A19 OCISO_Use_of_Non-Encrypted_PortableMedia_SOP.pdf

Office of the Chief Information Security Officer (OCISO)

U.S. Department of Health and Human Services

Centers for Disease Control and Prevention

OCISO Use of Non-Encrypted Portable Media

Standard Operating Procedure, Version 1.2

Submitted to CISO

DHHS/CDC/OCOO/OCIO/OCISO

4770 Buford Highway, MS F-35

Atlanta, GA 30341-3717

Approved:

3/18/2016

X Cheri L. Gatland-Lightner

Chief Information Security Officer

Signed by: Cheri L. Gatland-lightner -S

OCISO Use of Non-Encrypted Portable Media SOP, v1.2

VERSION Control

Date Author/Editor Version Notes

12/09/2013 Jim Brown / Michael Harris 1.0 Version 1.0 edits and updates.

12/11/2013 Colleen M. Robinson 1.0 Review/edit

12/18/2013 Cheri Gatland-Lightner 1.0 Approved

11/21/2014 Michael Harris 1.1 Annual review/edit

12/10/2014 John Kennedy 1.1 Review/Edit

01/02/2015 Cheri L. Gatland-Lightner 1.1 Approved

03/06/2016 Michael Harris 1.2 Annual review/edit

03/07/2016 John Kennedy 1.2 Review/Edits

03/11/2016 Colleen M. Flaherty 1.2 Review

TABLE OF CONTENTS

1. PURPOSE

2. SCOPE

3. ACRONYMS CHART

4. GENERAL

5. USE OF NON-ENCRYPTED THUMB DRIVES

a. Overview

b. Definitions

c. Roles and Responsibilities

d. Procedure

Appendix A. REFERENCES

Appendix B. RULES OF BEHAVIOR

1. PURPOSE

This document establishes the procedures for the use of OCISO-provided non-encrypted portable media for the storage and transport of non-sensitive information that has been cleared for public dissemination at off-site training and off-site presentations.

2. SCOPE

This SOP applies to all CDC employees, CDC non-employees, and those conducting business for and on behalf of the CDC through contractual relationships.

3. ACRONYMS CHART

The following table provides definitions for acronyms relevant to this document:

Acronym Description

CAN Common Accounting Number

CDC Centers for Disease Control and Prevention

CD-ROM Compact Disc Read-Only Memory

C/I/O Center/Institute/Office

CML Continuous Monitoring Lab

DVD Digital Versatile Disc

FIPS Federal Information Processing Standards

HHS Department of Health and Human Services

ISSO Information Systems Security Officer

OCISO Office of the Chief Information Security Officer

OMB Office of Management and Budget

PII Personally Identifiable Information

SD Secure Digital

USB Universal Serial Bus

4. GENERAL

Office of Management and Budget (OMB) issued Memorandum M-06-16, Protection of Sensitive Agency Information recommending Agencies “encrypt all data on mobile computers/devices which carry agency data unless the data is determined to be non-sensitive, in writing, by [the Agency] Deputy Secretary or an individual he/she may designate in writing.” To ensure compliance with this memorandum, OCISO issued the OCISO Standard for Portable Media and Mobile Device Security requiring all that portable media and mobile devices in use at CDC meet the Federal Information Processing Standards (FIPS) 140-2, Security Requirements for Cryptographic Modules, encryption standard. This requirement resulted in an increased burden on CDC Centers/Institutes/Offices (C/I/Os) in relation to distributing training and conference materials. C/I/Os had to print training and reference materials that were to be used outside CDC resulting in additional time and materials needed to distribute non-sensitive information.

http://www.whitehouse.gov/sites/default/files/omb/memoranda/fy2006/m06-16.pdf http://www.whitehouse.gov/sites/default/files/omb/memoranda/fy2006/m06-16.pdf http://intranet.cdc.gov/ocio/docs/computers-software-equipment/MobileDevicePortableMediaSecurityStandard.pdf http://intranet.cdc.gov/ocio/docs/computers-software-equipment/MobileDevicePortableMediaSecurityStandard.pdf http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf

In response to the collaborative efforts to reduce this burden, CDC requested and was granted the authority to use non-encrypted universal serial bus (USB) drives for the purposes of non-sensitive off-site training and off-site presentations.1

CDC users may use OCISO furnished non-encrypted thumb drives (also referred to as USB drives) for the purposes of storing and transporting non-sensitive off-site training materials and off-site presentations only.

