RFQ_DJD-17-Q-0195_Amend_0003_10-6-17.pdf

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT 1. CONTRACT ID CODE I PAGE OF PAGES 1 I 21

2. AMENDMENT/MODIFICATION NO. 3. EFFECTIVE DATE 4. REQUISITION/PURCHASE REQ. NO.

PROJECT NO. ( If applicable)

0003 Block 16C

6. ISSUED BY CODE 7. ADMINISTERED BY (If other than Item 6)

CODE I

DEA Headquarters Office of Acquisition and Relocation Mgt 8701 Morrissette Drive Springfield VA 22152

8. NAME AND ADDRESS OF CONTRACTOR (No., street, county, state and ZIP Code) (X) 9A. AMENDMENT OF SOLICITATION NO. -Prospective Quoters DJD-17-Q-0195 l~ 98. DATED (SEE ITEM 11)

09-18-2017

10A MODIFICATION OF CONTRACT/ORDER NO.

108. DATED (SEE ITEM 11)

CODE FACILITY CODE

11. THIS ITEM ONLY APPLIES TO AMENDENTS OF SOLICITATIONS

r~ The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers is extended L~ is not extended.

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods

(a) By completing Items 8 and 15, and returning _ copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

CHECK ONE A THIS CHANGE ORDER IS ISSUED PURSUANT TO (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT ORDER

NO. IN ITEM 10A.

D B THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation date. etc) SET FORTH IN ITEM 14. PURSUANT TO THE AUTHORITY OF FAR 43.103(b) r: fill' ',iJl'f'lfr,;1; i,jf(,! (,(;!'f'l'·,HrHf:;fNlllffl)INl()l'llfi:;IJf•.NI ](Jl\1Jlll(lf'!l 1 '(C!I lJ D OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is required to sign this document and return copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

The purpose of this amendment is to provide answers to questions. Accordingly:

a. The answers to questions, attached, are hereby incorporated into the above numbered solicitation.

b. All other terms and conditions remain unchanged.

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 1 OA, as heretofore changed, remains unchanged and in full force and effect

15A NAME AND TITLE OF SIGNER (Type or print)

158. CONTRACTOR/OFFEROR

(Signature of person authorized to sign)

NSN 7540-01-152-8070

Previous edition unusable

15C.DATE SIGNED

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

Dore (ri\ U. Adair, Contracting Officer

168 f)t 16C.DATE SIGNED )ITEf~ STATES \}ME~ O)l __ • . ~ / . ' 10-06-2017 v (Signature of Contracting Officer)

STANDARD FORM 30 (REv.10-.,31

Prescribed by GSA FAR (48 CFR) 53.243

Questions and Answers RFQ No. DJD-17-Q-0195/Amendment 0003

Maintenance, Repair and Overhaul (MRO) Commercial Off The Shelf (COTS) Software and Services

1. Section 6, 6.8 outlines the formats in which suppliers should send in the RFQ response. It is unclear whether you want two(2) or four(4) CD ROM copies.

ANSWER: The language should be changed to read “two (2) CD ROM copies.”

2. The Functional Requirements spreadsheet outlines a list of response pre-defined codes which are to be used in our response. However there is no “C” listed in the Code column dropdown for us to select. See screenshot below

ANSWER: See Amendment 0002 for the revised Attachment 1 “RFQ ATTACH 1 DEA MRO Requirements 20170928” which includes “C” in the dropdown.

3. I’m reviewing Amendment 2, just want to confirm the due date extension of November 3, 2017 10AM ET.

ANSWER: Amendment 0002 extended the due date to November 3, 2017 10AM ET.

4. I cannot locate DEA-487, Reporting Responsibilities/NonDisclosure Agreement (page 53).

Can you provide the document for review?

ANSWER: See DEA-487 Reporting Responsibilities/NonDisclosure Agreement attached (1 page).

5. The link to DEA’s Information Technology (“IT”) Rules of Behavior does not work (page 53).

Can you provide the document for review?

ANSWER: See DEA’s IT Rules of Behavior.pdf attached (18 pages).

6. Are the Mandatory Documents listed on pages 33- 35 required with our RFQ response or are they required only if selected?

ANSWER: Security requirements must be met following award to the successful offeror.

U.S. Department of Justice - Drug Enforcement Administration

REPORTING RESPONSIBILITIES/NONDISCLOSURE AGREEMENT

I. . realize that due to my current affiliation with the Drug Enforcement Administration (DEA), United States Department of Justice and as a condition of continued affiliation, I hereby declare that I intend to be governed by and will comply with the following provisions:

(I) That I am hereby advised and I understand that Federal Law such as Title 18, United States Code, Sections 793, 794 and 798: Order of the President of the United States (Executive Order 12356),; and regulations issued by the Attorney General of the United States (28 Code of Federal Regulations, Sections 16:40 thru lo:58 and Sections 17.110 thru 17.130); and the DEA Planning and Inspection Manual prohibit loss, misuse, or unauthorized disclosure or production of national security information, other classified information and other sensitive nonclassified information in the files of the DEA. I also understand that the Privacy Act of 1974, Title 5, United States Code, Section 552a, prohibits the unauthorized, wit lful disclosure of individually identifiable information contained in the records of a Federal agency.

(2) I understand that it is my responsibility to report any information requested of me, in other than an official capacity, immediately to my supervisor, whether it is information described as sensitive or classified. I realize this is to include information requested by any family member (by either blood or marriage), or any member of the general public who approaches me many manner, whether directly or indirectly.

(3) I understand that unauthorized disclosure of information in files of the DEA or information I may acquire as an emrloyee of tne DEA could result in the impainnent of national security, place human life in jeopardy, or result in the denia of "due process'.' rC! .a person or persons who are targets of investigations, or prevent the DEA from effectively discharging its respons1b1 ht1es.

(4) I agree that I will never divulge, publish, or reveal either by word or conduct or by other means disclose to any unauthorized recipient, unless I have been officially notified with U.S. Government certifications, any information, material or files acquired as part of the performance of my official duties or because of my official status wliere any such divulgence, publication, revelation or disclosure would be contrary to law, regulation or public policy.

(5) I agree that all information acquired by me in connection with my official duties with the DEA and all official material to which l will have access to by signing this Agreement, is now and will forever remain the property of the U.S. Government, and I will surrender upon demancfby the Administrator of the DEA or his delegate, or upon the conclusion ofmy employment or other relationship with the DEA, any material relating to such information or property m my possession.

(6) That I understand unauthorized disclosure could be a violation of Federal law and subject to prosecution as a criminal offense and in addition to this.Agreement may be enforced by rr.iean~ ofan il)junction or other civil rei:nedy. I underst<;1n.d thar if I cause any unauthorized d1scfosure of Department of Justice mformat1on, I may also be subJect to an admm1strat1ve disciplinary adverse action against me up to and including dismissal from government service.

I accept the above provisions as conditions for my affiliation and continued affiliation in the DEA. I agree to comply with these provisions both during my tenure in the DEA and following termination of such tenure.

(Type or Print Name) (Signature) (Date)

Witnessed and accepted in behalfofthe Administrator, DEA, on by (Signature)

FORM DEA-487 (4-89)

PRIVACY ACT STATEMENT

General: J he 1ntormatLOn 1s ('.2rov1ded_pursuant to 1-'ubllc Law 93-579 11-'rivacv Act ot 197A l, tor.LJl::A e.m.o1ovees comolet1ng rorms regara1ng t-eaeral National Security lnformat1orr clearance Periodic Kernvest1gat1ons.

~1B~~h~:

~c%'\rf· E.O. 12356, 5 use 1303-1305, 42 use 2165 and 2455; 22 use 2585 and euroose a; Uses· PnmanJy Joe.DEA internal use and 1s mandatorv 1n accordance with the FederaJ Personnel nua!,_ Ctiaoter 7:S6, ::;ection 1 - r, wh1cfi pertains to re1nvest1gat1ons or incumbents holding cnt1ca1-sens1 1ve pvs1t1ons.

