RFQ ENCL ATTCH 6 - OIT Rules of the ROAD 2024.pdf

SECURITIES AND EXCHANGE COMMISSION Rules of Behavior Office of Information Technology SSOP 24-04(a) Washington, DC 20549 January 3, 2024

Rules of Behavior (formerly known as “Rules of the Road”)

Table of Contents

Rule #1: Properly Use and Protect SEC Information Systems Rule #2: Follow Telework Guidance and other Remote Connection Guidance Rule #3: Use Email and Messaging Platforms Responsibly and Guard against Phishing Rule #4: Protect Federal Records Rule #5: Protect Your Credentials, Including Passwords and PIV Cards Rule #6: Protect Privacy and Nonpublic Information Rule #7: Use Removable Media Securely Rule #8: Don’t Text, Email, or Instant Message While Driving

INTRODUCTION

The Rules of Behavior (formerly known as the “Rules of the Road”) constitute the requirements, practices and controls governing access and use of SEC Information Systems at the U.S. Securities and Exchange Commission (“SEC” or “Agency”). These Rules of Behavior supplement SECR 2-1, “Data Access, Use, and Internal Sharing Policy,” SECR 23-2, “Safeguarding Nonpublic Information,” SECR 24-04, “Information Technology Security Program,” SECR 24-08, “Privacy Policy and Compliance,” and SECR 24-15, “Acceptable Use of SEC Information Systems.” All SEC Users must follow the Rules of Behavior when using SEC Information Systems or otherwise accessing SEC Nonpublic Information (“NPI”). A glossary with defined terms is included at the end of the Rules of Behavior. The Rules of Behavior reference other SEC policies, regulations and training, all of which are incorporated by reference. This document, SSOP 24-04(a) (“Rules of Behavior”), updates and supersedes SECOP 24-04B (“Rules of the Road”).

Upon certification that the mandatory training required for access to SEC Information Systems (currently known as the “Privacy and Information Security Awareness” training) is complete, an SEC User is presumed to have knowledge of all Rules of Behavior including any applicable consequences of non-compliance. All SEC Users will recertify on an annual basis to knowing and complying with the Rules of Behavior, and continued use of SEC Systems constitutes express agreement to abide by the terms of these Rules. All SEC Users are charged with the knowledge that failure to follow these Rules may result in a Security Incident and directly affect the Agency’s ability to perform its mission.

When using SEC Information Systems, SEC Users are subject to monitoring by the SEC Office of Information Technology (“OIT”) and law enforcement officials. Such monitoring may be used as necessary for a lawful purpose, such as in the course of an official investigation. SEC Users are reminded that there is no expectation of privacy when using SEC Information Systems and that they expressly consent to such monitoring, including retrieval and disclosure of information stored on other devices, such as hard drives or Portable Media in use (e.g., USB drives, Mobile Devices, and

Attachment 6

Washington, DC 20549 January 3, 2024

CD-ROMs). Misuse of SEC Information Systems, including but not limited to creating, seeking, transmitting, collecting, accessing, viewing, storing, uploading, or downloading of pornographic, sexually-explicit or offensive materials, may result in disciplinary action up to and including dismissal and, in some circumstances, criminal prosecution. The issuance or use of a personal password, known only to the SEC User, shall not be considered subjective or objective evidence that an expectation of privacy is warranted when using SEC Information Systems. Passwords are issued solely for the purpose of preventing unauthorized access or use of SEC systems.

Compliance by SEC Users with the Rules of Behavior is part of the SEC’s IT security program for SEC Information Systems as mandated by federal law. All exceptions to any of the Rules of Behavior must be approved by the Chief Information Officer (“CIO”) or their designee, or as otherwise provided by more specific procedures in an applicable SECR or SECOP.

Accountability and Consequences for Non-Compliance

SEC Users are on notice that violation of any of the Rules of Behavior may be considered as a basis for disciplinary action up to and including termination of employment or other status with the Agency. Additional guidance can be found in SECR 6-20, “Disciplinary and Adverse Actions,” and the Collective Bargaining Agreement as applicable.

Misuse of SEC Information Systems could also result in civil and/or criminal liability under applicable authorities, including the Computer Fraud and Abuse Act of 1986 (P.L. 99-474, 18 U.S.C. § 1030). Evidence of criminal activity or other misconduct will be provided to the SEC’s Office of Inspector General (“OIG”), which may refer the matter for criminal prosecution.

SEC Users who violate these Rules of Behavior may also be required to reimburse the Agency for any monetary damages suffered. In addition, violations or evidence of potential violations may be used as applicable in any authorized investigation, including a revocation of an SEC User’s security clearance or other approval needed to access SEC Information Systems. Contractual and other remedies may be sought against any contractor found to be in violation of the Rules of Behavior.

