Exhibit C3_Acceptable Use Policy (AUP).pdf

Domain & Directory Systems Branch Acceptable Use Policy

1 October 2019 UNCLASSIFIED/FOUO 1

ACCEPTABLE USE POLICY

DOD STANDARD MANDATORY NOTICE AND CONSENT

By signing this document, you acknowledge and consent that when you access Department of Defense (DOD) information systems:

1. You are accessing a U.S. Government (USG) information system (IS) (which includes any device attached to this information system) that is provided for U.S. Government authorized use only.

2. You consent to the following conditions:

a. The U.S. Government routinely intercepts and monitors communications on this information system for purposes including, but not limited to, penetration testing, communications security (COMSEC) monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.

b. At any time, the U.S. Government may inspect and seize data stored on this information system.

c. Communications using, or data stored on, this information system are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any U.S.

Government-authorized purpose.

d. This information system includes security measures (e.g., authentication and access controls) to protect U.S. Government interests, not for your personal benefit or privacy.

e. Notwithstanding the above, using an information system does not constitute consent to personnel misconduct, law enforcement, or counterintelligence investigative searching or monitoring of the content of privileged communications or data (including work product) that are related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Under these circumstances, such communications and work product are private and confidential, as further explained below:

(1) Nothing in this User Agreement shall be interpreted to limit the user's consent to, or in any other way restrict or affect, any U.S. Government actions for purposes of network administration, operation, protection, or defense, or for communications security. This includes all communications and data on an information system, regardless of any applicable privilege or confidentiality.

(2) The user consents to interception/capture and seizure of ALL communications and data for any authorized purpose (including personnel misconduct, law enforcement, or counterintelligence investigation). However, consent to interception/capture or seizure of communications and data is not consent to the use of privileged communications or data for personnel misconduct, law enforcement, or counterintelligence investigation against any party and does not negate any applicable privilege or confidentiality that otherwise applies.

(3) Whether any particular communication or data qualifies for the protection of a privilege, or is covered by a duty of confidentiality; is determined IAW established legal standards and DOD policy. Users are strongly encouraged to seek personal legal counsel on such

1 October 2019 UNCLASSIFIED/FOUO 2 matters prior to using an information system if the user intends to rely on the protections of a privilege or confidentiality.

(4) Users should take reasonable steps to identify such communications or data that the user asserts are protected by any such privilege or confidentiality. However, the user's identification or assertion of a privilege or confidentiality is not sufficient to create such protection where none exists under established legal standards and DOD policy.

(5) A user's failure to take reasonable steps to identify such communications or data as privileged or confidential does not waive the privilege or confidentiality if such protections otherwise exist under established legal standards and DOD policy. However, in such cases the U.S. Government is authorized to take reasonable actions to identify such communication or data as being subject to a privilege or confidentiality, and such actions do not negate any applicable privilege or confidentiality.

(6) These conditions preserve the confidentiality of the communication or data, and the legal protections regarding the use and disclosure of privileged information, and thus such communications and data are private and confidential. Further, the U.S.

Government shall take all reasonable measures to protect the content of captured/seized privileged communications and data to ensure they are appropriately protected.

f. In cases when the user has consented to content searching or monitoring of communications or data for personnel misconduct, law enforcement, or counterintelligence investigative searching, (i.e., for all communications and data other than privileged communications or data that are related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants), the U.S. Government may, solely at its discretion and IAW DOD policy, elect to apply a privilege or other restriction on the U.S. Government's otherwise-authorized use or disclosure of such information.

g. All of the above conditions apply regardless of whether the access or use of an information system includes the display of a Notice and Consent Banner ("banner"). When a banner is used, the banner functions to remind the user of the conditions that are set forth in this User Agreement, regardless of whether the banner describes these conditions in full detail or provide a summary of such conditions, and regardless of whether the banner expressly references this User Agreement.

1 October 2019 UNCLASSIFIED/FOUO 3

1. Understanding:

I understand that I have the primary responsibility to safeguard the Information contained on the classified and/or unclassified network from unauthorized or inadvertent modification, disclosure, destruction, denial of service, and use.

2. Access:

Access to this organization’s network(s) and Information Systems (IS) is for official use and authorized purposes and as set forth in DOD 5500.7-R, "Joint Ethics Regulation" or as further limited by this policy.