Effect: tallure to orov1de the necessary 1ntormat1on could preclude employee's continued su1tab1l1ty to t\ola a critica1-sens1t1ve position.

Drug Enforcement Administration

Information Technology

Rules of Behavior

December 2015

Version 2.0

DEA IT Rules of Behavior v2.0

Title Page

Document Name:

Original Publication Date:

Modification Date:

Prepared by:

Approved by:

Drug Enforcement Administration Information Technology Rules of Behavior

September 2008

December 2015

Policy and Compliance Unit Information Security Section Office of Security Programs

December 2015

\.i5,20lb

Information Security Section Office of Security Pro rams

Date

Sean Vereault Date Deputy Chief Inspector Office of Security Programs

'IL~ - 2-'2'201~

Dennis R. McCrary Date Deputy Assistant Administrator Office of Information Systems (SI)

DEA IT Rules of Behavior v2.0 December 2015

Change Control

Date Name Page Section Description of Change

11-30-15 C. Corson all all This version supersedes and replaces DEA IT Rules of Behavior v 1.3

Table of Contents I. Introduction

Who is covered by these rules?

What are the penalties/or noncompliance?

II. User Responsibilities

A. General

B. Classified Systems/Information

C. Passwords

D. Hardware

E. Software

F. E-mail Use

G. Mobile Computing and Remote Access

H. Virtual Conferencing

I. Traveling Users

J. Personally Identifiable Information

III. Statement of Acknowledgement

APPENDIX A - Acronyms

APPEND IX B - References ....................................................................................................... 1 7

I. Introduction

These Rules of Behavior (ROB) pertain to the use, security, and acceptable level ofrisk for Drug Enforcement Administration (DEA) systems and applications. These rules emphasize personal responsibility for the use of DEA's information technology (IT) systems as an essential function of employment. As a user of the DEA IT data and systems, you are the first line of defense in support ofDEA's IT security.

The intent of the ROB is to acknowledge users' receipt and understanding of applicable IT security requirements from various Federal, Department of Justice (DOJ), and DEA policies and procedures. These requirements include, but are not limited to, the references cited in Appendix B.

Who is covered by these rules?

These rules apply to all DEA employees, contractors, deputized state and local law enforcement officers, cross-designated federal law enforcement officers, and others who have access to information and user or privileged accounts on DEA IT systems, information, or provide IT services to DEA-hereafter referred to as "users." A Privileged User is any user that is authorized (and therefore, trusted) to perform security-relevant functions that ordinary users are not authorized to perform. All users are required to review and provide signature or electronic verification acknowledging understanding of these rules.

Mobile devices used for undercover work are excluded from these rules.

Exemptions to the ROB may only be granted by the DEA Chief Information Officer (CIO) or his/her designee, except as otherwise noted in a specific provision.

What are the penalties for noncompliance?

Non-compliance with requirements will be enforced through sanctions commensurate with the infraction. Actions may include a verbal or written warning, temporary suspension of system access or permanent revocation, reassignment to other duties, termination, or civil and criminal penalties, depending on the severity and nature of the violation. In addition, activities that lead to or cause disclosure of classified information may result in criminal prosecution under U.S.

Code, Title 18, Section 798, and other applicable statutes.

Users will be held responsible for the compromise of Government information through negligence or a willful act.

II. User Responsibilities

A. General

1. Comply with all Federal laws and DEA policies and requirements, including DOJ Orders and Standards. Use DEA information, IT systems, and mobile devices for lawful, official use, and authorized purposes only. See Appendix B.

2. Ensure that individuals have the proper clearance, authorization, and need-to-know before providing access to any DEA information or National Security Information (NSI).

3. Read and accept the DEA security warning banner that appears prior to logging onto to IT systems or mobile devices.

4. Consent to the monitoring and search of any IT equipment or mobile device that is brought into, networked to, or removed from DEA owned, controlled, or leased facilities consistent with employee and contractor consent obtained through log-on banners and

DEA policies.

