Attachment 2 - (SAMPLE) Rules of Behavior for United States Mint IT System Users.pdf

Attachment 2 Page 1 of 2 United States Mint 20340923R00004 Medical Professional Services

United States Mint User Rules of Behavior for IT Systems and Devices

1. Each computer user is responsible for activities performed under his or her assigned User ID.

2. Users must take positive steps to see that the information system resources with which they have been entrusted are used properly, as directed by Federal law, regulation and United States Mint policy.

3. Users must take positive steps to protect United States Mint equipment, software, and data from loss, theft, or unauthorized use. Unknown and unidentified persons attempting access should be reported to the ITD Help Desk

4. Users must not attempt to circumvent any United States Mint security control mechanisms.

5. Users must protect credentials and passwords or personal identification numbers (PIN) from improper disclosure and should not use another person’s credentials and password/PIN to access United States Mint information systems.

6. Users will only access agency information resources and data for which they have specific authorization, or are considered public.

o All access will conform to Federal law, regulation, and United States Mint policy o Users must not search, browse, copy, alter, delete, or reveal any United States Mint data or information except in accordance with their assigned job responsibilities.

o Users shall refrain from using Government IT resources for activities that are inappropriate, in accordance with Treasury Directive 87-041 definitions of inappropriate use, including but not limited to: accessing pornography or hacker sites; the creation, download, viewing, storage, copying, or transmission of sexually explicit or sexually oriented materials; and downloading, copying, and/or playing of computer video games, etc

7. Users must complete annual information security awareness and privacy awareness training as required by Federal law, regulation, and United States Mint policy.

8. Users must report any known or suspected breaches of information security to the ITD Help Desk immediately after discovery of the occurrence.

9. Users are not permitted to load any software onto, or alter the hardware or configuration of, any United States Mint electronic device unless specifically authorized. This includes the installation of games.

10. Unless specifically authorized, users will not use United States Mint devices to make copies of software or other copyrighted material or copy copyrighted material that is licensed to the United States Mint.

11. When leaving an active United States Mint workstation unattended, users will log off or use password screen protection and remove their PIV card to secure the workstation from unauthorized use.

12. Users will not transport United States Mint electronic devices or peripherals outside of the territory of the United States without the express permission of the Chief Information Officer. This includes Personal Digital Assistants or Smart Phones such as Blackberry® handheld devices or special use equipment such as tablets.

13. Sensitive but unclassified, intellectual property, and propriety information that includes United States Mint data for information system infrastructure, procurement and financial information (contracts and budgetary), personally identifiable information (PII) or information in identifiable form (IFF) such as, but not limited to: home address, personal telephone number, social security number, financial, medical, education, criminal, employment history that can identify an individual in conjunction with other data elements shall not be shared in audio/video conferencing tools for meetings/teleconferences.

Attachment 2 Page 2 of 2 United States Mint 20340923R00004 Medical Professional Services

14. United States Mint users do not have a right, nor should they have an expectation, of privacy while using covered devices at any time, including accessing the Internet or using e-mail. To the extent that users wish their private activities to remain private, they should not use covered devices. By using covered devices, users consent to disclosing the contents of any files or information maintained on those covered devices and consent to monitoring and recording of the content and conduct of their online activities, including, but not limited to, accessing the Internet and using e-mail.

Violation of these rules can be grounds for administrative, disciplinary and/or adverse action by the United States Mint, which may result in actions up to and including removal from Federal service and prosecution under Federal law.

1 TD 87-04 link to full text:

http://www.treasury.gov/about/role-of-treasury/orders-directives/Pages/td87-04.aspx

I hereby acknowledge that I have read and understood, and agree to abide by, the above IT System User Rules of Behavior for the United States Mint.

(Printed Name)

(Signature)

(Date) http://www.treasury.gov/about/role-of-treasury/orders-directives/Pages/td87-04.aspx