Attachment N DFA Information Systems AUCA.pdf

State of Arkansas

Department of Finance and Administration Office of Information Services

DFA Information System Acceptable Use and Confidentiality Agreement - v2024.02.28

Arkansas Department of Finance and Administration Information Systems

Acceptable Use and Confidentiality Agreement

PURPOSE:

The purpose of this Agreement is to set forth the terms and conditions under which an Authorized User may access and/or use the Arkansas Department of Finance and Administration (DFA) computer resources or confidential Information, as defined below.

DEFINITIONS:

For the purposes of this Agreement, the following words or terms shall have the following meanings:

“Authorized User” means an individual either employed by the State of Arkansas or through contractual terms who will provide services to the State of Arkansas. An Authorized User has a legitimate need and authorization by the State of Arkansas to access the DFA computer resources or confidential information.

“DFA Information System” means the collective interconnected set of components used to collect, store, process and transmit data and digital information in the providing of DFA technology services to Authorized Users and citizens. This includes hardware, software, data, network access and authentication mechanisms. The DFA Information System is maintained by the

Arkansas Department of Finance and Administration (DFA) and third parties.

“Minimum Necessary Standard” means the principle or rule that the amount of Personally Identifiable Information or other information accessed by an Authorized User shall be the least amount needed by the Authorized User to perform his or her legitimate duties for or on behalf of State of Arkansas.

“Personally Identifiable Information” (PII) is any information about an individual maintained by an agency with respect to, but not limited to, education, financial transactions, medical history, and criminal or employment history, and information that can be used to distinguish or trace an individual’s identity (e.g., name, Social Security Number, date and place of birth, mother’s maiden name, biometric records), including any other personal information linked or linkable to an individual.

“Privacy Breach” is any unauthorized access to, destruction of, modification of, acquisition of, or disclosure of Personally

Identifiable Information.

“Security Breach” is any compromise of the security, confidentiality, or integrity of an information system, including but not necessarily limited to any unauthorized access to information, destruction of information, modification of information, acquisition of information, or disclosure of information.

TERMS AND CONDITIONS:

A. Term. Subject to statutory or regulatory requirements to the contrary, this Agreement shall be effective as of the date of

Authorized User’s signature below (the “Effective Date”) and shall remain in effect until the earliest of:

1. The termination of Authorized User’s employment or contractual services with State of Arkansas;

2. The indictment of Authorized User for a felony, fraud, theft, or a crime involving inappropriate use of information; or,

3. Violation of the terms of this agreement.

B. Rights and Responsibilities of Authorized User. By signing below, Authorized User agrees on behalf of himself or herself that he or she is an employee of the State of Arkansas or agent of a contracted entity who needs to have access to DFA

Information Systems to perform his or her job duties. Authorized User also agrees:

1. To protect the privacy, confidentiality, and security of the PII and other information accessed from DFA Information

Systems in accordance with federal and state privacy laws and regulations;

2. To treat all information maintained in DFA Information Systems as strictly confidential and will not release any information to unauthorized persons. I understand that this confidential information includes, but is not limited to, the following: any information that identifies an individual in DFA Information Systems, including an individual's tax information, photograph, social security number, driver's license number, name, address, telephone number, child support information and medical or disability information.

3. To comply with the Minimum Necessary Standard when accessing information and otherwise using PII and other information obtained from DFA Information Systems;

4. To comply with the privacy, confidentiality, and security requirements of the State of Arkansas;

5. To protect the use of my entrusted access control mechanism for any purposes other than those required to perform authorized functions. (These include, but are not limited to, Login Identification, Password, Workstation

Identification, User Identification, File Protection Keys, or physical access control fob)

6. To refrain from accessing DFA Information Systems either directly, or indirectly via means such as screen sharing, from outside the continental United States;

7. To refrain from disclosing information concerning any access control mechanism unless properly authorized to do so by DFA Office of Information Services, and from utilizing any access mechanism not expressly assigned to me.

8. To refrain from and protect against the use of any access mechanism that DFA has not expressly assigned to me for access to the DFA Information System. Remote control of my system by another party via screen sharing while accessing the DFA Information System is expressly prohibited;

9. To acknowledge that the legitimate use of the DFA Information System does not extend to whatever I am capable of doing, but rather, only to the functions I have been authorized to perform;

10. To refrain from accessing, modifying, or copying programs, files, or data of any sort belonging to other users without obtaining prior authorization from the appropriate authority (owner of record, DFA Chief Information Officer (CIO) or their designee).

11. Refrain from installing any equipment or software on a DFA computer or DFA Information System without prior approval from the DFA CIO. This includes personal computers, printers, scanners, removable storage, smart phones, and any personally downloaded or owned software.

12. To refrain from using the DFA Information System to support any commercial enterprise for private financial gain, advertising, or solicitation;

13. To refrain from using the DFA Information System to engage in any illegal activities, such as harassment, discrimination, defamation, threatening or violent communications and behavior, offering for sale, purchase, or use of any prohibited or illegal substances.

14. To notify DFA OIS Technical Services by phone at (501) 683-2183 or by email to tech.support@dfa.arkansas.gov, immediately in the event of an actual or suspected Privacy or Security Breach, or in the case of an actual of suspected violation of this Acceptable Use and Confidentiality Agreement;

15. To cooperate fully with the State of Arkansas to investigate and mitigate the harmful effects of any actual or suspected Privacy or Security Breach, or any actual or suspected violation of this Acceptable Use and Confidentiality

Agreement;

16. To refrain from downloading, taking screenshots of, photographing, copying, printing or pasting information from

DFA Information System to any other non-DFA issued system or device, via the use of native tools, mobile device, or digital camera;

17. To use reasonable measures to prevent the computer screens and other devices displaying PII and other information accessed from DFA Information Systems from being seen by individuals who do not need to see such PII and information; and,

18. To destroy copies of any information obtained from the DFA Information System as soon after the business purpose for using the information has been achieved.

CERTIFICATION AND ACKNOWLEDGMENT

OF

Arkansas Department of Finance and Administration Information Systems

Acceptable Use and Confidentiality Agreement

By signing this agreement, I certify I understand the terms and provisions and accept responsibility for adhering to the same, and I understand that my usage of the DFA Information System may be monitored. I also understand that the above list is meant to be illustrative, not exhaustive. I further agree to abide by all applicable state and federal laws, and DFA policies and standards that relate to receiving access to DFA information. I will follow all security procedures relating to the DFA Information

System and protect the data contained therein. I understand that my access to and use of the DFA Information System will be monitored, and that I have no right to privacy in relation to this access and use.

I understand that violation of this agreement may subject me to disciplinary action that includes, but is not limited to the following:

• Verbal warning

• Written reprimand

• Suspension

• Termination of employment

I understand that violation of this agreement may result in referral of the matter to state and/or federal authorities.

Organization:

Name:

Telephone Number:

Email Address:

Signature: Date: