manages deployment of the new system. (Source: VA EHRM Intranet site)

This ongoing transition will affect the way that sensitive health records are handled and accessed, so it’s important to stay aware of the latest policies and guidance. Visit the VA EHRM Intranet site for more information. The Intranet site address can be found in the Resources section. To learn more about records management, you’re encouraged to take Records Management for Everyone (VA TMS ID:

4192704). You can also search for other related courses on VA’s TMS.

2.7 Summary

VA sensitive information comes in many formats, and you must be careful when handling it. Otherwise, you may face consequences, including fines or suspension. It is not always easy, but it is necessary to take such precautions to protect Veterans, their families, and other VA system users, including employees and contractors.

As you turn your mind to the ongoing privacy and security efforts, you should follow these best practices when handling VA sensitive information:

• Protect all VA sensitive information, in any format (i.e., physical, verbal, electronic), as if it were your own.

• Securely safeguard and handle paper and electronic documents to avoid unauthorized disclosure of sensitive information.

• Verify that names and addresses match and that only the content for the intended recipient is included when mailing sensitive information.

• Know what a record is and understand your responsibilities for records management.

Topic 3: Protecting VA Electronic Resources

3.1 Introduction and Objectives

It is your responsibility to track, protect, and care for all VA electronic devices and resources that you access or that are issued to you. This includes protecting the information on those devices, which is covered in Topic 5: Safeguarding VA Electronic Information. Consider all factors that could affect the safety of VA electronic resources in your care.

When you have completed this topic, you will be able to do the following:

• Recall steps to protect VA electronic resources

• Recognize procedures for reporting theft or misuse of VA devices

• Identify best practices and recertification for users of VA-provided mobile devices.

In this topic, you will find situations that deal with proper use and maintenance of VA devices and equipment, information about best practices, and annual training for users of VA-provided mobile devices.

3.2 VA-Issued Electronic Resources

Like many workplaces, VA issues equipment so employees can perform their daily duties based on their job requirements. Equipment includes laptop or desktop computers, mobile phones, and tablets.

Protect these resources as you would your own phone, laptop, or tablet. Only VA-approved devices are allowed on the VA network.

Keep in mind that the Office of Information and Technology (OIT) has implemented the VA IT One + One Initiative, which limits employees to no more than one IT computing device. Your supervisor will determine which device is more appropriate: a desktop for office use or a laptop for home or travel use if business needs dictate a more portable solution. If you have mobility needs, you can be provided with a VA-issued mobile device as well as one computing device, with supervisor permission.

The following are some basic guidelines for VA-issued devices:

• If you need repair or maintenance for your VA-issued equipment, use only those authorized by OIT to repair your equipment.

• If you experience theft or loss of VA-issued devices, report it as soon as it is discovered to your supervisor, local ISSO, and PO.

‒ If you don’t know the name of your local ISSO or PO, you can check the PO/ISSO locator website. A link to this site can be found in the Resources section.

‒ You should also contact the VA Police in the case of suspected theft or other physical security threats.

• If you find VA equipment unattended, take it to your local ISSO or the VA Police.

‒ You should also report any Veteran-owned personal devices that are left on VA property and turn them in to the VA Police upon discovery. These devices may be configured to access, or could contain, sensitive information.

If you are relocating or changing job roles, you should coordinate the details of the move with the proper authorities to ensure that your equipment is accounted for.

If you are leaving your current duty station within VA, remember to return your equipment or devices to your local OIT office. Contractors must also turn in VA-issued electronic resources at the end of the contract. If you leave VA, you must work with your supervisor to return and out-process all VA devices, equipment, and records.

There are criminal penalties for the unlawful removal of Federal records. Before separating from VA, you must transfer custody of all Federal records to your supervisor. You must also remove any encryption or security measures from the files and documents so your supervisor can access them.

Remember that you are not allowed to divulge any information you had access to during your time with VA (Sources: 18 U.S.C. 2071, VA Form 10-0708).

3.3 Scenario: Loss or Misuse of VA Equipment

Scenario

You are on travel for an important business trip. Coming back to your hotel room after dinner, you realize your VA-issued mobile device is gone. What should you do first?

Determine the best answer from the options provided.

A. Give yourself some time to find the missing device before alarming anyone. It’s probably somewhere in the room.

B. Since it’s after hours, contact the Enterprise Service Desk (ESD) right away. Then report the incident to your supervisor, ISSO, and PO on the next business day.

Feedback

The correct answer is B.

If you lose or misplace a Government Furnished Equipment (GFE) device, you should contact your supervisor, ISSO, and PO as soon as you’re able.