Prior to transferring the data to the non-encrypted thumb drives, CDC users must obtain written concurrence (such as email) from their supervisor that the data being transferred on the non-encrypted thumb drive is acceptable for release to the public.

5. USE OF NON-ENCRYPTED THUMB DRIVES

a. Overview

This section defines the process by which CDC users obtain non-encrypted thumb drives for storing and transporting data for off-site training and off-site presentations.

b. Definitions

The following table defines terms used in this section:

Term Definition

Government- Owned/Furnished Resources

Equipment (including computers, other hardware devices, software, etc.) or information/data owned by CDC or another Federal government organization and provided by CDC to its employees or contractors for use in their official duties.2

Mobile Device A portable computing device that: (i) has a small form factor such that it can easily be carried by a single individual; (ii) is designed to operate without a physical connection (e.g., wirelessly transmit or receive information); (iii) possesses local, non-removable or removable data storage; and (iv) includes a self-contained power source. Mobile devices may also include voice communication capabilities, on-board sensors that allow the devices to capture information, and/or built-in features for synchronizing local data with remote locations. Examples include smart phones, tablets, and E-readers.

Portable Media Any device that can store data electronically and is portable, such as portable hard drives, USB drives, secure digital (SD) card media, compact discs – read only memory (compact discs read-only memory (CD-ROMs)), and digital versatile discs (DVDs).

c. Roles and Responsibilities

The following table identifies the major roles and their associated responsibilities regarding the acquisition and use of non-encrypted thumb drives:

1 Daniel Galik, HHS Chief Information Security Officer, Memorandum to Thomas Madden, CDC Chief Information Security Officer, The Use of Non-encrypted Thumb Drives, February 24, 2012 2 This does not include the personal property of CDC employees, the property of CDC-contracted companies, CDC partners, or other non-U.S.

government entities.

Role Responsibilities

User Submit requests for non-encrypted thumb drives to your Information Systems Security Officer (ISSO)

Maintain possession of non-encrypted thumb drives until they are distributed

Return all unused non-encrypted thumb drives to your ISSO

ISSO Request and obtain non-encrypted thumb drives from OCISO

Copy data to non-encrypted thumb drives as necessary

Distribute the non-encrypted thumb drives to the user

Sanitize all returned non-encrypted thumb drives OCISO Maintain inventory of non-encrypted thumb drives

Process requests for drives received from ISSOs

Provide access to the Continuous Monitoring Lab as scheduled

d. Procedure

Tasks Detailed Steps

1. Requesting non-encrypted thumb drive(s)

User sends an email to their C/I/O’s ISSO specifying the following:

o Number of drives needed, o Date needed, o Digitally signed Rules of Behavior (Appendix B), and o Common Accounting Number (CAN) that may be used to purchase the drives

2. Obtaining non-encrypted thumb drive(s)

ISSO contacts OCISO Management and Program Analyst with number of non-encrypted thumb drives needed and the CAN supplied by the user

OCISO Management and Program Analyst processes request for drives received from ISSO

ISSO retrieves non-encrypted thumb drives from OCISO Management and Program Analyst

3. Copying data to non-encrypted thumb drive(s)

ISSO contacts OCISO Support (OCISOSupport@cdc.gov) to schedule access to OCISO Continuous Monitoring Lab (CML)

ISSO uses the workstation in OCISO CML to copy data from a network share to a single non-encrypted thumb drive o A USB duplicator is available (Monday-Friday 9:00 a.m.–3:00 p.m.)

if additional copies of non-encrypted drives are necessary

Once non-encrypted thumb drives are ready, ISSO gives the drives to the user mailto:OCISOSupport@cdc.gov

Tasks Detailed Steps

4. Returning non-encrypted thumb drive(s)

Upon returning to office, user returns all remaining non-encrypted thumb drives to their ISSO

ISSO:

o Sanitizes returned non-encrypted thumb drives using sanitization process on USB duplicator, o Acknowledges sanitization process by signing sanitization form located at USB duplicator, and o Returns sanitized non-encrypted thumb drives to OCISO Office

Automation Clerk

5. Non-encrypted thumb drive inventory

OCISO Management and Program Analyst uses CANs provided by ISSOs to purchase non-encrypted USB drives, as necessary, to ensure an inventory of approximately 500 devices is available

