SOL FINAL - Attachment 5 - OCIO-POL-63 - Cloud Services Usage Policy.pdf

OFFICE OF THE CHIEF INFORMATION OFFICER

Office of the Chief Information Officer 1

CLOUD SERVICES USAGE POLICY

OCIO-POL-63

Effective Date: See Signature

TABLE OF CONTENTS

Section

I. Purpose

II. Scope III. Definitions IV. Policy V. Guidance

VI. Exceptions VII. Authority VIII. References IX. Effect on other policies

Appendices

I. PURPOSE

This policy establishes guidelines for the selection and use of cloud-based information systems by the United States Patent and Trademark Office (USPTO). This policy is intended to supplement cloud usage policies established by the Office of Management and Budget (OMB), the Department of Commerce (DOC), and other federal agencies. This policy provides the requirements for the product owner and/or project manager to ensure they coordinate planning with the Office of the Chief Information Officer (OCIO) early in the planning process to avoid unnecessary problems later in the planning and acquisition lifecycle.

II. SCOPE

This policy pertains to the acquisition of services from a cloud service provider (CSP) outside of the USPTO. Internal cloud computing services are already covered by existing requirements. This policy also applies to information systems owned or operated by contractors on behalf of the USPTO.

Office of the Chief Information Officer 2

III. DEFINITIONS

Agency1: Any executive department, military department, Government corporation, Government controlled corporation, or other establishment in the executive branch of the Government (including the Executive Office of the President), or any independent regulatory agency.

Authorizing Official (AO)2: Official with the authority to formally assume responsibility for operating an information system at an acceptable level of risk to agency operations (including mission, functions, image, or reputation), agency assets, or individuals.

Availability3: Ensuring timely and reliable access to and use of information.

Cloud Computing4: A model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. Cloud computing services may be offered as an Infrastructure-as-a-Service, Platform-as-a-Service, or Software-as-a-Service.

Confidentiality5: Preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information.

Federal Risk Assessment and Management Program (FedRAMP): A government-wide program that provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services.

Individual6: A citizen of the United States or an alien lawfully admitted for permanent residence.

Integrity7: Guarding against improper information modification or destruction and includes ensuring information non-repudiation and authenticity.

Infrastructure as a Service (IaaS)8: The capability provided to the consumer is to provision processing, storage, networks, and other fundamental computing resources where the consumer is able to deploy and run arbitrary software, which can include operating systems and applications.

The consumer does not manage or control the underlying cloud infrastructure but has control over operating systems, storage, deployed applications, and possibly limited control of select networking components.

Joint Authorization Board (JAB): The primary governance and decision-making body for the FedRAMP program. The JAB reviews and provides joint provisional security authorizations of cloud solutions using a standardized baseline approach. Chief Information Officers (CIOs) from the Department of Defense, the Department of Homeland Security, and the General Services

Administration serve on the JAB.

1 NIST Glossary - OMB Circular A-130 2 NIST Glossary - NIST SP 800-18 rev. 1 3 NIST Glossary - 44 U.S.C., Sec. 3542 4 NIST Glossary - NIST SP 800-145 5 NIST Glossary - 44 U.S.C., Sec. 3542 6 NIST Glossary - NIST SP 800-60 v.1 r.1 7 NIST Glossary - 44 U.S.C., Sec. 3542 8 NIST Glossary - NIST SP 800-145 https://csrc.nist.gov/glossary/term/agency https://csrc.nist.gov/glossary/term/authorizing_official https://csrc.nist.gov/glossary/term/availability https://csrc.nist.gov/glossary/term/cloud_computing https://csrc.nist.gov/glossary/term/confidentiality https://csrc.nist.gov/glossary/term/individual https://csrc.nist.gov/glossary/term/integrity https://csrc.nist.gov/glossary/term/infrastructure_as_a_service

Office of the Chief Information Officer 3

Maintenance9: Any act that either prevents the failure or malfunction of equipment or restores its operating capability.