Reporting Security Incidents

SEC Users are obligated to report actual or suspected Security Incidents, preserve data related to Security Incidents, and assist authorized incident responders with investigations. If loss of, damage to, or unauthorized transmittal or disclosure of NPI, or another type of Security Incident, occurs or is suspected to have occurred, an SEC User must notify their supervisor and the OIT Service Desk immediately. Incidents requiring notification include, but are not limited to, the loss of SEC devices, such as laptops, Mobile Devices, and Removable Media, as well as misaddressed or accidentally sent emails or other electronic messages, such as texts and chats. The SEC User must immediately notify the OIT Service Desk in one of two ways:

• Report an incident via the askIT portal; or

• Call the Service Desk at 202-551-4357 (x1HELP).

Washington, DC 20549 January 3, 2024

The Service Desk shall notify the SEC Security Operations Center (SOC), which shall in turn make other notifications as required by the particulars of the incident.

In addition to the above reporting requirements, Staff in SEC regional offices are required to notify their Regional Office Privacy Point of Contact if there is a potential breach of Personally Identifiable Information (PII).

Suspected violations of criminal law or other misconduct related to the use of SEC Information Systems or SEC Information should be reported immediately to the SEC’s OIG hotline by calling 833-732-6441 or filing an online report with the OIG.

Exceptions

Some SEC Users may be required as part of their assigned duties to engage in activities that are otherwise prohibited by these Rules. Limited exceptions to these Rules may be authorized in the sole discretion of the CIO or their designee based upon a written request detailing why such activities are required as part of the SEC User’s assigned duties, or as otherwise provided in applicable SECRs or SECOPs.

Individual exceptions to specific components of this policy must be requested through the askIT website. Exceptions, which are based on a valid business need, may be granted on a case-by-case basis, must be consistent with federal law and policy, and are subject to periodic review and revocation as authorized by the CIO or their designee. The party seeking the exception must demonstrate that adherence to a specific requirement of the Rules of Behavior will hinder the completion of a specific mission-related activity, detrimentally impact an SEC business function, or result in a serious financial impact. For Office of Inspector General employees, exceptions concerning SMS texting, apps, and software will be made by the CIO in coordination with the Inspector General.

RULE #1 – Properly Use and Protect SEC Information Systems

Access to SEC Information Systems includes access from remote locations including locations where employees Telework in compliance with Agency Telework policies, procedures, requirements, and guidance.

As an SEC User, you have an obligation to conduct your SEC Information System activities in keeping with the SEC’s mission, goals, and objectives.

• DO use MS Teams to exchange messages with other SEC Users.

• Only software or applications that are available in the SEC App Store or otherwise were specifically approved by OIT for download may be downloaded onto SEC Mobile Devices. SEC Users are encouraged to apply for an exception if they have a specific individual need that requires the use of a non-approved app.

• DO NOT use SEC Information Systems for commercial purposes, to conduct, support, or promote any type of personal business interests, or for the personal or business interests of

Washington, DC 20549 January 3, 2024 relatives, friends, or other persons or entities. Examples of this prohibition include using SEC Information Systems in furtherance of a personal business activity such as a real estate business, consulting business, or operating an online business or “store.”

• DO NOT interfere with the administrative functions of any SEC Information System, or attempt to gain or provide unauthorized rights or privileges to SEC Information Systems.

• DO NOT use hardware, software, or cloud services on SEC Information Systems that have not been approved by OIT in accordance with SECR 24-13.

• DO NOT use SMS texting for SEC business unless an exception has been granted by OIT.

• DO NOT access AI chatbots, or submit any information into AI chatbots, in the course of conducting SEC business.

• DO NOT use SEC email addresses or SEC Information Systems to create accounts for AI chatbots.

• DO NOT use personal or non-SEC accounts to access AI chatbots to conduct official SEC business.

Limited Personal Use of SEC Information Systems:

SEC business may only be conducted on SEC Information Systems. SEC Users are permitted limited use of SEC Information Systems for personal reasons during non-work time (i.e., lunch periods, authorized breaks, or weekends and holidays), provided that:

• Such use is consistent with the “Rules of Behavior” and other established SEC regulations, policies, and procedures;

• This limited use does not disrupt or interfere with official business and involves minimal additional expense to the government; and

• SEC Users understand that any personal use of SEC systems may be accessed and reviewed by the SEC for any lawful purpose or investigation.

This privilege may be revoked or limited at any time. For more information concerning use of SEC Information Systems, please see SECR 24-15, “Acceptable Use of SEC Information Systems.”

Use of Software, Apps, and Copyrighted Material:

• Only software or applications that are available in the SEC App Store or otherwise were specifically approved by OIT for download may be downloaded onto SEC Mobile Devices. SEC Users are encouraged to apply for an exception if they have a specific individual need that requires the use of a non-approved app.