If the incident occurs outside of business hours, reach out to the Enterprise Service Desk (ESD) for immediate response. Contact information for the ESD is available in the Resources section.

The ESD is open 24/7 and can take appropriate measures until you’re able to report to your supervisor, ISSO, and PO. For example, VA technicians can remotely wipe lost or stolen phones to avoid unauthorized disclosure of VA sensitive information. Upon receiving a new VA-issued mobile device, you’ll be prompted to set up a secure Personal Identification Number (PIN) code shortly after activation, which helps avoid disclosure of VA sensitive information on lost or stolen phones.

Employees are encouraged to keep the ESD number on hand, especially while on travel. Just make sure to keep the written number secure and separate from your VA-issued device to avoid an impostor scenario.

Remember, it’s your responsibility to protect VA assets from theft, loss, fraud, and abuse. Never leave your work devices (e.g., laptops, mobile phones, tablets) unattended. If you find someone else’s VA equipment unattended, take it to your local ISSO or the VA Police.

The loss, theft, or misuse of GFE is a serious issue that should be reported as soon as it’s discovered, in accordance with the ROBs.

Rules of Behavior

Organizational Users and Non-Organizational Users

I WILL protect GFE from theft, loss, destruction, misuse and emerging threats.

Organizational Users

I WILL secure mobile devices (e.g., laptops, tablets, smartphones) and portable storage devices (e.g., compact discs, digital video discs, universal serial bus flash drives).

I WILL report suspected or identified information security incidents, including unauthorized disclosures of VA information, or access to a VA information system, as well as anti-virus, antispyware, firewall or intrusion detection software errors, or significant alert messages (security and privacy) to my VA supervisor and the enterprise service desk immediately or as soon as reasonably feasible.

Non-Organizational Users

I WILL report suspected or identified information security incidents, including loss or theft of GFE, unauthorized disclosures of VA information or unauthorized access to a VA information system, as well as anti-virus, antispyware, firewall or intrusion detection software errors or significant alert messages (security and privacy) on VA information systems to the enterprise service desk immediately or as soon as reasonably feasible.

3.4 Software Downloads

Install only software that is VA-approved and compliant with software licensing and copyright restrictions on VA-issued devices. Do not download software from the internet to your VA-owned systems unless you have been authorized to do so. This includes free trials and free open-source software.

For more information about approved software, please visit the Resources section for the link to the VA Technical Reference Model (TRM). If you need specific software to do your work that is not VA-approved, you should discuss it with your supervisor and submit a ticket through the ESD. They will route your request to the proper authority.

3.5 VA-Issued Mobile Device Safety

Before being issued a VA mobile device, you must first take Mobile Training: Security of Apps on iOS Devices (VA TMS ID: 3926744). Afterward, you must fulfill the annual refresher training requirement by completing this course.

Here are some best practices for securely using your VA-issued mobile device:

• Enroll GFE mobile devices in Workspace ONE® (formerly AirWatch®) before downloading any apps.

• Use only VA-approved apps from the VA App Catalog to send, receive, or store VA sensitive information. Go to the Resources section for a link to view the allow list of apps that have been approved for VA business.

• To download apps that will NOT be used for handling VA sensitive information or interacting with the VA system—such as hotel, airline, and weather apps—use approved public app stores.

• Never download apps from any third-party source other than an approved app store. The link to the deny list of apps that are blocked from VA phones is available in the Resources section.

Downloading unapproved applications on VA mobile devices is not allowed.

• If you are notified of a malicious app or other threat on your device, take the recommended steps to remove or correct it. VA’s mobile security tool Lookout monitors all VA mobile devices, alerting users whenever a threat is detected. Non-compliant devices may be removed from the network.

• Remember, VA sensitive information stored on a VA-issued mobile device must be encrypted.

• Enable and use Wi-Fi for automatic Operating System (OS) updates.

• Never allow remote access requests from anyone other than an authorized VA official.

For more detailed information, review VA Handbook 6500.10, Mobile Device Security Policy.

3.6 Handling VA-Issued Mobile Devices

Mobile phones and tablets/iPads are becoming standard devices for daily work, just like laptops. The two greatest conveniences of mobile devices, size and mobility, are also their greatest weaknesses.

That’s because their size and mobility make them easy to steal, lose, or misuse.

VA uses a mobile device management system to centrally manage all VA-issued mobile devices. While the risk of data breaches and privacy incidents on VA mobile devices is low, you should stay aware and vigilant. Loss or theft of mobile devices and equipment can have negative privacy and security impacts, such as the compromise of VA sensitive information.