Operation of a system of records: The performance of any of the activities associated with maintain the system of records, including the collection, use, and dissemination of records.

Platform as a Service (PaaS)10: The capability provided to the consumer is to deploy onto the cloud infrastructure consumer-created or acquired applications created using programming languages and tools supported by the provider. The consumer does not manage or control the underlying cloud infrastructure including network, servers, operating systems, or storage, but has control over the deployed applications and possibly application hosting environment configurations.

Record: Any item, collection, or grouping of information about an individual that is maintained by an agency, including, but not limited to, education, financial transactions, medical history, and criminal or employment history, and that contains the individual's name, or the identifying number, symbol, or other identifying particular assigned to the individual, such as a fingerprint or voiceprint or a photograph.

Risk Acceptance Memorandum: A memorandum that documents known security risks to the confidentiality, integrity, and availability of the information system. The memorandum also details any business justification to support the acceptance of risk and any compensating controls in place for risk mitigation. This memorandum is acknowledged and signed by the System Owner and Authorization Official.

Security Assessment11: The testing or evaluation of security controls to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements for an information system or organization.

Security Authorization12: the official management decision given by a senior organizational official to authorize operation of an information system and to explicitly accept the risk to organizational operations and assets, individuals, other organizations, and the Nation based on the implementation of an agreed-upon set of security controls.

Software as a Service (SaaS)13: The capability provided to the consumer is to use the provider’s applications running on a cloud infrastructure. The applications are accessible from various client devices through a thin client interface such as a web browser (e.g., web-based email). The consumer does not manage or control the underlying cloud infrastructure including network, servers, operating systems, storage, or even individual application capabilities, with the possible exception of limited user-specific application configuration settings.

System Owner14: Person or organization having responsibility for the development, procurement, integration, modification, operation and maintenance, and/or final disposition of an information system.

9 NIST Glossary - NIST SP 800-82r.3 10 NIST Glossary - NIST SP 800-145 11 NIST Glossary - OMB Circular A-130 (2016) 12 NIST Glossary - NIST SP 800-12 r.1 13 NIST Glossary - NIST SP 800-145 14 NIST Glossary - CNSSI 4009-2015 https://csrc.nist.gov/glossary/term/maintenance https://csrc.nist.gov/glossary/term/platform_as_a_service https://csrc.nist.gov/glossary/term/security_assessment https://csrc.nist.gov/glossary/term/security_authorization https://csrc.nist.gov/glossary/term/software_as_a_service https://csrc.nist.gov/glossary/term/system_owner

Office of the Chief Information Officer 4

System of records on individuals15: A group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual.

IV. POLICY

Use of cloud computing services must be formally authorized in accordance with the NIST Risk Management Framework (RMF) per NIST SP 800-53v.516 (CA-3, CP-7) and the USPTO assessment and authorization processes. Specifically:

• Use of cloud computing services must comply with all privacy laws and regulations, and appropriate language must be included in the contract vehicle defining the cloud computing source responsibilities for maintaining privacy requirements.

• Use of cloud computing services must adhere to and hold CSPs accountable for complying with all current laws, IT security, and risk management policies, and meet the requirements established in this policy. All cloud services leveraged by USPTO must meet the FedRAMP requirements, implement the CSP-provided customer responsibility matrix, and complete the USPTO RMF processes to obtain authority to operate (ATO).

• Cloud computing services must have JAB FedRAMP authorization to be considered for use at USPTO. However, FedRAMP authorization alone is not sufficient to meet the requirement of authorization for USPTO use of a particular service for a particular purpose. An appropriate AO, sufficiently familiar with the context of the use of the service (including the mission requirements and associated Federal

Information Processing Standard (FIPS) 19917 impact level), and adequately informed of the associated risks through a risk assessment, must document an acceptance of risk and formal authorization of the use of the cloud computing service.

All use of cloud computing services must be approved in writing by the USPTO CIO and, when applicable, a designated Co-AO. The AO(s) will certify that security, privacy, and other IT management requirements have been adequately addressed prior to approving use of cloud computing services.

• The cloud computing service must meet all criteria documented in the, “FedRAMP Applicability” policy before the AO(s) provide written approval.

• The cloud computing service may not be put into production use until written approval has been provided by the AO(s).

• The product owner and/or project manager must retain the CIO’s approval along with other investment documentation.

15 5 U.S.C., Sec. 552a(a)(5) 16 NIST SP 800-53 Rev. 5 17 FIPS 199 – Standards for Security Categorization of Federal Information and Information Systems https://www.govinfo.gov/content/pkg/USCODE-2024-title5/pdf/USCODE-2024-title5-partI-chap5-subchapII-sec552a.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf https://nvlpubs.nist.gov/nistpubs/fips/nist.fips.199.pdf

Office of the Chief Information Officer 5

V. GUIDANCE

In accordance with the Cloud Security Authorization Guide, the following issues should be considered carefully before adopting a cloud computing solution. The list below features some of the more important issues to consider, and to address in contract language, when appropriate:

• Identify and consider appropriate existing contracts and cloud computing solutions already in use at DOC or USPTO before acquiring new services.

• When acquiring new services, consider how services can be architected and agreements written in a way that enables broader use/adoption of the service across the rest of the organization.

• IT Security:

o Match IT security requirements (including FIPS 19918 impact level) and the security capabilities of the cloud computing implementation to those of the mission/business needs being supported.

o Weigh the security threats and opportunities that are present for public, private, and community clouds.

o Consider how issues of logging, incident reporting, response, forensics, and other security-related functions should be addressed with respect to the cloud computing service provider.

o Consider how disaster recovery and continuity of operations planning will be addressed.

• Privacy Impact:

o If Personally Identifiable Information (PII), business identifiable information (BII), or other sensitive information is involved, document how it will be protected and who is allowed access to it.

o If the cloud computing source is keeping user usage statistics, consider the privacy implications involved and define appropriate safeguards to assure user privacy is maintained. This would include session logs and security access logs, among others.

o Define how all relevant provisions of The Privacy Act19 will be enforced and identify responsible parties.

• Records Management:

o Identify all systems of records to be hosted in the cloud.

o Identify the National Archives and Records Administration (NARA) approved agency schedules for all records and include the information on retention and agency ownership of records as part of the agreement with the vendor.

18 FIPS 199 – Standards for Security Categorization of Federal Information and Information Systems 19 The Privacy Act https://usptogov.sharepoint.com/:b:/r/sites/f20aa580/Documents/Guides/Assessment%20and%20Authorization/USPTO%20Cloud%20Security%20Authorization%20Guide.pdf?csf=1&web=1&e=w1hBKl https://nvlpubs.nist.gov/nistpubs/fips/nist.fips.199.pdf https://www.justice.gov/opcl/privacy-act-1974

Office of the Chief Information Officer 6 o Records must be managed and dispositioned in accordance with the agency provided/identified records schedule(s).

o Specify the records retention period for all system backups.

o Consider and verify how records management and electronic discovery will be managed and executed in the cloud environment.

o Verify that copies of the records and its metadata are not retained by the vendor when service ends. And full custodial control of the records is given to the agency.

o Vendor must delete all records once agency verifies receipt and custodial control of records when service(s) ends.

• Consider implications of using a service model that is different from the traditional use of

Government-owned-and-operated infrastructure.

• Identify which issues should be explicitly documented in service level agreements.

• Consider issues of interoperability with existing systems.

• Consider issues of data ownership and portability. How would a migration from one cloud computing infrastructure to another be performed at some point in the future?

• Examine the need for additional training for departmental staff.

• Focus on the requirement driving the need, not the technology used to implement it.

• Determine how mature the industry offerings are for the proposed implementation.

• If there are additional or specific concerns contact RecordsManagement@USPTO.gov.