OCISO Office Automation Clerk maintains unassigned non-encrypted thumb drive inventory as well as distributes drives as necessary

Appendix A. REFERENCES

The following table summarizes the documents referenced in this document:

Document Name and

Version

Description Location

OMB Memorandum M- 06-16, Protection of Sensitive Agency Information, June 23, Implements the requirements and actions required for all department and agencies to protect sensitive agency information when removed from, or accessed from outside the agency location http://www.whitehouse.gov/sites/default /files/omb/memoranda/fy2006/m06- 16.pdf

FIPS 140-2, Security Requirements for Cryptographic Modules, May 2001

Specifies the security requirements for a cryptographic module utilized within a security system protecting sensitive information in computer and telecommunication systems (including voice systems) as defined in Section 5131 of the Information Technology Management Reform Act of 1996, Public Law 104-106 http://csrc.nist.gov/publications/fips/fips1 40-2/fips1402.pdf

HHS Chief Information Security Officer Memorandum to Thomas Madden, The Use of Non-encrypted Thumb Drives, February

Approves the storing and transporting of non-sensitive off-site training materials and off-site presentations using non-encrypted thumb drives

Available per request to OCISO Policy Branch:

CDCOCISOComplianceandEducationTeam @cdc.gov

OCISO Standard for Portable Media and Mobile Device Security

Establishes responsibilities and requirements for reducing potential harm inherent in the daily use of mobile devices and portable media under the ownership or control of the

CDC

http://intranet.cdc.gov/ocio/docs/comput ers-software-equipment/MobileDevicePortableMediaS ecurityStandard.pdf http://www.whitehouse.gov/sites/default/files/omb/memoranda/fy2006/m06-16.pdf http://www.whitehouse.gov/sites/default/files/omb/memoranda/fy2006/m06-16.pdf http://www.whitehouse.gov/sites/default/files/omb/memoranda/fy2006/m06-16.pdf http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf mailto:CDCOCISOComplianceandEducationTeam@cdc.gov?subject=Request:%20HHS%20Chief%20Information%20Security%20Officer%20Memorandum%20to%20Thomas%20Madden,%20The%20Use%20of%20Non-encrypted%20Thumb%20Drives,%20February%202012 mailto:CDCOCISOComplianceandEducationTeam@cdc.gov?subject=Request:%20HHS%20Chief%20Information%20Security%20Officer%20Memorandum%20to%20Thomas%20Madden,%20The%20Use%20of%20Non-encrypted%20Thumb%20Drives,%20February%202012 http://intranet.cdc.gov/ocio/docs/computers-software-equipment/MobileDevicePortableMediaSecurityStandard.pdf http://intranet.cdc.gov/ocio/docs/computers-software-equipment/MobileDevicePortableMediaSecurityStandard.pdf http://intranet.cdc.gov/ocio/docs/computers-software-equipment/MobileDevicePortableMediaSecurityStandard.pdf http://intranet.cdc.gov/ocio/docs/computers-software-equipment/MobileDevicePortableMediaSecurityStandard.pdf

Appendix B. RULES OF BEHAVIOR

Use of Non-Encrypted Portable Media Rules of Behavior

By signing this form, I acknowledge I have received a CDC furnished non-encrypted thumb drive (also known as a USB drive) and understand and will adhere to the following Rules of Behavior:

Upon receipt of the CDC owned/furnished non-encrypted thumb drive(s), I, ________________________________, agree that I:

1. Understand the use of any non-encrypted thumb drive(s) on any CDC information system is strictly prohibited.

2. Understand the non-encrypted thumb drive(s) must be used to store and transport non-sensitive off-site training material or non-sensitive off-site presentation material only.

3. Received a prior written statement (such as email) from my supervisor stating the supervisor has reviewed the data to be transferred to the non-encrypted thumb drive(s) and the data is non-sensitive, releasable to the public, and any loss of data will not have a negative impact on the CDC. In addition, the supervisor has acknowledged the data being transferred to the non-encrypted thumb drive(s) contains no personally identifiable information (PII).

4. Agree not to use the non-encrypted thumb drive(s) to store or transport sensitive data.

5. Agree to keep the non-encrypted thumb drive(s) in my possession until they are distributed at the off-site presentation/training for which they were acquired.

6. Upon return to CDC, I agree to return any remaining non-encrypted thumb drive(s) to my ISSO.

X User signature and date