When switching duty stations, it’s important to return the equipment to the departing duty station. Do not take the equipment with you. You will be issued equipment from the receiving station.

If you have a VA mobile device, review the guidance below:

• Follow all mobile-specific VA ROBs for your user type as agreed to and report any suspected or actual incidents to your local ISSO or PO.

• Do not use text messaging or third-party Short Message Service (SMS) apps not offered in the VA App Catalog to conduct VA business or send VA sensitive information unless specifically approved by the appropriate authorities. Contact your local ISSO or PO for more information.

• Observe limited personal use of the device as stated in VA Directive 6001, Limited Personal Use of Government Office Equipment Including Information Technology.

• If you are leaving VA or transferring to a new duty station, remember to return your devices to the duty station you are leaving.

3.7 Scenario: GFE, Personal Devices, and Personal Use

Scenario

You are working remotely and need to print out a document for business reasons. However, you haven’t been issued a GFE printer. Can you plug your personal printer into one of your work laptop’s Universal Serial Bus (USB) ports?

Determine the best answer from the options provided.

A. Sure. You need to print the document for work-related reasons, and your supervisor said it should be fine.

B. No. You should keep GFE separate from personal property.

Feedback

The correct answer is B.

You should never plug personal printers, tablets, smart watches, or phones into GFE such as laptops, desktop computers, or VA-provided docking stations. Doing so creates a risk of unauthorized access and harm to VA systems. If you’re a teleworker who’s been approved for remote printing as part of your assigned job duties, you should use only VA-issued equipment to do so, per your Telework Agreement.

Remember, personally owned mobile devices are not allowed to be connected to the VA network or used to store or communicate VA data. Note that this includes wireless connections, such as Bluetooth, as well as physical connections via USB.

Most unauthorized connections to USB ports will be blocked based on the configuration of the GFE.

However, this isn’t always the case and is not a guaranteed fail-safe. If you have a business need to connect a blocked device to VA-issued equipment, contact the ESD to determine the appropriate method for submitting a request.

Keep GFE and sensitive information safe, secure, and separate from personal devices and information.

This also means that you should avoid using GFE to access social media or other personal sites unless it’s for a work-related purpose. You should always observe limited personal use of VA-issued devices in compliance with VA Directive 6001. Note that unapproved sites will be blocked by the firewall.

However, even if a site is approved, that doesn’t mean you can use it in ways that interfere with your duties or go against policy. Misuse of approved sites will be handled on a case-by-case basis by your supervisor.

Rules of Behavior

Organizational Users and Non-Organizational Users

I WILL keep Government furnished equipment (GFE) and VA information safe, secure, and separated from my personal property and information, regardless of work location.

I WILL protect GFE from theft, loss, destruction, misuse and emerging threats.

I WILL limit the personal use of social media/networking sites, in accordance with VA Directive 6001, Limited Personal use of Government Office Equipment Including Information Technology.

3.8 Summary

Just as you handle VA sensitive information with care, you must also make smart choices to protect the devices and resources that store and process that information.

Follow these requirements when handling VA electronic resources:

• Use only VA-approved software on VA-issued devices.

• Protect VA-issued devices, such as laptops, tablets, and mobile phones, against unauthorized access, loss, theft, and misuse.

• Report lost or stolen VA-issued devices to your supervisor, ISSO, and PO. You should also contact the VA Police in the case of suspected theft or other physical security threats.

Topic 4: Accessing VA Information

4.1 Introduction and Objectives

VA information systems can be accessed in many ways but should be accessed only by those who have a valid need-to-know and the proper credentials. Knowing how to do so securely and logically is important to maintain the integrity of the system and to take strategic action moving forward.

When you have completed this topic, you will be able to do the following:

• Identify common situations and methods used when protecting access to VA information systems

• Recognize the steps to protect access to VA information and systems.

In this topic, you will find situations that deal with accessing VA systems and information properly and how to protect your accesses to such systems and information.

4.2 Need-to-Know and Minimum

Access The need-to-know principle means you should have access only to information, programs, and systems that you need to perform your official duties. Also, you should have access only to the minimum necessary information. Remember, never provide anyone access to information who doesn’t have an authorized need-to-know. This practice helps support the new federal strategy of Zero Trust.

VA is moving toward the new federal strategy of Zero Trust, per OMB-M22-09, Moving the U.S.

Government Toward Zero Trust Cybersecurity Principles. With this strategy, no actor, system, network, or service operating outside or within the security perimeter is trusted. Anything or anyone attempting to establish access must always be verified to protect the organization against growing threats.