VI. EXCEPTIONS

Exceptions to this policy shall be determined on a case-by-case basis using the process as defined in the USPTO IT Security Handbook and the IT Policy on Security Risk Acceptance (OCIO-POL-35).

In some cases, a Risk Acceptance Memorandum may need to be issued to accept any residual security risk in order to operate the information system. Some cloud computing services may have security assessment and risk reports available, but not yet have FedRAMP authorization. Such services may be considered for conditional adoption following a complete risk assessment by

USPTO.

VII. AUTHORITY

This policy is issued pursuant to:

• Department of Commerce Enterprise Cybersecurity Policy

• Federal Information Security Modernization Act of 2014

• Federal Cloud Computing Strategy, From Cloud First to Cloud Smart, June 2019

• Federal Information Processing Standards Publication (FIPS) Publication 199, Standards for Security Categorization of Federal Information and Information Systems, February 2004 mailto:RecordsManagement@USPTO.gov https://usptogov.sharepoint.com/:b:/r/sites/a142efd3/Documents/OCIO-PRC-8%20-%20IT%20Security%20Handbook.pdf?csf=1&web=1&e=ieSZPC https://usptogov.sharepoint.com/:b:/r/sites/a142efd3/Documents/OCIO-POL-35%20-%20IT%20Policy%20on%20Security%20Risk%20Acceptance.pdf?csf=1&web=1&e=LZvevG

Office of the Chief Information Officer 7

• FIPS Publication 200, Minimum Security Requirements for Federal Information and Information Systems, March 2006

• National Institute of Standards & Technology (NIST) SP 800-145 - The NIST Definition of Cloud

Computing

• NIST SP 800-53 Rev 5 - Security and Privacy Controls for Information Systems and

Organizations

• Office of Management and Budget (OMB) Circular A-130, Management of Federal Information

Resources, Appendix III, Revised July 2016

• OMB Memorandum M-03-22, OMB Guidance for Implementing the Privacy Provisions of the E-

Government Act of 2002, September 2003

• OMB Memorandum M-08-05, Implementation of Trusted Internet Connections (TIC), November

• OMB Memorandum M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information, January 2017

• OMB Memorandum M-17-15, Rescission of Memoranda Relating to Identity Management, January 2017

• The Privacy Act of 1974, 5 U.S.C. §552a.

VIII. REFERENCES

All references will be linked throughout the document.

IX. EFFECT ON OTHER POLICIES

This policy does not conflict with any existing OCIO or USPTO policies.

ISSUED BY:

Deborah Stephens

Chief Information Officer (Acting) United Stated Patent and Trademark Office

OFFICE OF PRIMARY INTEREST: Office of the Chief Information Security Officer

Office of the Chief Information Officer 8

Appendix A Records Management Requirements for Cyber Procurements

Office of Procurement - PTAM 52 (see PTO-40)

A. Applicability

This clause applies to all Contractors whose employees create, work with, or otherwise handle Federal records, as defined in Section B, regardless of the medium in which the record exists.

B. Definitions

“Federal record” as defined in 44 U.S.C. § 3301, includes all recorded information, regardless of form or characteristics, made or received by a Federal agency under Federal law or in connection with the transaction of public business and preserved or appropriate for preservation by that agency or its legitimate successor as evidence of the organization, functions, policies, decisions, procedures, operations, or other activities of the United States Government or because of the informational value of data in them.

The term Federal record:

1. Includes USPTO records.

2. Does not include personal materials.

3. Applies to records created, received, or maintained by Contractors pursuant to their USPTO contract.

4. May include deliverables and documentation associated with deliverables.

C. Requirements

1. Contractor shall comply with all applicable records management laws and regulations, as well as National Archives and Records Administration (NARA) records policies, including but not limited to the Federal Records Act (44 U.S.C. chs. 21, 29, 31, 33), NARA regulations at 36 CFR Chapter XII Subchapter B, and those policies associated with the safeguarding of records covered by the

Privacy Act of 1974 (5 U.S.C. 552a). These policies include the preservation of all records, regardless of form or characteristics, mode of transmission, or state of completion.