5. Screen-lock or log off your computer when leaving the work area.

6. Remove his/her Personal Identity Verification (PIV) card from workstation when unattended.

7. Prevent viewing by unauthorized personnel to information displayed on monitors or mobile devices at all times.

8. Keep your PIV Card on your person when not in use.

9. Do not generate, view, download, store, copy, or transmit offensive, threatening, harassing, or inappropriate information in any medium, to include e-mail messages, documents, images, videos, and sound files (e.g., graphic violence, pornography, hateful language, etc.).

10. Do not attempt to bypass the DEA security controls designed to protect systems from malicious Internet sites.

11. Do not use Peer-to-Peer (P2P) technology (e.g., Skype, BitTorrent) on the Internet unless the DEA CIO or his/her designee approves a waiver from this rule.

12. Do not post DEA information on cloud-based services that do not have a DEA Authority to Operate approved by the DEA CIO.

13. Do not post DEA information for official business on public websites or social media unless explicitly authorized for your official duties (e.g., Public Affairs Office).

14. Do not post DEA information on social media or public websites that allows unauthorized users to infer or obtain non-public information (e.g., system account information, personal identifiable information (PII), project status, etc.).

15. Protect and safeguard all DEA information commensurate with the sensitivity and value of the data at risk, including encrypting or password-protecting all PII being sent to third parties.

16. Protect and safeguard all DEA information and information systems from unauthorized access; unauthorized or inadvertent modification, disclosure, damage, destruction, loss, theft; and improper sanitization or use.

17. Ensure that all DEA data on authorized removable media (e.g., thumb drives, removable hard drives, and CD/DVD), laptops, tablets, and mobile devices (e.g., smartphones and netbooks) are encrypted in accordance with the guidelines in the DEA Removable Media

Policy. For classified environments, follow the procedures required for those networks for data storage and transport.

18. Report any anomalous or unusual behavior, and discovered or suspected security incidents to your Supervisor and the DEA Service Desk at

DEA.Service.Desk@dea.usdoj.gov or 202-307-4357.

19. Ensure that you complete any required training in accordance with current DOJ and DEA policies and requirements.

20. Do not conduct illegal activities or soliciting for personal gain.

21. Do not engage in partisan political activity (Hatch Act).

22. Do not engage in deliberate activities that overload network resources (e.g., downloading music or video files). Network bandwidth consumption caused by such downloads may inhibit or prohibit service to other users.

23. Do not access, store, process, display, distribute, transmit, or view material encouraging criminal activity, or violation or local, state, Federal, national, or international law or that is abusive, harassing, defamatory, vulgar, profane; that promotes hate crimes, or is otherwise not suitable for work.

24. Do not use DEA network resources for personal financial gain such as advertising or solicitation of services or sale of personal property (e.g., eBay). This does not prohibit the use of a local intranet for bulletin boards.

25. Do not use DEA Internet to access related to gambling, wager, or place any bets on inappropriate web sites.

B. Classified Systems/Information

26. Do not take portable electronic devices (e.g., smart watches, fitbits, laptops, mobile devices, and removable media except CD-R for music) into Sensitive Compartmented

Information Facilities, Open Storage Areas, or areas where classified information processing is authorized unless specifically approved to do so by the Office of Security

Programs (IS).

27. Properly mark and label classified and sensitive documents, electronic equipment, and media.

28. Do not process classified information on an unclassified system or unclassified mobile device.

29. Send classified e-mail only on systems authorized for that purpose and for the highest level of the classified data involved.

30. When in use, operate IT systems only in those areas or facilities certified for the highest classification or sensitivity level of the information involved. When not in use, store classified items in an approved security container or in a facility or room approved for open storage.

31. Only use classified removable media upon approval and after receiving training. Only use it to move data across security domains when an approved Cross-Domain solution is not available and authorization has been given.

C. Passwords

32. Supervisors must validate user IT account access for users under their direction.

33. Change the password initially assigned by the vendor upon notification from a system administrator.

34. Do not share account user IDs, passwords, or Personal Identification Number (PIN) for

PIV card with anyone.