3. Revocability:

Access to DHA resources is a revocable privilege and is subject to disciplinary action.

4. Classified Information Processing:

The classified network and IS is a US-only system and approved to process classified collateral information.

a. The classified network provides communication to external DOD organizations using the SIPRNET. Primarily this is done via electronic mail and internet networking protocols such as web, ftp, and telnet.

b. The classified network is authorized for SECRET or lower-level processing IAW accreditation package held at this organization.

c. The classification boundary between classified network and unclassified network requires vigilance and attention by all users. The classified network is also a US-only system and not accredited for transmission of NATO material.

d. The ultimate responsibility for ensuring the protection of information lies with the user. The release of TOP SECRET information through the classified network is a security violation and will be investigated and handled as a security violation or as a criminal offense.

5. Unclassified Information Processing:

The Unclassified Network is the primary unclassified automated administration tool for this organization. The unclassified network is a US-only system.

a. The unclassified network provides unclassified communication to external DOD and other United States Government organizations. Primarily this is done via electronic mail and internet networking protocols such as web, ftp, telnet.

b. The unclassified network is approved to process UNCLASSIFIED, SENSITIVE information IAW local regulations dealing with automated information system security management programs.

1 October 2019 UNCLASSIFIED/FOUO 4

c. The unclassified network and the Internet, as viewed by this organization are synonymous. Email and attachments are vulnerable to interception as they traverse the NIPRNET and Internet.

6. Rule of Behavior:

As a Classified Network and/or Unclassified system user, the following minimum security rules and requirements apply:

a. Personnel are not permitted access to the Classified Network and the Unclassified Network unless in complete compliance with this organization’s personnel security requirement for operating in a SECRET system-high environment.

b. I have completed the current DoD Cyber Awareness Challenge and DHA HIPAA and Privacy Act Training, and will retake this training annually, as well as any other training as required.

c. I will protect my Common Access Card (CAC) and PIN at all times and I will not share my system access credentials with others.

d. I will use only authorized hardware and software. I will not install or use any personally owned hardware, software, shareware, or public domain software.

e. I will not connect any external device to the government system or network, such as USB thumb drives, flash memory cards, personal or government-issued cell phones, external hard drives or CD devices, etc. unless specifically authorized by a Data Loss Prevention (DLP) exclusion waiver signed by my supervisor and approved by the Information Systems Security Officer (ISSO).

f. I will use virus-checking procedures before uploading or accessing information from any system or attachment.

g. I will not attempt to access or process data exceeding the authorized IS classification level.

h. I will not alter, change, configure, or use operating systems or programs, except as specifically authorized.

i. I will not introduce executable code (such as, but not limited to, .exe, .com, .vbs, or .bat files) without authorization, nor will I write malicious code.

j. I will safeguard and mark with the appropriate classification level all information created, copied, stored, disseminated or transmitted from the IS and will not disseminate it to anyone without a specific need to know.

k. I will not utilize DHA- or DOD-provided ISs for commercial financial gain or illegal activities.

l. I will not embed unencrypted static authenticators in access scripts or applications nor will I

1 October 2019 UNCLASSIFIED/FOUO 5 store them in function keys.

m. Maintenance will be performed by the System Administrator (SA) only.

n. I will remove my CAC and lock the workstation whenever departing the area. When leaving for the day, I will log out of the workstation and leave it on and connected to the network to be available for patching.

o. I will immediately report any suspicious output, files, shortcuts, or system problems to the Organization’s Global Service Center (GSC) and/or ISSO and cease all activities on the system.

p. I will address any questions regarding policy, responsibilities, and duties to the organization’s ISSO and/or ISSM.

q. I understand that each IS belongs to and is the property of DHA and is provided to me for official and authorized uses. I further understand that each IS may be monitored for security purposes to ensure that use is authorized. I understand that I do not have a recognized expectation of privacy in official data on the IS and may have only a limited expectation of privacy in personal data on the IS. I realize that I should not store data on the IS that I do not want others to see.

r. I understand that monitoring of Classified Network and Unclassified Network will be conducted for various purposes and information captured during monitoring may be used for administrative or disciplinary actions or for criminal prosecution.

