Attachment_10.docx

Public Health Service DEPARTMENT OF HEALTH & HUMAN SERVICES Food and Drug Administration Center for Devices and Radiological Health Office of In Vitro Diagnostics and Radiological Health Division of Mammography Quality Standards Information Management Branch

Rules of Behavior The Mammography Program Reporting and Information System (MPRIS)

1. Introduction All users of MPRIS must follow the Rules of Behavior. The rules clearly delineate responsibilities of and expectations for all individuals with access to MPRIS. FDA will enforce non-compliance with these rules sanctions commensurate with the level of infraction.

2. Responsibilities The MPRIS Program Manager, Information Management Branch (IMB), Division of Mammography Quality Standards (DMQS), Office of In Virtro Diagnostics and Radiological Health, Center for Devices and Radiological Health (CDRH), U. S. Food and Drug Administration (FDA), Department of Health and Human Services (HHS) is responsible for ensuring that an adequate level of protection is afforded to MPRIS through an appropriate mix of technical, administrative, and managerial controls. The MPRIS Program Manager develops policies and procedures, ensures the development and presentation of user and contractor awareness sessions, and inspects to determine that an adequate level of compliance with security requirements exists. The MPRIS Program Manager is responsible for periodically conducting vulnerability analyses to help determine if security controls are adequate, giving special attention to those new and developing technologies, systems, and applications that can open or have opened vulnerabilities in this system’s security posture.

The MPRIS Program Manager is responsible for day to day implementation of generally recognized good security practices as well as specific FDA policies and procedures, as included below, in order to keep MPRIS data confidential and accurate. The Program Manager also is responsible for notifying the CDRH Information System Security Officer of any breaches to security.

3. Other Policies and Procedures The Rules of Behavior for MPRIS do not replace existing Federal policies. Rather, they enhance and further define the specific rules each user must follow while accessing MPRIS. The rules are consistent with Federal Office of Management and Budget (OMB), HHS, and FDA policies and procedures.

4. Application Rules

4.1 Remote Access. All persons remotely accessing the system must comply with FDA’s rules concerning copyrighted software.

4.2 Connection to the Internet. Users can access the Internet only in order to visit sites such as the FDA public web site.

4.3 Protection of software copyright licenses. CDRH personnel and contractors will comply with all copyrighted software licenses restrictions. End users, supervisors, and function managers are ultimately responsible for this compliance.

4.4 Authentication. MPRIS will authenticate each user. Authentication consists of a password and unique username. Remote access users must also have a password and unique username for the remote access server. In addition, user-based application rights determine which users can access an MPRIS application, which parts of the application are available for them to use, and whether they are allowed to add, insert, and delete data, or simply view the data. FDA maintains a record of all data accesses in the MPRIS database. Only persons who must access this data as part of their normal assignment will have access. You must not share your user name and password with other users.

4.5 Use of Government Equipment. The use of MQSA-furnished government equipment is restricted to official FDA business only. If FDA has assigned you an MQSA inspector laptop and/or printer, then you are responsible for securely storing your equipment during non-business hours, and for using the supplied Kensington Lock during business hours to secure your laptop.

4.6 Assignment and Limits of System Privileges. Only persons with appropriate clearances can access MPRIS data. Persons responsible for system maintenance will not modify any data elements without explicit permission from the MPRIS Program Manager.

4.7 Production and I/O Controls. Disposal of all removable or magnetic media used to store data from MPRIS must be appropriate to the media type, and must be in accordance with National Industrial Security Program Operating Manual (NISPOM) 5220.22-M (http://www.dtic.mil/whs/directives/corres/html/522022m.htm). Examples include: physical destruction (including burning, shredding, or melting); overwriting (only on functioning hard disks); and degaussing (only for magnetic media).

Reports produced by MPRIS may contain nonpublic sensitive data. You must dispose of hard copy containing FDA data by shredding when those data are no longer required.

I acknowledge receipt of, understand my responsibilities, and will comply with the Rules of Behavior for the MPRIS system.

Print Name image1.wmf