• DO NOT copy, upload, or otherwise use any commercial software on any SEC electronic medium for backup purposes unless the copyright owner (i.e., the software company) specifically grants permission in the software licensing agreement and OIT has approved such use.

• DO NOT install SEC-owned or SEC-licensed software on any non-SEC-owned computer or device, including any personal computer or device.

• DO NOT unlawfully use copyrighted and/or licensed materials, including software and digital media, on any SEC Information System.

Washington, DC 20549 January 3, 2024

• DO NOT use TikTok on government devices, per OMB Memo M-23-13.

Protect Nonpublic Information:

NPI is SEC Information that Staff or a contractor gains by reason of Federal employment or a Federal contract and that has not been made available to the general public in accordance with Section 5.2 of SECR 23-2. NPI includes, but is not limited to, SEC Information that is protected from disclosure by law or that the Commission has decided to accord confidential treatment, or any information the loss, misuse, unauthorized access or modification of which could adversely affect national interests, the conduct of SEC programs, or the privacy to which individuals are entitled under the Privacy Act. Unless SEC Information has been authorized for release outside of the SEC in accordance with SECR 23-2, SEC Information should be treated as NPI. For questions on whether particular information constitutes NPI or may be disclosed pursuant to SECR 23-2, consult with the Office of General Counsel’s Office of Litigation and Administrative Practice prior to disclosure.

• DO NOT transmit NPI outside of the SEC via email, unless you have encrypted it using the SEC’s approved procedures and technologies and the transmission complies with this SSOP and SECR 23-2. There are two options to encrypt outgoing email.

o Any outgoing email can be encrypted by entering the word “smail” (without quotation marks) into the subject line of the message (i.e., if the normal subject of your message is “Big Announcement,” the new subject line would be “smail Big Announcement”). You can get more information by following this link: SEC Internal Guide for Using the Email Encryption Solution.

o Outgoing emails between SEC and certain external organizations have an additional encryption service called Transport Layer Security (TLS). If, before sending your email, you confirm that TLS is in place for the specific recipient organization, you are not required to put “smail” in the subject line. For guidance on determining if TLS is in place, see Email Encryption Quick Guide: When to Use Transport Layer Security or Smail to Send Nonpublic Information Outside the SEC.

o You may also use Accellion to transmit NPI outside of the SEC securely. For guidance on using Accellion, see the Kiteworks (Acellion) File Transfer System site.

• DO NOT store or transmit NPI on any non-SEC System, such as your personal computer, laptop, cell phone, tablet, or thumb drive. In addition, any transmission or storage of NPI on any non-SEC cloud-based storage service such as Google Drive or similar service from Apple is expressly forbidden.

• DO NOT leave SEC-issued devices, including Portable Media, Mobile Devices, or other IT equipment containing NPI unprotected.

o Laptops must require the use of a PIV credential to activate them unless a specific device exclusion is issued by OIT.

• If a Security Incident occurs or is suspected to have occurred in connection with any Mobile

Device or Portable Media containing NPI (see below), including, but not limited to, a laptop computer or data storage device, the incident must be reported immediately in accordance with the above section entitled “Reporting Incidents.”

Washington, DC 20549 January 3, 2024

• When NPI is mailed out externally, it should be placed in a sealed envelope marked “Nonpublic,” and then placed in a second or outer unmarked envelope and sent via United States Postal Service or commercial delivery service. Information should be sent via registered mail and/or be subject to in-transit automated tracking and accountability tools.

AI chatbot tools, including ChatGPT, Google Bard, and Microsoft Bing “chat mode,” are not approved to conduct SEC business. Unless specifically authorized by OIT, SEC Staff and contractors should not:

• Access AI chatbots, or submit any information into AI chatbots, in the course of conducting

SEC business;

• Use SEC email addresses or SEC Information Systems to create accounts for AI chatbots; or

• Use personal or non-SEC accounts to access AI chatbots to conduct SEC business.

SEC NPI may NOT be processed on non-SEC Information Systems. In the event that SEC Users work with Classified Information at any time, such information will only be processed on SEC Information Systems approved for such activity. For more information concerning safeguarding NPI, refer to SECR 23-2, “Safeguarding Nonpublic Information.”

Protect SEC Information Systems:

Unless otherwise authorized by the CIO or designee:

• DO use only SEC-authorized internet browsing capabilities, e.g., Microsoft Internet Edge and Google Chrome, for accessing the internet.

• DO ask for written permission from OIT using its exception and risk acceptance process if you need to use a blocked service.

• DO use Login.gov, which offers two-factor authentication, to access various programs pertaining to your official duties at the SEC, including the Quicktime Time & Attendance System, Employee Express, and Electronic Official Personnel Folder.

