RRB11Q041 - Logical Access Control - Attachment 4 - Rules Regarding Privacy and Security of Data.docx

REQUEST FOR QUOTATIONS NO. RRB11Q041 ATTACHMENT 4

LOGICAL ACCESS CONTROL

Rules Regarding Privacy and Security of Data

1. The RRB’s rules are summarized in the following publications:

a) Privacy Act Information http://www.rrb.gov/bis/privacy_act/introduction.asp http://www.rrb.gov/bis/privacy_act/overview.asp http://www.rrb.gov/bis/privacy_act/information_rrb_maintains.asp

b) RRB’s Privacy System of Records http://www.rrb.gov/bis/privacy_act/sornlist.asp

2. Anticipated threats and hazards that the contractor must guard against.

a) Data stored on equipment following the completion of the project.

b) Unauthorized data removal.

c) Contractor employees not fully versed in responsibilities with respect to Privacy and Security.

d) Contractor accessing RRB data from unauthorized sites.

3. Safeguards that the contractor must specifically provide include a contractor having access to RRB data should have in place preventive measures to assure that:

a) Accessed data is not retained in contractor files or on contractor’s equipment.

b) No RRB data may be stored or transported on portable or removable media, either contractor or RRB owned

c) Data temporarily housed on contractor’s equipment must be securely deleted meeting or exceeding NIST SP 800-88, Media Sanitation Guidelines.

d) All contractor staff members are made aware of their responsibilities with respect to Privacy and Security.

e) Contractor access to RRB data is limited to RRB approved sites.

4. Inspection of contractor’s premises.

RRB reserves the right to have an inspection program during performance of the contract to ensure the continued efficacy and efficiency of safeguards and the discovery and countering of new threats and hazards.