36C24420Q0035-002.pdf

DEPARTMENT OF VETERANS AFFAIRS

INFORMATION SECURITY RULES OF BEHAVIOR

1. COVERAGE

a. Department of Veterans Affairs (VA) Information Security Rules of Behavior (ROB) provides the specific responsibilities and expected behavior for organizational users and non-organizational users of VA systems and VA information as required by OMB Circular A-130, Appendix III, paragraph 3a(2)(a) and VA Handbook 6500, Managing Information Security Risk: VA Information Security Program.

b. Organizational users are identified as VA employees, contractors, researchers, students, volunteers, and representatives of Federal, state, local or tribal agencies not representing a Veteran or claimant.

c. Non-organizational users are identified as all information system users other than VA users explicitly categorized as organizational users. These include individuals with a Veteran/claimant power of attorney. Change Management Agents at the local facility are responsible for on-boarding power of attorney/private attorneys.

d. VA Information Security ROB does not supersede any policies of VA facilities or other agency components that provide higher levels of protection to VA’s information or information systems. The VA Information Security ROB provides the minimal rules with which individual users must comply. Authorized users are required to go beyond stated rules using “due diligence” and the highest ethical standards.

2. COMPLIANCE

a. Non-compliance with VA ROB may be cause for disciplinary actions.

Depending on the severity of the violation and management discretion, consequences may include restricting access, suspension of access privileges, reprimand, demotion and suspension from work. Theft, conversion, or unauthorized disposal or destruction of Federal property or information may result in criminal sanctions.

b. Unauthorized accessing, uploading, downloading, changing, circumventing, or deleting of information on VA systems; unauthorized modifying VA systems, denying or granting access to VA systems; using VA resources for unauthorized use on VA systems; or otherwise misusing VA systems or resources is strictly prohibited.

c. VA Information Security ROB does not create any other right or benefit, substantive or procedural, enforceable by law, by a party in litigation with the U.S.

Government.

3. ACKNOWLEDGEMENT

a. VA Information Security ROB must be signed before access is provided to VA information systems or VA information. The VA ROB must be signed annually by all users of VA information systems or VA information. This signature indicates agreement to adhere to the VA ROB. Refusal to sign VA Information Security ROB will result in denied access to VA information systems or VA information. Any refusal to sign the VA Information Security ROB may have an adverse impact on employment with VA.

b. The ROB may be signed in hard copy or electronically. If signed using the hard copy method, the user should initial and date each page and provide the information requested under Acknowledgement and Acceptance. For other Federal Government Agency users, documentation of a signed ROB will be provided to the VA requesting official.

4. INFORMATION SECURITY RULES of BEHAVIOR

Access and Use of VA Information Systems I Will:

• Comply with all federal VA information security, privacy, and records management policies. SOURCE: PM-1

• Have NO expectation of privacy in any records that I create or in my activities while accessing or using VA information systems. SOURCE: AC-8

• Use only VA-approved devices, systems, software, services, and data which I am authorized to use, including complying with any software licensing or copyright restrictions. SOURCE: AC-6

• Follow established procedures for requesting access to any VA computer system and for notifying my VA supervisor or designee when the access is no longer needed. SOURCE: AC-2

• Only use my access to VA computer systems and/or records for officially authorized and assigned duties. SOURCE: AC-6

• Log out of all information systems at the end of each workday. SOURCE: AC-11

• Log off or lock any VA computer or console before walking away. SOURCE: AC-

• Only use other Federal government information systems as expressly authorized by the terms of those systems; personal use is prohibited. SOURCE: AC-20

• Only use VA-approved solutions for connecting non-VA-owned systems to VA’s network. SOURCE: AC-20

I Will Not:

• Attempt to probe computer systems to exploit system controls or to obtain unauthorized access to VA sensitive data. SOURCE: AC-6

• Engage in any activity that is prohibited by VA Directive 6001, Limited Personal Use of Government Office Equipment Including Information Technology. SOURCE:

AC-8

• Have a VA network connection and a non-VA network connection (including a modem or phone line or wireless network card, etc.) physically connected to any device at the same time unless the dual connection is explicitly authorized.