• DO use PIV cards for credential access, including access to Login.gov.

• DO use your PIV card and sec.gov email address to register for access to programs in

Login.gov that are related to your official duties at the SEC.

• DO use Silo when you need an anonymous browser to perform your official duties and you are operating under a limited exception referenced above.

• DO identify yourself properly at all times when conducting official business, but you may block your phone number when you make outbound calls from your work phone and SEC-issued Mobile Device.

• DO use MS Teams to exchange messages with other SEC Users.

• DO NOT use your PIV card and sec.gov email address to register for access to programs on

Login.gov that are unrelated to your official duties at the SEC.

• DO NOT engage in any activity that would discredit the SEC, which includes, but is not limited to, viewing sexually-explicit or offensive material or any material related to illegal activities, e.g., child pornography, gambling, terrorist acts.

Washington, DC 20549 January 3, 2024

• DO NOT use anonymous access or any alias when requesting or submitting information to conduct official business. A limited exception to this prohibition shall apply to users of SEC Information Systems to the extent: (1) required to perform their official work duties as part of an authorized OIG or other authorized SEC investigation or matter; and (2) consistent with written office and division policies and procedures governing such excepted activity, which have been provided to OIT Security.

• DO NOT use non-SEC email accounts from SEC equipment while at work, home, or on travel unless authorized by OIT in the course of your duties. This includes email portals and web-based email such as Gmail, Hotmail, MSN, Yahoo, and AOL.

• DO NOT power off your computer, iPhone, or iPad at the end of the day, unless specifically directed to do so by OIT or you have a need to do so, for example, while in transit. SEC computers, iPhones, and iPads, including those in remote locations, should be logged off but left powered on to facilitate remote software upgrades, virus protection, and other maintenance as necessary.

• DO NOT introduce non-approved applications, software, hardware, or cloud services technology into SEC Information Systems. Any software or device that is connected to SEC Information Systems must be examined and approved by OIT prior to that installation. This includes downloading or installing any software, even if it is free.

• DO NOT use SMS texting for SEC business unless an exception has been granted by OIT.

• DO NOT interfere with the virus-scanning software installed on SEC equipment. If a virus is detected when a file is opened or during the automatic virus scan, contact the OIT Service Desk.

• DO NOT reconfigure SEC computer hardware, software, or cloud assets or services.

• DO NOT modify system files (instructions used by software to carry out commands).

Modification includes editing, changing, adding or deleting program code within a system file.

• DO NOT cut, break, or remove any lock or physical security device attached to any SEC printer or other IT equipment.

• DO NOT try to perform your own repairs on government-owned computer equipment, iPhones, and iPads. Contact the OIT Service Desk for assistance.

• DO NOT move your computer workstation or peripheral equipment to a new location. You may adjust the orientation of your computer workstation or peripheral equipment if it does not need to be disconnected. If disconnection and reconnection of any computer workstation or peripheral equipment is necessary, contact the OIT Service Desk for assistance.

• DO NOT execute any SEC Information System scanning/monitoring program unless you are authorized to do so as part of your assigned job responsibilities, your supervisor is aware of your scanning and monitoring, and OIT has been notified in advance of this activity.

• DO NOT attempt to decrypt or translate encrypted material belonging to another person or organization (including email), unless this action is part of your regular duties, the originator/sender supplies you with the password to access such material, and/or you are complying with a court order issued to the SEC.

• DO NOT attempt to connect personally owned devices (smart phones, tablets, e-readers, USB drives, etc.) to SEC Information Systems, including SEC computers, iPhones, iPads, Networks, or any SEC Mobile Device. The SEC is not responsible for any damage to personally owned devices. The SEC User may be held responsible for any damage to SEC

Washington, DC 20549 January 3, 2024

Information Systems that may result from any attempt to connect a personally owned device to SEC Information Systems. The normal procedures for disciplinary and adverse actions will apply per SECR 6-20.

• DO NOT store portable SEC Information Systems in unsecured locations. Store them in locked containers or areas secured by a guard, key, or key card access.

• DO NOT use a personally owned device to store SEC NPI, and do not store any credentials to access SEC Information Systems on your personal device.

• DO NOT transmit SEC NPI on Portable Media to any non-SEC device or to a person or entity unless that transmission is authorized and consistent with requirements set forth in this policy and SECR 23-2.

• DO NOT leave laptops and Mobile Devices unattended or unsecured in a public area at any time.