2. In accordance with 36 CFR 1222.32, all data created for Government use and delivered to, or falling under the legal control of, the Government are Federal records subject to the provisions of 44 U.S.C. chapters 21, 29, 31, and 33, the Freedom of Information Act (FOIA) (5 U.S.C. 552), as amended, and the Privacy Act of 1974 (5 U.S.C. 552a), as amended and must be managed and scheduled for disposition only as permitted by statute or regulation.

3. In accordance with 36 CFR 1222.32, Contractor shall maintain all records created for Government use or created in the course of performing the contract and/or delivered to, or under the legal control of the Government and must be managed in accordance with Federal law. Electronic records and associated metadata must be accompanied by sufficient technical documentation to permit understanding and use of the records and data.

4. USPTO and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Records may not be removed from the legal custody of USPTO or destroyed except for in accordance with the provisions of the agency records schedules and with the written concurrence of the Head of the Contracting Activity.

https://usptogov.sharepoint.com/sites/f0a4ef36/SitePages/OP%20Activities/PTAM%2052.aspx

Office of the Chief Information Officer 9

Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. In the event of any unlawful or accidental removal, defacing, alteration, or destruction of records, Contractor must report to USPTO and USPTO must report promptly to NARA in accordance with 36 CFR 1230.

5. The Contractor shall immediately notify the appropriate Contracting Officer upon discovery of any inadvertent or unauthorized disclosures of information, data, documentary materials, records or equipment. Disclosure of non-public information is limited to authorized personnel with a need-to-know as described in the [contract vehicle]. The Contractor shall ensure that the appropriate personnel, administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, documentary material, records and/or equipment is properly protected. The Contractor shall not remove material from Government facilities or systems, or facilities or systems operated or maintained on the Government’s behalf, without the express written permission of the Head of the Contracting Activity. When information, data, documentary material, records and/or equipment is no longer required, it shall be returned to USPTO control or the Contractor must hold it until otherwise directed. Items returned to the Government shall be hand carried, mailed, emailed, or securely electronically transmitted to the

Contracting Officer or address prescribed in the [contract vehicle]. Destruction of records is EXPRESSLY PROHIBITED unless in accordance with Paragraph (4).

6. The Contractor is required to obtain the Contracting Officer's approval prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under, or relating to, contracts. The Contractor (and any sub-contractor) is required to abide by Government and USPTO guidance for protecting sensitive, proprietary information, classified, and controlled unclassified information.

7. The Contractor shall only use Government IT equipment for purposes specifically tied to or authorized by the contract and in accordance with USPTO policy.

8. The Contractor shall not create or maintain any records containing any non-public USPTO information that are not specifically tied to or authorized by the contract.

9. The Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected from public disclosure by an exemption to the Freedom of Information Act.

10. The USPTO owns the rights to all data and records produced as part of this contract. All deliverables under the contract are the property of the U.S. Government for which USPTO shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest. Any Contractor rights in the data or deliverables must be identified as required by FAR 52.227-11 through FAR 52.227-20.

11. Training. All Contractor employees assigned to this contract who create, work with, or otherwise handle records are required to take USPTO-provided records management training. The Contractor is responsible for confirming training has been completed according to USPTO policies, including initial training and any annual or refresher training.

[Note: To the extent an agency requires contractors to complete records management training, the agency must provide the training to the contractor.]

D. Flowdown of requirements to subcontractors

Office of the Chief Information Officer 10

1. The Contractor shall incorporate the substance of this clause, its terms and requirements including this paragraph, in all subcontracts under this [contract vehicle], and require written subcontractor acknowledgment of same.

2. Violation by a subcontractor of any provision set forth in this clause will be attributed to the Contractor.

Office of the Chief Information Officer 11

Appendix B Records Management Requirements for CUI Cyber Procurements

This information should be input to any contracts requiring CUI.

