Attachment_J.8_CDAN_2020_ROB.pdf

Crash Data Acquisition Network (CDAN) Rules of Behavior (ROB) 2020 (27Jan2020)

The following CDAN Account holders should begin with Item 8:

• FARS/CRSS State Employees

As an account holder for NHTSA’s Crash Data Acquisition Network (CDAN), you are required to read and acknowledge your understanding of the CDAN Rules of Behavior. CDAN ROB acceptance is renewed annually.

1. The CDAN systems and equipment are intended for official government use only. No personal use of your Government

Furnished Equipment (GFE) is authorized.

2. CDAN systems and equipment cannot be used for commercial purposes, for financial gain, for illegal activity, or in support of “for profit” non-government activities.

3. Applies to Federal and Contract Staff: Work related to a user’s official duties for the program is to be performed using your official US DOT approved email.

a) Use of personal and company email for official program related matters is NOT authorized.

b) DO NOT send sensitive PII information to internal or external audiences using unsecure/unencrypted email.

4. The government will monitor the activity of any machine connected to its infrastructure, which includes distributed equipment (e.g., ToughBook, camera, etc.).

5. CDAN equipment, i.e. Laptops, Tablet PC’s, and Digital Cameras shall be kept secure at all times. Portable equipment shall not be left overnight in vehicles and must be secured and hidden from external view (i.e. trunk, “enclosed lockable area”) if left unattended in the vehicle at anytime. Turn laptop/tablet etc. off at the end of the day, unless otherwise directed.

6. Virus prevention tools must be installed and kept current on any and all machines from which CDAN systems and network(s) are accessed.

7. Any resource not under contract to perform work on behalf of NHTSA and CDAN is prohibited from possessing Government Furnished Equipment (GFE) at anytime. This includes acting as steward of GFE when no active contract exists.

All GFE must be surrendered to the federal COR/ACOR or designate on or before expiration of the contract.

8. CDAN systems are the property of the federal government. NHTSA owns the data stored on these systems, including all email messages and information, even those deemed personal.

9. Information that was obtained via the CDAN systems will not be divulged outside of government channels without the express permission of the data owner.

10. Any activity that would discredit NHTSA or the U.S. Department of Transportation, including seeking, transmitting, collecting, or storing defamatory, discriminatory, obscene, harassing, or intimidating messages or material is not permitted.

11. Any activity that violates Federal laws for information protection (e.g., hacking, spamming, etc.) is not permitted.

12. CDAN system accounts are provided solely for the use of the individual for whom they were created to perform authorized government work.

13. Passwords or any other authentication mechanism should never be shared or stored in any place easily accessible. If stored, a password must not be stored in a clear-text or readable format.

14. Each CDAN system has password format requirements and a password expiration policy. Although there are variations between systems, passwords which are at least 12 alphanumeric characters in length, and contain at least two letters and three numbers or special characters (@, $, #, etc.) will normally meet the requirement. Typically, passwords must be changed every 90 days (30 days for Administrator accounts).

15. It is mandatory that all forms of Personally Identifiable Information (PII) stored on all systems (including mobile devices) be protected and never disclosed to unauthorized third parties.

16. Any security problems, password compromises, and unauthorized information disclosures must be reported immediately to the Network Administrator by contacting the CDAN HelpDesk at 888-399-3277 or by e-mail to CDAN.HelpDesk@dot.gov.

17. CDAN Users should use extreme caution when printing CDAN material, specifically CDAN content that contains sensitive information. Printed material containing sensitive information must be secured in transit and in storage. See Emergency Events for reporting document loss.

18. The distribution of third party software and proprietary manuals outside of CDAN is strictly prohibited.

19. Collection, transportation and transfer of CDAN data, specifically sensitive data, is strictly prohibited unless done so using an approved and authorized mobile device such as Secure USB.

mailto:CDAN.HelpDesk@dot.gov

Crash Data Acquisition Network (CDAN) Rules of Behavior (ROB) 2020 (27Jan2020)

20. When using government provided or employee provided, approved, mobile devices (iPhone, iPad, smart phone) to support data acquisition; any information captured and/or transmitted must contain ONLY non-sensitive, unclassified, publicly releasable information. All CDAN sanitization rules apply.

Emergency Events Asset and Data Protection are imperative for all CDAN users. CDAN Management must report emergency events to the NHTSA Office of the Chief Information Officer within one hour of these types of events occurring.

! The following are considered Emergency events:

• Site compromise (break in, fire, natural disaster, etc.)

• Crashes involving Study vehicles

• Immediate (unscheduled) termination of CDAN/ADDOT account holder (reference CDAN System Security Plan)

• Loss (defined as “no longer in control of or unaware as to the exact location and status regardless of the circumstances”) of any asset having data storage capability (camera, computer, personal storage media, cell phone, etc.)

• Virus/Malware contamination (turn computer off prior to reporting)

• Loss of documents containing sensitive data (PAR, medical record, etc.)

• Identification of sensitive, un-redacted data on unauthorized mediums (Internet, reports, unencrypted email, etc.)

! Emergency events are to be reported immediately by following instructions in the Crash Data Acquisition Network (CDAN):

Reporting Emergency Events instructions located in the CDAN Resources section of the CDAN Main Menu

• Complete your information below

• Signature Options (depending on your Adobe Acrobat version):

o Print, Sign, Scan o Electronically Sign using Adobe Acrobat by either typing or drawing signature o Electronically Sign using Adobe Acrobat Secure Certificate Signature

• Save file as LastName_FirstName_CDAN_ROB_2020.PDF

• Attach to CDAN HelpDesk ticket using “Notification” ticket type OR Attach in email to CDAN.HelpDesk@dot.gov with subject “Completed ROB”

Name (Last, First):

Affiliation (CDAN, CIREN, CISS, CRSS, FARS, NTS, SCI):

Company Name:

Work Location (City/State):

Date (MM/DD/YYYY):

Signature:

mailto:CDAN.HelpDesk@dot.gov