The official use of social networking technologies to support Commission objectives is governed by SECR 18-3. When using social media in your personal capacity on your personal accounts, do not post NPI or other sensitive government material on a social networking site, do not post information as a representative of the SEC, do not post material someone could use to guess your SEC passwords, and be mindful that criminals often attempt to use social networking sites to obtain sensitive information or compromise your computer. Always familiarize yourself with the security and privacy capabilities of social networking technologies you use and apply those that afford the best opportunity to protect your reputation and ours. Please see SECR 18-3 for further requirements.

RULE #2 – Follow Telework and other Remote Connection Guidance

• The SEC is operating in a hybrid work environment, and the SEC has provided SEC Users the ability to connect remotely to SEC Information Systems. Approved remote access methods include virtual private networks (VPN) using certain SEC-issued laptops, Citrix (SEC GO), Azure Virtual Desktop, and certain SEC-issued Mobile Devices.

• SEC Users must follow guidance under SECR 6-16, "Telework Program", when Teleworking and any supplemental Telework guidance related to technology, such as video conferencing protocols. FaceTime, a video conferencing tool, will also be disabled unless needed for a reasonable accommodation, but there are no plans to discontinue use of Webex for meetings, videoconferencing, or phone calls.

• When handling SEC NPI in paper form (i.e., not electronic) during Telework, it is the user’s obligation to protect this information. Printing documents during Telework is discouraged;

any paper documents created during Telework must be handled in a manner consistent with other NPI in paper form. It is recommended that paper documentation be kept securely in a folder or other container so that it is not readily visible to other individuals in the remote location or home.

• In addition, please remember that records of internet and intranet activity are available for review under the Freedom of Information Act (FOIA) and the Privacy Act and for other official purposes.

Washington, DC 20549 January 3, 2024

RULE #3 - Use Email and Messaging Platforms Responsibly and Guard against Phishing

Email and messaging platforms are not inherently confidential, and SEC Users must have no expectation of privacy when using SEC Information Systems, including email and messaging platforms, notwithstanding the issuance or use of a personal password. In addition, email and messaging platforms are often used for phishing – tricking individuals into revealing information that can be used to masquerade as that SEC User.

• DO ensure the text messages and voicemails that meet the definition of a record are captured and stored in accordance with federal recordkeeping regulations and the appropriate SEC records schedules are applied.

• All emails to non-SEC email addresses (email addresses that end in anything other than @sec.gov) containing SEC NPI or PII must be encrypted by placing “smail” (without quotation marks) in the subject line or by using TLS when the SEC User is able to confirm TLS is available for that intended recipient as discussed above.

• Carefully read any warning message that is displayed that will alert you if your email includes external recipients and does not include “smail” in the subject line to encrypt the message. For more information about how to interpret the warning messages that appear when sending external emails, review Email Encryption Quick Guide: When to Use Transport Layer Security or Smail to Send Nonpublic Information Outside the SEC. If you cannot confirm there is a TLS connection between SEC and the party you are sending the email to, you must put “smail” in the subject line (See Rule #1).

• Report any email or messaging platform Security Incidents to your immediate supervisor and either through the askIT website or the OIT Service Desk at 202-551-HELP (extension 14357).

• All threatening, harassing, or intimidating calls (“THAIC”) or emails should be forwarded to the thaic@sec.gov inbox.

• Report emails, instant messages, or any other communication evidencing violations of criminal law or other misconduct by anyone granted access to SEC Information Systems to the OIG, as described in the “Reporting Incidents” section of this document.

• Make sure all emails, instant messages, and other electronic documents are saved in accordance with federal recordkeeping regulations, appropriate SEC records schedules, and applicable office and division policies.

• Be careful when addressing email and instant messages. Know your intended recipients and do not assume auto-populated addresses are correct.

• DO NOT use email to send SEC NPI to your personal e-mail account(s).

• DO NOT create, store, send, or forward chain email messages.

• DO NOT use SEC Information Systems in any activity that would discredit the SEC. Use of

SEC Information Systems to harass or denigrate individuals or groups is specifically prohibited.

Washington, DC 20549 January 3, 2024

• DO NOT open any email message or text message containing an attachment from a source outside of the SEC unless you know the originator of the message and can confirm its validity.

• DO NOT establish an automated system or rule that sends/forwards email directed to an SEC email account to a non-SEC account or directs mail from any non-SEC account to an SEC email account.

Guarding Against Phishing

“Phishing” – tricking individuals into revealing information about an SEC User that can be used to masquerade as that SEC User – is among the most common information security threats we face today.

To report suspected phishing attempts from your computer, click the “Report Phishing” button in the shape of a fish in your Microsoft Outlook tool bar. Clicking this button will notify OIT Security about the phishing attempt so it can be reviewed and analyzed by the security team. You do not need to open the suspicious email, and when you click the “Report Phishing” button, you will receive a pop-up window asking if you want to report the email as suspicious. If you acknowledge the pop-up, the email will be automatically forwarded to OIT Security for further analysis and the email will be deleted and no further action is needed on your part. To report a phishing attempt from your SEC iPhone, forward it to SEC’s Phishing Mailbox.