35. Avoid using the same password across different DEA IT systems or applications.

36. Compromised passwords or those suspected of being compromised must be changed immediately and reported to the DEA Service Desk at

DEA.Service.Desk@dea.usdoj.gov or 202-307-4357.

37. Report any attempt to obtain your password to the DEA Service Desk.

38. Passwords must be protected commensurate with the level of information they provide access to and must be stored in a manner that precludes access to others.

D. Hardware

39. Do not add, modify, or remove hardware, or connect unauthorized accessories or communications connections to DEA IT resources unless specifically authorized.

40. Do not access the internal components of the computer, or remove the computer or its hard drive from DEA facilities, unless specifically authorized.

41. Official DEA business, including undercover work, must be conducted using

Government Furnished Equipment (GFE) (e.g., laptop, tablet, smartphone), unless authorized in advance by the DEA CIO, Special Agent in Charge, or Regional Director.

42. There is no expectation of privacy in maintaining any personal information, data, or applications on devices.

E. Software

43. Do not copy or distribute intellectual property without permission or license from the copyright owner (e.g., music, software, documentation, and other copyrighted materials).

44. Use DEA-licensed and/or authorized software only.

45. Do not install or update any software unless specifically authorized by the system owner. Submit requests for system changes through the DEA Service Desk at

DEA.Service.Desk@dea.usdoj.gov or 202-307-4357.

46. Do not attempt to access any electronic audit trails that may exist on the computer unless specifically authorized.

4 7. Do not change any configurations or settings of the operating system and security-related software, or circumvent and test the security controls of the system unless authorized through the documented configuration management procedures.

48. Do not knowingly write code, compile, store, transmit, or transfer unauthorized software code, Trojan horse programs, or malicious software code, to include viruses, logic bombs, worms, and macro viruses into any DEA information system.

F. E-mail Use

49. Limit distribution of e-mail to only those with a "'need to know."

50. Do not open e-mails from suspicious sources (e.g., people you do not recognize, know, or normally communicate with) and do not visit untrusted or inappropriate websites (unless authorized). Only download permissible files from known and reliable sources and use virus-checking procedures prior to file use.

51. Do not auto forward e-mails from your DEA email account to or through a non-DEA e mail system (e.g., Gmail, Yahoo, Outlook.com).

52. DEA e-mail systems and DEA e-mail addresses shall not be used to establish or register non-business accounts with web sites to included social media, dating, gambling, e commerce, news feeds, biogs, etc.

53. Although DEA government e-mail shall be used for job-related purposes, limited personal use is permitted, provided such use does not interfere with job performance, incur additional costs to the government, or violate established policy.

54. Do not knowingly distribute chain letters, extremist or terrorist material advocating the violent overthrow of the government and/or material or jokes that demean or ridicule others.

G. Mobile Computing and Remote Access

55. Use mobile GFE (e.g., laptop, tablet, smartphone) only for official business and authorized use. Mobile GFE is for use by DEA personnel only and shall only connect to DEA/DOJ networks through an approved DEA remote access method.

56. Keep all GFE mobile devices assigned to you in your physical presence whenever possible. Secure all of your portable electronic devices and removable media, preferably out-of-sight (e.g., in a locked container) when you are away from the device.

57. Do not bypass native mobile device operating system controls to gain increased privileges (e.g., jail breaking or rooting the device).

58. Only download and/or install applications and software authorized by the Office of Information Systems (SI) for mobile GFE on DEA devices.

59. Only install DEA-provided removable media, including memory (such as SD cards) and subscriber identity module (SIM) cards, on mobile GFE.

60. Immediately report lost or stolen devices (e.g., laptop, phone, tablet, thumb drive) to your supervisor and the DEA Service Desk at DEA.ServiceDesk@dea.usdoj.gov or 202- 307-4357.

61. Do not associate a personal gin or credit card with a government app store account (e.g., iTunes or Google Play). Authorized mobile application purchases should be made by the appropriate contracting officer or official designee (e.g., government purchase card holder).