ACCESS TO CONTROLLED UNCLASSIFIED INFORMATION (CUI)

A. For the sole purpose of performing work required under this contract, the contracting officer of the Department of Commerce (hereinafter referred to as "Commerce”) may grant the contractor -including contractor employees, subcontractors, and subcontractor employees - access to controlled unclassified information (CUI).

B. CUI:

1. Is information that requires safeguarding or dissemination controls consistent with 32 CFR Part 2002, but is not classified under Executive Order 13526 “Classified National Information” or the Atomic Energy Act, as amended.

2. Is not available to the general public;

3. May include:

a. Government acquisition-sensitive information, including source selection information as defined at section 2.101 of the Federal Acquisition Regulation (48 CFR chapter 1);

contractor bid or proposal information.

b. Information contained in individual contracts that is not public information and such contract information that is contained in Government databases; proprietary economic, financial, or business information (e.g., salary information) provided to the Government by other parties

(e.g., other contractors) or belonging to Commerce.

c. Personally identifiable information (PII) that includes, but is not limited to social security numbers, names, dates of birth, places of birth, parents' names, credit card numbers, applications for entitlements, and information relating to a person's private financial, income, employment, and tax records.

d. Other information that the 32 CFR Part 2002 explicitly identifies as CUI.

4. May exist in various physical media (e.g., paper, electronic file, audio or video disc) or be transmitted orally, may be developed under or pre-exist any related contract, and may be in its original form or a derivative form (i.e., where the information has been included in contractor-generated work, or where it is discernible from materials incorporating or based upon such information).

C. Prior to receiving access to CUI, each contractor or subcontractor employee shall execute the nondisclosure agreement in attachment [insert attachment number], attach to this contract and deliver the executed agreement to the contracting officer of Commerce.

D. The Contractor shall include this clause in all subcontracts.

E. The contractor's failure to comply with any part of this clause or with the terms of the required nondisclosure agreements may result in the termination of this contract for default.

Office of the Chief Information Officer 12

Appendix C Records Management Requirements for PII Cyber Procurements

24.102 General

(a) The Act requires that when an agency contracts for the design, development, or operation of a system of records on individuals on behalf of the agency to accomplish an agency function the agency must apply the requirements of the Act to the contractor and its employees working on the contract.

(b) An agency officer or employee may be criminally liable for violations of the Act. When the contract provides for operation of a system of records on individuals, contractors and their employees are considered employees of the agency for purposes of the criminal penalties of the Act.

(c) If a contract specifically provides for the design, development, or operation of a system of records on individuals on behalf of an agency to accomplish an agency function, the agency must apply the requirements of the Act to the contractor and its employees working on the contract. The system of records operated under the contract is deemed to be maintained by the agency and is subject to the Act.

(d) Agencies, which within the limits of their authorities, fail to require that systems of records on individuals operated on their behalf under contracts be operated in conformance with the Act may be civilly liable to individuals injured as a consequence of any subsequent failure to maintain records in conformance with the Act.

24.103 Procedures

i. The contracting officer shall review requirements to determine whether the contract will involve the design, development, or operation of a system of records on individuals to accomplish an agency function.

ii. If one or more of those tasks will be required, the contracting officer shall-

1. Ensure that the contract work statement specifically identifies the system of records on individuals and the design, development, or operation work to be performed; and

2. Make available, in accordance with agency procedures, agency rules and regulation implementing the Act.

Privacy Act Notification20

The Contractor will be required to design, develop, or operate a system of records on individuals, to accomplish an agency function subject to the Privacy Act of 1974, Public Law 93-579, December 31, 1974 (5 U.S.C. 552a) and applicable agency regulations. Violation of the Act may involve the imposition of criminal penalties.