For more information, review this Article.

Use the “Report Phishing” button or phishing mailbox for an unexpected email that:

• Contains an attachment,

• Contains a hyperlink, OR

• Contains a call to action (i.e., a social engineering attempt such as “call this phone number and be prepared to tell us sensitive information”)

If the unexpected email message does not meet the criteria for using the “Report Phishing” button or phishing mailbox, you may simply delete it because it is considered spam. If you have a specific concern about a spam message, however, then forward the message to SEC’s spam mailbox at spam@sec.gov for review. No further action is necessary, but depending on the spam message, the analysts reviewing the Spam mailbox may reach out for follow-up.

RULE #4 - Protect Federal Records

SEC Users receive federal records management training. The responsibilities and legal requirements described in that training are applicable to all SEC Users. In particular, SEC Users should be aware that any electronic file created or used in the conduct of the SEC’s business has the potential to be a federal record and should be treated like any hardcopy of a document when it comes to determining its status as a federal record. As described more fully in the federal records management training, SEC Users must manage federal records accordingly:

Washington, DC 20549 January 3, 2024

• Follow the Division/Office file plan and records disposition schedule for retention and destruction. Direct specific questions about data preservation or destruction to the Office of Records Management Services. Additional records and information management guidance is located in the “Records Management” section of The Exchange.

• Remember that electronic messages, such as texts, chats, and instant messages, can be federal records and should be managed accordingly. You must retain all text messages and voicemails that meet the definition of a record in accordance with federal recordkeeping regulations and the appropriate SEC records schedules.

• Back up critical data that may include federal records. Storing data on SEC shared drives, OneDrive, SharePoint Online (i.e., storage spaces accessible through the SEC Network), or other locations approved for storing records, consistent with written office and division policies and procedures, ensures that your information is backed up.

• Keep attachments or related files that are an integral part of an electronic record together.

• DO NOT conduct agency business through any non-SEC resource, such as personal email accounts or other non-SEC electronic messaging systems. If, for some reason (such as by accident), an SEC User utilizes non-SEC email systems, personal text messaging accounts, or unauthorized applications for agency business, 44 USC § 2911 requires the individual to forward a complete copy of any such communication to the SEC’s email system or other approved SEC recordkeeping system within 20 days of the creation or transmission of the communication.

• DO NOT store federal records on the C:\ drive, except as a temporary, emergency measure where Network storage is unavailable, because files on the C:\ drive are not backed up, unlike the Network drives (F:\ and J:\) and SharePoint Online.

Destruction of NPI shall be in accordance with applicable federal records schedules, office and division policies, litigation holds, Freedom of Information Act requirements, and retention requirements and policies for Capstone officials. Subject to the foregoing, deletion of data on hard drives, magnetic disks, flash memory, USB storage devices, magnetic tape, and optical discs must be in accordance with 24-04.CRG.21, Electronic Media Sanitization Policy.

For additional policies concerning electronic federal records, refer to SECR 7-1, “Records and Information Management Program” and Recordkeeping Guidance for SEC-Issued Mobile Devices and Electronic Messages.

RULE #5 – Protect Your Credentials, Including Passwords and PIV Cards

• Always use a password that you can easily remember without writing down but is unique enough that it cannot be easily guessed – follow current guidance on creating a password.

• Safeguard PIV cards, system passwords, SecurID Tokens, and PINs from unauthorized disclosure and report any compromises or suspected compromises to askIT or the OIT Service Desk.

• The only approved password keeper/storage lockers are KeePass and CyberArk. If you do not have KeePass installed, simply submit a software installation request via askIT. To learn how to use KeePass, visit this User Guide.

Washington, DC 20549 January 3, 2024

• Lock your computer whenever it will be left unattended, even briefly, by pressing the

“Ctrl+Alt+Delete” keys simultaneously and then selecting “Lock Computer,” or use the Windows logo key + L shortcut.

• DO NOT share or reveal passwords or SEC Information System credentials at any time or under any circumstances. No authorized OIT Service Desk support technician, under any circumstances, will ever ask you for your password or PIN, either in person or on the phone.

Note that the creation or use of a unique password known only to the SEC User shall not create a subjective or objective expectation of privacy in SEC systems. Use of SEC Systems constitutes an express understanding that the SEC may access and review any materials on its System at any time for any lawful purpose or investigation.

• DO NOT use the same passwords from your personal accounts for your accounts on SEC Information Systems.

• DO NOT access another SEC User’s computer, iPhone, or iPad using the other user’s logon credentials, such as a username and password.