62. Unless explicitly authorized by the DEA CIO, follow these rules for mobile devices:

a. Do not use Short Message Service (SMS) (texting) to conduct official government business.

b. Do not connect non-DEA mobile devices and/or accessories to DEA networks, including wireless access.

c. Do not enable mobile device tethering via Bluetooth, Universal Serial Bus (USB), or wireless hotspots on mobile GFE. If authorized, do not tether between GFE and non

GFE devices.

d. Do not use unapproved cloud-based services (e.g., DropBox and iCloud) on mobile

GFE or to transfer DEA data.

e. Do not connect mobile GFE to non-DEA IT systems, to include personal computers.

Mobile GFE should only be charged via connection to a power outlet or DEA IT system.

63. Follow DEA's telework guidelines when working remotely and/or accessing DEA information remotely.

64. Ensure the confidentiality of government information when using remote access (e.g., Firebird Anywhere (FBA), Secure Notebook Solution) from a non-GFE client (public or private). This includes the following:

a. Maintain a reasonable security posture on non-GFE registered/watermarked devices and computers (e.g., updated antivirus, local firewall, updated Operating System

(OS) and software patch levels).

b. When downloading attachments or files to registered non-GFE private computers, immediately remove any extraneous attachments, encrypt them locally, or transfer them to an approved encrypted USB drive.

c. Delete attachments and files when finished on registered non-GFE private computers.

d. Do not download attachments or files on unregistered non-GFE public computers.

e. Do not print e-mails in public areas and with public non-GFE printers. Users may print with non-GFE private printers at home.

H. Virtual Conferencing

65. Hosts and presenters must provide participants with advance notice if the virtual conference session is being recorded.

66. Limit presentation information to only that which is authorized for dissemination.

I. Traveling Users

67. Adhere to DOJ requirements and recommendations, when possible, regarding foreign travel and mobile devices (e.g., laptop, tablet, or smartphone) in the DOJ Mobile Device

Foreign Travel Security Policy Instruction. You must obtain approval to take any DEA-issued mobile device to a foreign country from the DEA Deputy Assistant

Administrator, SI.

68. Minimize the information on your mobile device to what is required to perform a particular mission while traveling and destroy copies of sensitive data when no longer needed.

69. Remove the battery from mobile devices when not in use or no longer needed. If the IT device is needed but not the associated network capability, turn off/disable the network/wireless network functionality.

70. Assume all communications (including cellular services) are being intercepted and read when in a foreign country.

71. Keep your remote access token separate from the laptop/tablet (preferably on your person) when possible.

J. Personally Identifiable Information

72. Personally Identifiable Information (PII) is information that can be used alone or combined with other information that can distinguish or trace an individual's identity such as a name, social security number, biometric records, the date and place of birth, mother's maiden name, address, etc. PII as used here means PII on DEA IT systems that a user obtains as a function of her/his DEA official duties.

73. Destroy PII data within 90 days of receipt unless its use is still required.

74. Although all DEA data should be safeguarded, take extra precautions to safeguard against breaches of information involving PII.

75. If you are given explicit authorization to access, maintain, store, or transmit PII, ensure you meet required security controls.

76. Disclose PII in accordance with appropriate legal authorities and the Privacy Act of

1974.

77. Dispose of and retain records in accordance with applicable record schedules, National

Archives and Records Administration guidelines and DEA/DOJ Policies.

78. Do not perform unauthorized querying, review, inspection, or disclosure of Federal

Taxpayer Information.

79. Encrypt PII with a DOJ-authorized encryption tool when transmitting PII by e-mail outside of DOJ. Only collect, maintain, use and disclose PII for authorized DEA purpose.

80. Immediately report all breaches of information involving PII to your supervisor and the

DEA Service Desk. A breach is any situation in which a person other than an authorized user obtains access to PII, for example: loss of electronic devices or media containing PII, sending PII via email to unauthorized recipients, sending it in an unencrypted format outside DOJ, posting PII on public websites, system intrusion/hacking.

