Attachment 5_Security Agreement_AG32KWS100082.doc

ATTACHMENT 5

APHIS

Security Agreement and Rules of Behavior

An agreement between _______________________________________________ (your printed name) and the Animal and Plant Health Inspection Service.

PURPOSE. This document is meant to obtain an individual agreement to abide by security requirements and procedures needed to protect APHIS and customer information resources. It is also intended to help raise security awareness and inform workers about security policies and procedures and to provide workers an opportunity for asking questions about these matters.

AUTHORITIES. National policy requirements regarding information systems are stated in the Federal Information Security Management Act (Title Ill of the E-Government Act of 2002); the Computer Fraud and Abuse Act (18 U.S.C. Sec. 1030 [1993]); Office of Management and Budget (OMB) Circular No. A-123, Management Accountability and Control; and OMB Circular A-130, Management of Federal Information Resources. These documents along with USDA security policies, prescribe and set standards for establishing and maintaining a comprehensive information security program and use of information systems.

SCOPE. This agreement applies to APHIS employees (and contractors) who operate, maintain, and/or use APHIS Information Technology (IT) systems.

UNDERSTANDING AND AGREEMENTS. As a user of APHIS IT systems, I:

· Will protect APHIS computer systems in accordance with Federal, USDA, and APHIS policies.

· Will use USDA and/or APHIS computer systems (e.g., computers, systems, laptops, networks, etc.) only for authorized purposes. If using the computer systems and networks for nonofficial purposes, I will do so within the bounds allowed by USDA policy, supervisor approval, and without interfering with official business.

· Will protect systems and all sensitive information from electronic or physical access by unauthorized personnel. I will protect computer equipment, media, telecommunications, and similar assets from theft, fraud, misuse, loss, unauthorized modification, and unauthorized denial of use. I will make every effort to avoid action/inaction that could jeopardize mission success, customer rights, individual privacy, or the reputation of the agency.

· Understand that systems and other information resources, including electronic mail and Internet access, are primarily intended for official business and may be monitored. Although USDA policy permits limited personal use, I understand that my personal use must not interfere with official business and that I have no expectation of personal privacy when using these systems.

· Will not intentionally access, delete or alter files, operating systems or programs, except as specifically authorized for official business.

· Will not leave APHIS computers in an operational state (e.g., "logged on") while unattended. I will either: turn off the computer system, manually lock the screen, or set a time activated password-protected screen saver.

· Will abide by software copyright licenses and restrictions. I will not load any unapproved software (e.g., software from home, games, etc.) or install hardware or peripheral devices (e.g., external hard drives, docking stations, thumb drives, etc) on APHIS systems without my supervisor’s permission.

· Will not download file-sharing software (e.g., MP3 music, video files, etc.), peer-to-peer software (e.g., Kazaa, Napster, etc.), or games onto APHIS systems or networks.

· Acknowledge that I will receive user identifiers (user IDs) and passwords to authenticate my computer account. After receiving them, I will:

· Immediately change the password.

· Protect and not share or publicly post my password. (If my password has been compromised, I will report the issue to my supervisor or security personnel.)

· Not store my password on any processor, microcomputer, personal digital assistant (PDA), personal electronic device (PED) or other media unless approved by security personnel.

· Be responsible for all activity that occurs on my individual account once my password has been used to log on. If I am a member of a group account, I am responsible for all activity when logged on a system with that account.

· Ensure my password is changed regularly or if compromised.

· Ensure my password meets USDA complexity requirements.

· Will use anti-virus software in an effective way to prevent damage or disruption to APHIS operations. I will scan all removable media (e.g., disks, CDs, thumb drives, etc.) for malicious software (e.g., viruses, worms, etc.) before using it on any APHIS computer system or network.

· Will take appropriate steps to protect important data from loss (e.g., backups).

· Will not use APHIS computers, networks, or IT services for purposes that violate ethical standards, including harassment, threats, sending or accessing sexually explicit material, racially or ethnically demeaning material, gambling, chain letters, for-profit activities, political activities, promotion or solicitation of activities prohibited by law, and so forth. If I use APHIS computer systems and networks for nonofficial purposes, I will do so within the bounds allowed by USDA policy and supervisor approval and without interfering with official business.

· Will not try to disable or subvert APHIS security controls or monitoring mechanisms.

· Will not attempt to break into any computer, whether Federal, USDA, APHIS, or private, for which access is not authorized. Attempted break-ins may be authorized by my organization’s Information System Security Program Manager (ISSPM) only for functions such as approved security tests, approved attempts to recover a system after a password is lost/forgotten, and similar functions.

· Will practice good housekeeping with all electronic equipment, including keeping food, beverages, or other contaminants away from computers and data storage media.

· Will report suspected/actual security incidents and other security concerns to my supervisor and my organization’s ISSPM.

· Will stay abreast of security issues through education and awareness products distributed throughout USDA. I will attend at least one (1) security awareness session each year.

· Will not disclose sensitive data. In the course of performing work at APHIS I realize it may be necessary for me to have access to sensitive information, which includes:

· Proprietary information - technical information or trade secrets that is proprietary to USDA/APHIS.

· Privacy information - information protected under the provisions of the Privacy Act of 1974.

· Privileged information - financial or commercial information that must be restricted from disclosure on the basis of Federal law or contractual agreement.

· Government information - information or data stored, processed or handled in providing services under any APHIS contract.

NOTE: Signature Agreement on the next page.

I have read and understand the APHIS Security Agreement on the use of government Information Technology (IT) systems. I understand that unauthorized or inappropriate use of government IT systems may result in the loss or limitation of my privilege. I also understand that I could face administrative action ranging from counseling to removal from the agency, as well as any criminal penalties or financial liability, depending on the severity of the misuse.

EFFECTIVE DATE. This agreement becomes effective when signed and dated. Refusal to sign may result in being denied use of any or all APHIS information systems, including e-mail and network access to the Internet. Refusal to sign does not relieve the individual of responsibility to abide by the standards set forth in this and related documents. (Supervisor/COR/COTR: If the worker refuses to sign, note that fact on the signature line and retain this document.)

**If you need to connect remotely to the APHIS network, please initial the following statement:

_____ My duties will require me to connect to the APHIS network remotely and I hereby request remote access authorization.

Signature: ____________________________________ Date: __________

Are you a: Federal Employee: [ ] Contractor: [ ] (check one)

If Federal Employee, your organization: __________________

(Provide one of the following: AC, BRS, IS, LPA, MRPBS, PPD, PPQ, VS, WS, OA (Office of the Administrator))

If Contractor- Company Employed By: ______________________________________

Supervisor/

OR/COTR

Signature: _______________________________________ Date: _______________

Supervisor/COR/COTR/Title: ___________________________________________