RULE #6 – Protect Privacy and Nonpublic Information

SEC business may only be conducted on SEC-approved and -issued email accounts, messaging systems and messaging applications within SEC Information Systems.

• DO NOT send NPI outside the SEC domain (“@sec.gov”) unless it is for SEC business and sent via one of the two SEC-approved options for encrypting email – smail or TLS.

• DO NOT send NPI to personal email accounts or otherwise conduct SEC business using personal email.

• DO NOT use SMS texting for SEC business unless an exception has been granted by OIT.

• DO use MS Teams to exchange messages with other SEC Users.

• DO NOT use non-approved messaging applications, such as Messages (the Apple texting app), FaceTime, WhatsApp, Signal, Slack, and Snapchat, on SEC Mobile Devices.

• You are permitted to message with individuals outside of the SEC during a MS Teams or

Webex videoconference if an SEC User hosts the videoconference, but you must abide by all rules concerning the sharing of SEC Information and NPI outside the SEC.

Access to all NPI must be provided only on a need-to-know basis. Not all SEC Users have a need-to-know for the same information, even if all SEC Users have been approved for access to SEC Information Systems.

• DO NOT leave NPI in an area outside of your control.

• DO NOT grant access to NPI to individuals unauthorized to receive such information.

• DO NOT intercept or view any SEC Information System communication not addressed or otherwise directed to you.

• DO NOT disclose records protected from disclosure under the Privacy Act to any person

(including SEC employees and special Government employees) or to another agency without a request from or the written consent of the individual to whom the record pertains, unless an

Washington, DC 20549 January 3, 2024 appropriate exception, defined in SECR 24-08, “Privacy Policy and Compliance,” is provided concerning the disclosure.

• DO NOT include names or other personal identifiers that constitute NPI or PII in electronic communications to external recipients unless they are sent securely (i.e., encrypted email as detailed above) and otherwise comply with the requirements for handling the NPI or PII being communicated (e.g., Whistleblower information, information regarding Suspicious Activity Reports, or related Bank Secrecy Act information).

• DO NOT disclose any NPI contained in any system of records except as authorized by federal law or by SEC regulation or directive.

• DO NOT intentionally view or modify data (including email messages, passwords, and NPI) unless you have a valid business purpose and are acting within the scope of your duties with respect to such data.

• DO NOT create, deploy, use, or distribute any device, program, or other technique that secretly collects information about SEC Users.

For more information on the SEC’s privacy program and policies, visit the SEC Privacy Office web site.

RULE #7 – Use Removable Media Securely

The use of Removable Media presents significant risks, including security and privacy risks. Those risks are heightened in our hybrid work environment. Only SEC Users who submitted a Security Policy Exception Request for Removable Media using the askIT portal and had the request granted may use Removable Media.

• DO encrypt all NPI saved to Removable Media.

• DO physically secure Removable Media containing NPI when not in use.

• DO physically safeguard Removable Media whether you are at home or in transit. If you are not able to maintain direct possession or control over your Removable Media during an intermediate transit stop – for instance, while you are at the gym or grocery store – you must take steps to secure your Removable Media in your locked vehicle or a locker just as you are required to do to safeguard your SEC laptop and other accessories.

• DO take all reasonable and appropriate steps to protect your Removable Media, including closing the windows and locking your car, hiding it from sight, or locking it in the trunk of your car if you have a trunk.

• DO NOT place NPI on Removable Media or remove any such devices containing NPI from SEC offices unless you are specifically authorized to do so.

• DO NOT use non-government furnished equipment, including personally owned and other unauthorized Removable Media, with SEC computers and information technology equipment.

• DO NOT use SEC-issued Removable Media for personal use.

• DO NOT use any Removable Media to store Agency passwords or other Agency codes (e.g., safe combinations).

Washington, DC 20549 January 3, 2024

RULE #8 – Don’t Text, Email, or Instant Message While Driving

In accordance with guidance in Executive Order 13513, all SEC Users are prohibited from instant messaging, texting, or using email functions under the following conditions:

• On an electronic device supplied by the SEC when driving a Government-owned vehicle or a privately-owned vehicle, whether or not on official Agency business;

• On an electronic device that is personally owned when driving a Government-owned vehicle, or when driving a privately-owned vehicle while on official Agency business.

Electronic devices include Mobile Devices, such as smart phones, cell phones, global positioning systems (GPS), as well as other Portable Media, such as a laptop computer, that allow you to read or enter data.

Additionally, the SEC prohibits the use of electronic devices while driving, unless it is in a hands-free manner. The prohibition covers reading from or using hands to enter data into an electronic device. This prohibition applies when driving a federal government owned, leased, or rented vehicle, driving a privately-owned vehicle while on official federal government business, and using an electronic device supplied by the federal government when driving any vehicle (even during off-duty hours). This prohibition applies to all SEC employees, special Government employees, contractors, subcontractors, interns, fellows, secondees, and detailees, as well as all others working on behalf of, or using an electronic device supplied by, the federal government.