20 48 CFR § 52.224-2

https://www.acquisition.gov/far/52.224-2#:~:text=(2)%20%22Record%2C%22,person%27s%20name%2C%20or%20the%20identifying

Office of the Chief Information Officer 13

Privacy Act

(a) The Contractor agrees to-

(1) Comply with the Privacy Act of 1974 (the Act) and the agency rules and regulations issued under the Act in the design, development, or operation of any system of records on individuals to accomplish an agency function when the contract specifically identifies-

i. The systems of records; and

ii. The design, development, or operation work that the contractor is to perform;

(2) Include the Privacy Act notification contained in this contract in every solicitation and resulting subcontract and in every subcontract awarded without a solicitation, when the work statement in the proposed subcontract requires the redesign, development, or operation of a system of records on individuals that is subject to the Act; and

(3) Include this clause, including this paragraph (3), in all subcontracts awarded under this contract which requires the design, development, or operation of such a system of records.

(b) In the event of violations of the Act, a civil action may be brought against the agency involved when the violation concerns the design, development, or operation of a system of records on individuals to accomplish an agency function, and criminal penalties may be imposed upon the officers or employees of the agency when the violation concerns the operation of a system of records on individuals to accomplish an agency function. For purposes of the Act, when the contract is for the operation of a system of records on individuals to accomplish an agency function, the Contractor is considered to be an employee of the agency.

(c) (1) "Operation of a system of records," as used in this clause, means performance of any of the activities associated with maintaining the system of records, including the collection, use, and dissemination of records.

(2) "Record," as used in this clause, means any item, collection, or grouping of information about an individual that is maintained by an agency, including, but not limited to, education, financial transactions, medical history, and criminal or employment history and that contains the person's name, or the identifying number, symbol, or other identifying particular assigned to the individual, such as a fingerprint or voiceprint or a photograph.

(3) "System of records on individuals," as used in this clause, means a group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual.

Accessibility Report

Filename:

Cloud Services Usage Policy.pdf

Report created by:

Organization:

[Enter personal and organization information through the Preferences > Identity dialog.]

Summary

The checker found no problems in this document.

Needs manual check: 2

Passed manually: 0

Failed manually: 0

Skipped: 1

Passed: 29

Failed: 0

Detailed Report

Document

Rule Name Status Description

Accessibility permission flag Passed Accessibility permission flag must be set

Image-only PDF Passed Document is not image-only PDF

Tagged PDF Passed Document is tagged PDF

Logical Reading Order Needs manual check Document structure provides a logical reading order

Primary language Passed Text language is specified

Title Passed Document title is showing in title bar

Bookmarks Passed Bookmarks are present in large documents

Color contrast Needs manual check Document has appropriate color contrast

Page Content

Rule Name Status Description

Tagged content Passed All page content is tagged

Tagged annotations Passed All annotations are tagged

Tab order Passed Tab order is consistent with structure order

Character encoding Passed Reliable character encoding is provided

Tagged multimedia Passed All multimedia objects are tagged

Screen flicker Passed Page will not cause screen flicker

Scripts Passed No inaccessible scripts

Timed responses Passed Page does not require timed responses

Navigation links Passed Navigation links are not repetitive

Forms

Rule Name Status Description

Tagged form fields Passed All form fields are tagged

Field descriptions Passed All form fields have description

Alternate Text

Rule Name Status Description

Figures alternate text Passed Figures require alternate text

Nested alternate text Passed Alternate text that will never be read

Associated with content Passed Alternate text must be associated with some content

Hides annotation Passed Alternate text should not hide annotation

Other elements alternate text Passed Other elements that require alternate text

Tables

Rule Name Status Description

Rows Passed TR must be a child of Table, THead, TBody, or TFoot

TH and TD Passed TH and TD must be children of TR

Headers Passed Tables should have headers

Regularity Passed Tables must contain the same number of columns in each row and rows in each column

Summary Skipped Tables must have a summary

Lists

Rule Name Status Description

List items Passed LI must be a child of L

Lbl and LBody Passed Lbl and LBody must be children of LI

Headings

Rule Name Status Description

Appropriate nesting Passed Appropriate nesting

Back to Top