SOURCE: AC-17 (k)

• Host, set up, administer, or operate any type of Internet server or wireless access point on any VA network unless explicitly authorized by my Information System Owner, local Chief Information Officer (CIO) or designee, and approved by my Information Security Officer (ISO). SOURCE: AC-18

Protection of Computing Resources

I Will:

• Secure mobile devices and portable storage devices (e.g., laptops, Universal Serial Bus (USB) flash drives, smartphones, tablets, personal digital assistants

(PDA)). SOURCE: AC-19

I Will Not:

• Swap or surrender VA hard drives or other storage devices to anyone other than an authorized OI&T employee. SOURCE: MP-4

• Attempt to override, circumvent, alter or disable operational, technical, or management security configuration controls unless expressly directed to do so by authorized VA staff. SOURCE: CM-3

Electronic Data Protection

I Will:

• Only use virus protection software, anti-spyware, and firewall/intrusion detection software authorized by VA. SOURCE: SI-3

• Safeguard VA mobile devices and portable storage devices containing VA information, at work and remotely, using FIPS 140-2 validated encryption (or its successor) unless it is not technically possible. This includes laptops, flash drives, and other removable storage devices and storage media (e.g., Compact Discs (CD), Digital Video Discs (DVD)). SOURCE: SC-13

• Only use devices encrypted with FIPS 140-2 (or its successor) validated encryption. VA owned and approved storage devices/media must use VA’s approved configuration and security control requirements. SOURCE: SC-28

• Use VA e-mail in the performance of my duties when issued a VA email account.

SOURCE: SC-8

• Obtain approval prior to public dissemination of VA information via e-mail as appropriate. SOURCE: SC-8

I Will Not:

• Transmit VA sensitive information via wireless technologies unless the connection uses FIPS 140-2 (or its successor) validated encryption. SOURCE: AC-

• Auto-forward e-mail messages to addresses outside the VA network. SOURCE:

SC-8

• Download software from the Internet, or other public available sources, offered as free trials, shareware, or other unlicensed software to a VA-owned system.

SOURCE: CM-11

• Disable or degrade software programs used by VA that install security software updates to VA computer equipment, to computer equipment used to connect to VA information systems, or used to create, store or use VA information. SOURCE: CM-

Teleworking and Remote Access

I Will:

• Keep government furnished equipment (GFE) and VA information safe, secure, and separated from my personal property and information, regardless of work location. I will protect GFE from theft, loss, destruction, misuse, and emerging threats. SOURCE: AC-17

• Obtain approval prior to using remote access capabilities to connect non-GFE equipment to VA’s network while within the VA facility. SOURCE: AC-17

• Notify my VA supervisor or designee prior to any international travel with a GFE mobile device (e.g. laptop, PDA) and upon return, including potentially issuing a specifically configured device for international travel and/or inspecting the device or reimaging the hard drive upon return. SOURCE: AC-17

• Safeguard VA sensitive information, in any format, device, system and/or software in remote locations (e.g., at home and during travel). SOURCE: AC-17

• Provide authorized OI&T personnel access to inspect the remote location pursuant to an approved telework agreement that includes access to VA sensitive information. SOURCE: AC-17

• Protect information about remote access mechanisms from unauthorized use and disclosure. SOURCE: AC-17

• Exercise a higher level of awareness in protecting GFE mobile devices when traveling internationally as laws and individual rights vary by country and threats against Federal employee devices may be heightened. SOURCE: AC-19

I Will Not:

• Access non-public VA information technology resources from publicly-available IT computers, such as remotely connecting to the internal VA network from computers in a public library. SOURCE: AC-17

• Access VA’s internal network from any foreign country designated as such unless approved by my VA supervisor, ISO, local CIO, and Information System Owner. SOURCE: AC-17

User Accountability

I Will:

• Complete mandatory security and privacy awareness training within designated time frames, and complete any additional role-based security training required based on my role and responsibilities. SOURCE: AT-3

• I understand that authorized VA personnel may review my conduct or actions concerning VA information and information systems, and take appropriate action.