K. Privileged Users

81. Adhere to Separation of Duties principles. A void conflict of interest in responsibilities, roles, and functions within a system or application to minimize risks associated with the privileged account (e.g., duties of the System Administrator and Information System

Security Officer (ISSO) should not be combined).

82. Privileged users must maintain a standard user account for performing daily administrative functions such as preparing e-mails, writing or reviewing documentation, and accessing DEA IT applications. Accounts with elevated privileges may only be used for activities or functions that require the use of higher privileges such as troubleshooting, system integration, account management, or security. When the activity or function can be completed with lesser privileges, users must use a standard user account.

83. At no time may privileged users modify system audit policy, circumvent audit mechanisms, or tamper with audit logs.

84. While troubleshooting system problems, privileged users may not access another user's personal directory, e-mail, or files without authorization from the user or the Information

Security Section (ISI).

85. Do not access a virtual conference presentation using a privileged user account.

86. Privileged users may not log onto DEA IT systems using a service account, system account, or other user's account or personal directory, e-mail, or files without first obtaining authorization from the DEA CIO or designee, or the Deputy Chief Inspector

(DCI) IS, or designee. Privileged users may not elevate the permissions of their standard user account or another user's account without appropriate authorization from the DEA CIO or designee, or the DCI, IS, or designee.

87. Comply with appropriate system security policies, guidelines, and procedures (DOJ

Order 2640.2(series), DOJ Order 2740.l(series), and the DOJ IT Security Standard).

88. Do not grant read and/or write authority that is higher than is granted to you (e.g., a Regional level user administrator shall not assign Enterprise level access to another user administrator).

89. Do not make modifications to classified or unclassified system configurations without the approval of the DEA Configuration Control Board (CCB) and DEA System Owner

(SO), or as delegated by the SO in accordance with DOJ and DEA policies and procedures.

90. Do not share accounts with another privileged or general user.

91. Make changes to system configuration as directed by the SO to meet Vulnerability and

Patch Management requirements in accordance with existing DOJ and DEA policies and procedures.

92. Immediately record and report any security incidents or loss of PII to the DEA Service

Desk at DEA.Service.Desk@dea.usdoj.gov or 202-307-4357. Ensure that a log is kept of events following incident discovery and maintain proper chain of custody of any evidence collected in accordance with DEA policies and procedures.

93. Change the password on privileged user accounts every ninety (90) days or as required.

94. Submit to additional investigation and monitoring of privileged user activities as required to ensure the integrity of privileged user accounts.

95. Do not monitor another user's account or system files without direction by the DEA

CIO.

96. Ensure that only DEA-approved removable media are used on DEA equipment.

97. Do not alter/change/delete system logs outside of the normal CCB/Configuration

Management process.

98. Do not install or use software that has not been authorized through the system's CCB process.

99. Do not obtain, install, copy, transfer, or use software or other materials obtained in violation of the appropriate vendor's patent, copyright, trade secret, or license agreement.

100. Do not knowingly write code, compile, store, transmit, or transfer malicious software code, to include viruses, logic bombs, worms, and macro viruses.

101. Limit the use of vulnerability scanning tools for their intended purposes and only after proper coordination with and approval by the responsible Information System Owner

(ISO) and/or the Information System Security Manager (ISSM)/ISSO.

102. Do not attempt to run ·'sniffer" or hacker-related tools on any information system unless authorized by the Authorizing Official and Information System Owner

(ISO)/ISSM/ISSO.

103. Immediately report any indication of computer network intrusion, unexplained degradation or interruption of network services, or the actual or possible compromise of data file access controls to the appropriate ISO and/or ISSM/ISSO.