If you have access to a system you no longer need or more accesses than you need, this violates the need-to-know principle. Having accesses you no longer need increases your risk of being an insider threat. This could expose SPI; invade the privacy of Veterans, colleagues, and employees; and cause possible risk to VA. Let your supervisor know when you no longer need access to a system so that you can be removed from it. This helps keep your risk of being an insider threat low.

Typically, your accesses will need to be updated whenever you change jobs within VA. Work with your supervisor, ISSO, Records Management Officer, and PO to take care of system accesses and any physical records you have before changing jobs, retiring, or leaving VA.

4.3 Scenario: Need-to-Know

Scenario

An external entity sends you an email saying they need access to VA sensitive information for authorized purposes. What should you do?

Determine the best answer from the options provided.

A. Reach out to the appropriate authorities to make sure the external entity has a need-to-know. If they do, send the necessary information in an encrypted email.

B. Provide access to the information right away. It sounds as if they have a valid need, so encryption isn’t necessary.

Feedback

The correct answer is A.

You should provide access to VA sensitive information only to those who have a verified need-to-know for official business purposes and the correct level of permissions.

Even if the requesting party is an authorized entity, you should still reach out to the appropriate authorities, such as your supervisor or local ISSO, to verify that they have a need-to-know. If they do, provide only the minimum necessary information through a properly encrypted email or other VA-approved method.

If you provide access to sensitive records, such as medical diagnoses or treatments, without the appropriate legal authority, you are in violation not only of the VA ROBs but also of federal law. There must be a valid, professional, duty-related reason for you to share access with anyone, whether they are inside or outside the organization. In cases when an external party is requesting information, direct them to the facility’s Release of Information Office or Freedom of Information Act Officer for assistance.

Rules of Behavior

Organizational Users

I WILL only provide access to VA sensitive information to those whom I verify have a need-to-know of this information for their official duties.

I WILL NOT disclose information protected by VA’s privacy statutes or regulations without appropriate legal authority. Unauthorized disclosure of this information may have an adverse effect on agency operations, agency assets and individuals including myself.

Non-Organizational Users

I WILL NOT disclose any information protected by VA’s privacy statutes or regulations without appropriate legal authority. I understand unauthorized disclosure of this information may have a serious adverse effect on agency operations, agency assets and individuals.

4.4 Identification and Authentication

You use your VA credentials, also known as a Personal Identity Verification (PIV) card, to access VA facilities, systems, and information.

You provide this identification to show that you are authorized to be in a VA facility, and you use it to authenticate your access to VA systems. This card should be treated like your credit card or passport; it is an important piece of identification for you and is part of VA’s standard method for controlling access to information and systems.

The security certificates on your PIV card and your Personal Identification Number (PIN) authenticate you to use VA systems. You should secure any PINs, passwords, passcodes, or other forms of authentication you may use; never share this information with others.

See VA Directive and Handbook 6510, VA Identity and Access Management, for more detailed information on how VA manages credentials and accesses to VA systems.

4.5 Scenario: Lost PIV Card

Scenario

You’re visiting a local VA facility to pick up some equipment. When you get back to your home office, you can’t find your PIV card. It isn’t in your wallet or your lanyard. What should you do first?

Determine the best answer from the options provided.

A. Notify the local PIV Card Issuing (PCI) Facility, the VA Police, and your supervisor immediately.

B. Go back and retrace your steps. Maybe you dropped it somewhere.

Feedback

The correct answer is A.

For a lost or stolen PIV card, you should notify local PCI Facility personnel, the VA Police, and your supervisor within 4 hours.

In the past, if your PIV card was lost or stolen, you had to submit an incident ticket and also find and notify your local ISSO. Now, if you submit a request for a Lost/Stolen PIV Exemption through the AccessVA Service Portal, an incident will automatically be created, so you don’t have to perform that extra step of locating and notifying your local ISSO. You will still need to notify the local PCI Facility personnel, the VA Police, and your supervisor within 4 hours.

If the incident occurs after hours and these parties aren’t available, contact the ESD, which is open 24/7.

The longer the card is missing, the greater the threat of unauthorized access becomes. All lost or stolen credentials must be reported to the PCI Facility within 24 hours of discovery or on the next business day.

While waiting for the card to be replaced, you can contact the ESD for temporary exemption and system access.

Lost PIV cards continue to be one of the most commonly reported security incidents, often occurring in remote environments. For this reason, you should take care to protect your PIV card, passwords, and credentials at all times, securing them just as you would your driver’s license or credit cards.

Remember, PIV cards can be used to access not only VA computers and information, but also facilities and secure…