7. Wireless / Remote Access:

As an IS user, the following rules and requirements apply when using your government issued device either connected wirelessly within government facilities or when travelling and/or teleworking:

a. Wireless Access: Wireless authentication is done with the users CAC certificate tied to their Active Directory account. The user and machine are added to Active Directory groups that allow wireless access. Wireless access is approved by the ISSO who must submit a request to have wireless access enabled for a user account and machine. Users have the capability of managing their wireless network connections and connecting to a wireless network when not on the installation.

b. Remote Access: Remote access will be via virtual private network (VPN).

Government owned hardware and software will be used. The employee is the only individual authorized to use this equipment. Access will be as authorized by the supervisor. Requirements as indicated throughout this AUP are applicable for access to USG resources.

c. Device Security: Users of mobile computing devices (laptops, portable notebooks, tablet-PCs, and similar systems) are tasked with the physical security of these mobile devices while administrators must protect the IS from compromise when used as a standalone system or when remotely connected.

1 October 2019 UNCLASSIFIED/FOUO 6

8. PROHIBITED USE:

I understand that DHA IS may not be used to support the following unauthorized activities:

a. Soliciting business, advertising, or engaging in other selling activities in support of private business enterprises or outside employment

b. Fundraising activities not sanctioned by DHA

c. Endorsing any product or service, participating in any lobbying activity, or engaging in any prohibited partisan political activity, including campaign fundraising

d. Use of a DHA network as a staging ground or platform to gain unauthorized access to other systems

e. Attempting to circumvent, disable, or compromise DHA security features and authentication measures

f. Accessing, creating, downloading, viewing, storing, copying, or transmitting materials related to illegal gambling, illegal weapons, and/or any other prohibited or illegal activities

g. Accessing, creating, downloading, viewing, storing, copying, or transmitting materials related to terrorist activities, sexually oriented, or racist materials

h. Participating in “spamming”; that is, exploiting list servers or similar group broadcast systems for purposes beyond their intended scope to provide widespread distribution of unsolicited e-mail

i. Participating in “letter-bombing”; that is, sending the same e-mail repeatedly to one or more recipients to interfere with the recipient’s use of e-mail

j. Downloading shareware/freeware software, malicious code, or executable programs (e.g., .EXE, .COM, .BAT, or script.INI files). (Note: Usage of Network File System open-source software is permitted with a risk assessment and AO/AODR approval)

k. Creating, copying, or transmitting chain letters or other unauthorized mailings regardless of the subject matter

l. Using the system for personal financial gain, such as advertising, solicitation of services, sale of personal property (e.g., eBay), or stock trading (i.e., issuing buy, hold, and/or sell directions to an online broker)

m. Posting DHA information to external newsgroups, bulletin boards, or other public forums without authority

n. Sending, whether initiating or replying to, inappropriate messages or messages containing inappropriate language

o. Accessing sites known for hacker attacks or hacker activity

p. Opening e-mail attachments from unknown or questionable sources

q. Transmitting CUI, including PII and PHI in e-mails and via the Internet without

1 October 2019 UNCLASSIFIED/FOUO 7 ensuring appropriate security controls (e.g., use of Federal Information Processing Standards’ compliant encryption algorithms) are in place

9. AUTHORIZED USE:

I understand that DHA IS may be used for the authorized purposes of reasonable duration and frequency so as not to adversely affect the performance of official duties. Whenever possible, such use should be made during the employee’s personal time, such as after duty hours or during lunch periods:

a. E-mailing short messages to a relative or colleague

b. Accessing personal e-mail accounts.

c. Announcing DHA-related activities (e.g., office luncheons, retirement or departure events, and holiday office parties).

d. Making a medical, dental, auto repair, or similar appointment.

e. Accessing the Internet for professional development purposes.

f. Authorizing a financial transaction.

g. Reading news or professional journals.

h. Accessing personal accounts, such as Facebook, Twitter, etc.

10. REFERENCES:

Further information regarding acceptable or unacceptable activities can be found in the following additional references:

a. DHA Administrative Instruction 081, “Employee use of Information Technology”

b. DHA/HIT Rules of Behavior

c. DoDI 8550.01, “DoD Internet Services and Internet-Based Capabilities”

Acknowledgement:

I have read the above requirements regarding use of this organization’s access systems. I understand my responsibilities regarding these systems and the information contained in them. I further understand that I will have to sign another AUP form when my CAC is renewed.

Name: Dir/Branch/Div:

Date: Grade/Series/Contractor:

Signature: