Attachment Q PE-17 Policy.pdf

State of Arkansas

Department of Finance and Administration Office of Information Services

Information Security v.20230331.1 Page 1 of 2

Title: PE-17-Policy: Alternate Work Site

Type: POLICY

Scope: All DFA

Last Revised: 12/27/2023 Last Reviewed: 12/27/2023 Review Frequency: ANNUALLY

Owner: Office of Information Services – Information Security

Custodian: Office of Information Services – Information Security

Classification: SENSITIVE

Purpose

The Department of Finance and Administration (DFA) develops policies and procedures as is necessary to ensure the security of agency information assets.

The purpose of this policy is to establish requirements and guidelines addressing usage of Alternate Work Sites for DFA employees and contractors authorized to work off site at approved locations.

Scope

This policy applies to all DFA employees and contractors. The policy applies to the use of technology accessing DFA information systems from locations designated as “Alternate Work Sites”.

Policy

"Alternate Work Site" is defined as any location which is not a DFA office facility or designated disaster recovery location from which a DFA Employee or Contractor accesses DFA information systems in performance of their authorized job duties. The following provisions to apply to the use of Alternate Work Sites:

• Remote access to DFA information systems involving access to Federal Tax Information (FTI) from Alternate Work Sites shall require multifactor authentication.

• Alternate Work Sites from which FTI is accessed shall be inspected in accordance with IRS Publication 1075 requirements to ensure the effectiveness of security and privacy controls.

• DFA shall retain ownership and control of any and all hardware, software, and endpoint equipment connecting to public communication networks that are present at Alternate Work Sites.

• DFA employees and contractors authorized to utilize an Alternate Work Site shall be required to have a specific room that has appropriate space and facilities for the type of work done. Access to locking file cabinets or desk drawers for the security of hardware that may be used to access FTI items shall be required. All hardware with the ability to access, store, and/or process abilities to FTI shall be kept in a locked state when not directly accompanied by DFA authorized employees or contractors.

• DFA employees/contractors shall not leave computers unprotected at any time. In the event a user must be away from their computer, even in the event of a brief period of time, the user must lock the computer to prevent the unauthorized disclosure of any information located on the computer.

• DFA employees and contractors shall ensure adherence to DFA Security Policy in the use of technology from an Alternate Work Site. This includes ensuring viewing or accessing of sensitive information, including but not limited to FTI, is limited to authorized individuals.

• FTI shall only be stored on hard disks with agency approved security access control devices installed.

Use of illegal and/or non-approved software is expressly prohibited.

• DFA employees and contractors shall not print information containing FTI from an Alternate Work Site.

• Locations outside of the United States are not approved Alternate Work Sites.

• DFA employees and contractors shall report an incident involving the unauthorized disclosure of FTI to their supervisor and the DFA Office of Information Services - Information Security Office immediately upon discovery of a confirmed or suspected occurrence of unauthorized disclosure.

• DFA shall provide specialized training in security, disclosure awareness and ethics for all participating employees and managers.

State of Arkansas

Department of Finance and Administration Office of Information Services

Information Security v.20230331.1 Page 2 of 2

• The use of digital media, computing resources, and communications resources provided in commercial or public facilities (examples include: hotel Wi-Fi/network or printers, restaurant Wi-Fi, convention, or airport Wi-Fi, etc.) is strictly prohibited from a DFA issued device.

Controls and Measures

• Discovered instances of violation of this policy will be investigated in accordance with Incident Response

Procedures.

• Employees or contractors found to be in violation of this policy shall be subject to disciplinary action in accordance with DFA HR policy which may include, but is not necessarily limited to:

o Verbal Warning o Written Warning o Suspension o Termination

• Employees or contractors found to be in violation of this policy may, pursuant to statutory or regulatory requirements, be subject to criminal or civil penalty.

Reference

Guidance for maintenance of this policy shall include but is not necessarily limited to:

• IRS Publication 1075 (https://www.irs.gov/pub/irs-pdf/p1075.pdf)

• NIST 800-53 Security and Privacy Control Framework (https://csrc.nist.gov/publications/detail/sp/800- 53/rev-5/final)

Revision History

3/24/2022 First Revision

5/25/2022 Purpose wording change

12/29/2022 Header Change

6/3/2023 Revised to include additional language from IRS Publication 1075 Section 2.B.7.

12/27/2023 Revised to include the protection of user computers during brief absences.

https://www.irs.gov/pub/irs-pdf/p1075.pdf https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final