III. Statement of Acknowledgement I acknowledge receipt and understand my responsibilities as identified above, and will comply with this ROB. Additionally, this acknowledgment accepts my responsibility to ensure the protection of PII that I may handle. All DEA IT systems covered by this ROB may be monitored for all lawful purposes to ensure authorized use, facilitate protection against unauthorized access, maintain the confidentiality, availability, and integrity of DEA's information and for system management. Monitoring may be conducted for any legitimate purpose. During monitoring, information may be examined, recorded, copied, and used for authorized purposes. All information, including personal information stored on, or transmitted over DEA IT systems, may be monitored. I understand that my use of any DEA IT system or mobile GFE constitutes consent to disclosure of information in addition to monitoring.

Signature Date

Printed Name Office or Division

Note: Statement of acknowledgement may be made by signature if this ROB is reviewed in hard copy or by electronic acknowledgement if reviewed online. All users are required to review and provide their signature or electronic verification acknowledging compliance with these rules. !('you have questions related to this ROB, please contact the Information Security Help Desk at JSIHelpdesk@dea.usdoj.gov, your Security Offzcer, or Supervisor.

DEA has the right, reserved or otherwise, to update this ROB to ensure it remains compliant with all applicable laws, regulations, and DO.! Standards. Updates to this ROB will be communicated through JS.

APPENDIX A - Acronyms

AO

CCB

CD

CD-R

CIO

DEA

DOJ

DVD

E-mail

FBA

GFE

ID

ISI

ISO

ISSM

ISSO

IT

ITSS

NSI

OS

PIN

P2P

PII

PIV Card

ROB

SCIF

SD

SI

SIM

SMS

so

Authorizing Official

Configuration Control Board

Compact Disk

Compact Disk-Read Only

Chief Information Officer

Drug Enforcement Administration

Department of Justice

Digital Versatile Disk

Electronic Mail

Firebird Anywhere

Government Furnished Equipment

Identification

Information Security Section

Information System Owner

Information System Security Manager

Information System Security Officer

Information Technology

IT Security Standard

National Security Information

Operating System

Personal Identification Number

Peer-to-Peer

Personally Identifiable Information

Personal Identity Verification

Rules of Behavior

Sensitive Compartmented Information Facility

Secure Digital

Office of Information Systems

Subscriber Identity Module

Short Message Service

System Owner

U.S.

USB

United States

Universal Serial Bus

APPENDIX B - References

Drug Enforcement Administration [DEA]. (April 27, 2010). Computer Incident Response Plan (Version 5.5).

DEA Headquarters Cable. (2008). Interim Policy Pending Revision of DEA 's Information Technology Rules of Behavior Regarding Lost/Stolen/Missing DEA Owned Laptop Computer by all DEA Personnel, Task Force Officers, and Contractors (191905Z).

DEA. (September 21, 2015). Proper Use of DEA Email Systems and Data.

DEA. Planning and Inspection Manual, Document Security (Chapter 86).

DEA. (July 2012). Removable Media Policy.

DEA. (March 3, 2013). Security Classification Guide, Revision 2.

DEA (2005). Special Purpose Systems Security Policy. (Version 2.4).

Department of Justice [DOJ]. (March 24, 2014). Guidance on the Personal Use of Social Media by Department Employees.

DOJ. (2014). Information Technology Resources Outside U.S. Territory Waiver Request.

DOJ. (January 2015). Information Technology (IT) Security Rules o.f Behavior (ROB) for General Users.

DOJ Order 2640.2F. (November 2008). Information Technology Security.

DOJ. (March 2011 ). Information Technology Security Standard (Version 1.4).

DOJ. (July 2015). Mobile Device and Mobile Application Security Policy Instruction (Version 5).

DOJ Order 0801. (March 2014). Records Management.

DOJ. (April 2011 ). Removable Media Requirements for Class(fied Systems.

DOJ. (September 2015). Secure Communications Security Instruction (Version 1.0).

DOJ. (2010). Security Program Operating Manual (Version 3.0).

DOJ Order 2740. lA. (November 2010). Use and Monitoring o,/DOJ Computers and Computer

Systems.

Intelligence Community Directive 503. (2008). Intelligence Community Information Technology Systems Security Risk Management, Certification and Accreditation.

Office of Management and Budget Circular A-130. (2000). Management of Federal Information Resources (Appendix III).