SOURCE: AU-1

• Have my GFE scanned and serviced by VA authorized personnel. This may require me to return it promptly to a VA facility upon demand. SOURCE: MA-2

• Permit only those authorized by OI&T to perform maintenance on IT components, including installation or removal of hardware or software. SOURCE:

MA-5

• Sign specific or unique ROBs as required for access or use of specific VA systems. I may be required to comply with a non-VA entity’s ROB to conduct VA business. While using their system, I must comply with their ROB. SOURCE: PL-4

Sensitive Information

I Will:

• Ensure that all printed material containing VA sensitive information is physically secured when not in use (e.g., locked cabinet, locked door). SOURCE: MP-4

• Only provide access to sensitive information to those who have a need-to-know for their professional duties, including only posting sensitive information to web-based collaboration tools restricted to those who have a need-to-know and when proper safeguards are in place for sensitive information. SOURCE: UL-2

• Recognize that access to certain databases has the potential to cause great risk to VA, its customers and employees due to the number and/or sensitivity of the records being accessed. I will act accordingly to ensure the confidentiality and security of these data commensurate with this increased potential risk. SOURCE:

UL-2

• Obtain approval from my supervisor to use, process, transport, transmit, download, print or store electronic VA sensitive information remotely (outside of VA owned or managed facilities (e.g., medical centers, community based outpatient clinics (CBOC), or regional offices)). SOURCE:UL-2

• Protect VA sensitive information from unauthorized disclosure, use, modification, or destruction, and will use encryption products approved and provided by VA to protect sensitive data. SOURCE: SC-13

• Transmit individually identifiable information via fax only when no other reasonable means exist, and when someone is at the machine to receive the transmission or the receiving machine is in a secure location. SOURCE: SC-8

• Encrypt email, including attachments, which contain VA sensitive information. I will not encrypt email that does not include VA sensitive information or any email excluded from the encryption requirement. SOURCE: SC-8

• Protect Sensitive Personal Information (SPI) aggregated in lists, databases, or logbooks, and will include only the minimum necessary SPI to perform a legitimate business function. SOURCE: SC-28

• Ensure fax transmissions are sent to the appropriate destination. This includes double checking the fax number, confirming delivery, and using a fax cover sheet with the required notification message included. SOURCE: SC-8

I Will Not:

• Disclose information relating to the diagnosis or treatment of drug abuse, alcoholism or alcohol abuse, HIV, or sickle cell anemia without appropriate legal authority. I understand unauthorized disclosure of this information may have a serious adverse effect on agency operations, agency assets, or individuals.

SOURCE IP-1

• Allow VA sensitive information to reside on non-VA systems or devices unless specifically designated and authorized in advance by my VA supervisor, ISO, and Information System Owner, local CIO, or designee. SOURCE: AC-20

• Make any unauthorized disclosure of any VA sensitive information through any means of communication including, but not limited to, e-mail, instant messaging, online chat, and web bulletin boards or logs. SOURCE: SC-8

Identification and Authentication

I Will:

• Use passwords that meet the VA minimum requirements. SOURCE: IA-5 (1)

• Protect my passwords; verify codes, tokens, and credentials from unauthorized use and disclosure. SOURCE: IA-5 (h)

I Will Not:

• Store my passwords or verify codes in any file on any IT system, unless that file has been encrypted using FIPS 140-2 (or its successor) validated encryption, and I am the only person who can decrypt the file. I will not hardcode credentials into scripts or programs. SOURCE: IA-5 (1) (c)

Incident Reporting

I Will:

• Report suspected or identified information security incidents including anti-virus, antispyware, firewall or intrusion detection software errors, or significant alert messages (security and privacy) to my VA supervisor or designee immediately upon suspicion. SOURCE: IR-6

5. ACKNOWLEDGEMENT AND ACCEPTANCE

a. I acknowledge that I have received a copy of VA information Security Rules of Behavior.

b. I understand, accept and agree to comply with all terms and conditions of VA Information Security Rules of Behavior.

Print or type your full name Signature Date

Office Phone Position Title