When Using Electronic Devices While Operating a Motor Vehicle:

• DO pull over to the side of or off the roadway and bring the motor vehicle to a complete stop in a location where you can safely remain stationary if you must type on or read from any Portable Media while operating a motor vehicle.

Contractors and subcontractors are strongly encouraged to adopt and enforce policies that ban text or chat messaging when driving company owned, leased or rented vehicles or Government-owned vehicles, or when driving personally owned, leased or rented vehicles while on official SEC business or when performing any work for or on behalf of the SEC.

Approved by:

David Bottom Chief Information Officer Director, Office of Information Technology

Bottom, David Digitally signed by Bottom, David Date: 2024.01.03 10:45:28 -05'00'

Washington, DC 20549 January 3, 2024

Glossary

• Breach: The loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where: a person other than an authorized user accesses or potentially accesses personally identifiable information; or an authorized user accesses personally identifiable information for another than authorized purpose.

• Classified Information: Information that has been determined pursuant to E.O. 12958 as amended by E.O. 13292 or any predecessor order to require protection against unauthorized disclosure and is marked to indicate its classified status when in documentary form.

• Information System: A discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.

• Information Technology (IT): Any equipment or interconnected system or subsystem of equipment that is used in the automatic acquisition, storage, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information by the agency. The term Information Technology includes computers, ancillary equipment, software, firmware and similar procedures, services (including support services), and related resources.

• Mobile Device: A portable computing device, such as a smart phone or tablet, that: (i) is small enough to be easily carried by a single individual; (ii) is designed to operate without a physical connection (e.g., wirelessly transmit or receive information); (iii) possesses local, non-removable data storage; and (iv) is powered-on for extended periods of time with a self-contained power source.

Mobile Devices may also provide voice communication capabilities, on-board sensors that permit information capture (e.g., photograph, video, recording, or location), and/or built-in features for synchronizing local data with remote locations.

• Network: A group of interconnected computers, including the hardware and software used to connect them.

• Nonpublic Information (NPI): SEC Information that Staff or a contractor gains by reason of Federal employment or a Federal contract and that has not been made available to the general public in accordance with Section 5.2 of SECR 23-2. NPI includes, but is not limited to, SEC Information that is protected from disclosure by law or that the Commission has decided to accord confidential treatment, or any information the loss, misuse, unauthorized access, or modification of which could adversely affect national interests, the conduct of SEC programs, or the privacy to which individuals are entitled under the Privacy Act. For questions on whether particular information constitutes NPI or may be disclosed pursuant to Section 5.2 of SECR 23-2, consult with the Associate General Counsel for Litigation and Administrative Practice in the Office of the General Counsel prior to disclosure.

• Portable Media: Devices that can store electronic data, for example, laptop computers, external hard drives, universal serial bus (USB) drives, flash memory cards, tape drives and optical media (e.g., CD-ROM, DVD) discs. Portable media also include handheld devices such as cell phones.

Washington, DC 20549 January 3, 2024

• Public Information: SEC Information authorized for release to the general public.

• Removable Media: Any type of computer storage designed to be inserted and removed from a computer. Examples of removable storage media include: laptop hard drives, external hard drives, flash drives, USB drives, memory cards, optical discs (CD and DVD), and other external IT storage devices that encompass removable media abilities.

• SEC Information: Information created, developed, processed, managed, owned, and/or received by, or on behalf of, the SEC. SEC Information may be NPI or Public Information and may be in the form of documents, emails, computer files, oral statements, mobile and handheld devices, and audio or video recordings. For purposes of the Rules of Behavior, personal communications of Staff and contractors unrelated to official business are not considered SEC Information.

• SEC Information Systems: Discrete sets of SEC information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information. SEC Information Systems include but are not limited to: messaging platforms, desktop computers, laptop computers, mobile devices, software, electronic mail, data repositories, library resources, telephones, facsimile machines, photocopiers, and access to the Internet.

• SEC Users: Individuals who use SEC Information Systems or who otherwise have access to SEC NPI, including employees, special Government employees, contractors, interns, scholars, fellows, detailees, and secondees.

• Security Incident: An occurrence that (i) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or

(ii) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies. Security Incidents include, but are not limited to, incidents involving the loss of, damage to, or unauthorized disclosure of NPI.

• Staff: All SEC officers, employees, special Government employees, detailees, interns, scholars, fellows, secondees, and volunteers.

• Transport Layer Security (TLS): A protocol intended to provide secure communication between networks by encrypting data in transit.