SOL FINAL - Attachment 6 - OCIO-POL-36 - Rules of the Road (USPTO).pdf

Office of the Chief Information Officer Version 7.2 1

Office of the Chief Information Officer

USPTO RULES OF THE ROAD

OCIO-POL-36

Effective Date: May 21, 2012

Last Revision Date: May 20, 2025 Purpose of Revision: Annual review and updates of outdated information including references and links.

Version: 7.2

TABLE OF CONTENTS

Section

I. Purpose II. Authority III. Scope IV. Policy V. Responsibilities VI. Effect on Other Policies VII. References

I. PURPOSE

The PTOnet, United States Patent and Trademark Office (USPTO) Wireless Network, USPTO information systems, and other computing resources are shared among USPTO employees and applicable USPTO contractors. PTOnet provides access to USPTO business systems that operate on the USPTO information technology infrastructure and provides access to remote information systems through secure gateways.

To avoid confusion, the use of “you” in the following text refers to USPTO employees and contractors.

The use of “we” refers to the personnel of USPTO as a whole.

You must follow the Rules of the Road when using USPTO automation resources. Complying with these rules will help maximize access to these facilities and help ensure that your use of USPTO systems and resources is responsible, legal, and respectful of privacy.

Office of the Chief Information Officer Version 7.2 2

The Rules of the Road are grouped into three categories to ensure users comply with:

1. The intended use of USPTO resources.

2. The ethical use of USPTO resources.

3. The proper use of USPTO resources.

The following is a more detailed discussion of the individual rules in each category. The Office of Human Resources Policies and Procedures include employee guidelines for the USPTO workplace. Other USPTO directives can be found in the list of agency directives.

II. AUTHORITY

This policy is issued pursuant to:

• Electronic Communications Privacy Act of 1986

• Federal Information Security Modernization Act of 2014 (FISMA)

• Federal Information Technology Acquisition Reform Act (FITARA)

• Federal Records Act of 1950, as amended by Presidential and Federal Records Act

Amendments of 2014

• Privacy Act of 1974

• Consolidated Appropriations Act, 2023

• OMB Memorandum M-15-14, Management and Oversight of Federal Information

Technology

• OMB Circular A-130, Managing Information as a Strategic Resource

• OCIO-1001-09, Policy Management

III. SCOPE

The provisions of this policy are written for and apply to all USPTO employees and contractor employees using or operating USPTO computer systems, and to employees of contractor systems owned and operated on behalf of the USPTO.

IV. POLICY

Complying with the intended use of USPTO resources.

It is important to understand the purpose of PTOnet, USPTO Wireless Network, cloud-based systems, and any USPTO information systems so that your use of these systems conforms to their intended purpose and complies with applicable policies.

http://ptoweb.uspto.gov/ptointranet/ohr/policies_and_procedures/index.htm http://ptoweb.uspto.gov/ptointranet/ohr/policies_and_procedures/index.htm http://ptoweb.uspto.gov/ptointranet/directives/index.html

Office of the Chief Information Officer Version 7.2 3

Rule #1: Do not conduct unauthorized business on USPTO resources

You have an obligation to conduct your activities in alignment with the USPTO mission, goals and objectives. All uses of PTOnet, USPTO Wireless Network, and USPTO information systems, including accessing the internet, must be consistent with this purpose. The following are examples of appropriate uses of USPTO resources:

• Exchange of information that supports the USPTO mission, goals, and objectives.

• Job-related professional development for USPTO management and staff.

• Communications and exchange of information intended to maintain job currency or gain additional knowledge that is directly or indirectly related to job functions.

• Communications and exchange of information generally supportive of otherwise acceptable uses.

Internet services and email provided by the USPTO are intended for authorized purposes during business hours. However, limited personal use of the internet, including sending infrequent personal email messages is permissible provided such use is consistent with the Rules of the Road and does not interfere with conducting USPTO business. Use of certain tools, such as Microsoft Teams, should be restricted to official business only, given their unique nature and potential for negative impact on PTOnet. The privilege to use government equipment for limited personal purposes may be revoked or restricted at any time by the USPTO. USPTO employees should consult with their supervisors in case of any doubt about the appropriate use of any government equipment. Please refer to: USPTO policy AAO 202-735, Limited Personal Use of Government Equipment; Employee Wi-Fi Quick Reference Guide; and Terms of Wireless Services Use.

The USPTO flexible work schedules, including the Increased Flextime Policy (IFP) and mid-day flex (see Office of Human Resources Administrative Policies), should minimize the necessity for the personal use of any and all government equipment during official working hours. Employees are reminded of their obligation to accurately certify their time and attendance records and to report as duty-time only that time permitted under USPTO Time and Attendance Policies.

All unauthorized use of USPTO resources is prohibited. The following activities, while not an exhaustive list, are specific examples of unacceptable uses of the PTOnet, USPTO Wireless Network, and USPTO information systems:

• Using resources for commercial purposes, for financial gain, or in support of private business activities.

• Initiating actions that interfere with the supervisory or accounting functions of the information systems, including attempts to obtain elevated privileges without proper authorization.

• Creating, storing, or sending electronic chain letters.

• Using the internet or intranet as a staging ground or platform to gain unauthorized access to other systems.

• Publishing personal opinions to external (non-USPTO) entities while appearing to be representing USPTO without express authorization based on individual job description or through other USPTO clearance process. Including a disclaimer that such statements are not http://ptoweb/ptointranet/directives/AAO_202-735.doc http://ptoweb/ptointranet/directives/AAO_202-735.doc http://ptoweb/ptointranet/directives/AAO_202-735.doc http://ptoweb.uspto.gov/ptointranet/ohr/policies_and_procedures/policies/policies_home.htm https://ptoweb.uspto.gov/ptointranet/ohr/policies_and_procedures/policies/time-attendance-information.htm

Office of the Chief Information Officer Version 7.2 4 aligned with USPTO is not sufficient to obviate or negate this restriction.

• Communicating with the media without prior approval of the Office of the Chief

Communications Officer. For guidelines, refer to the USPTO Media Policy.

• Engaging in any activity that would discredit the USPTO, including the creation, downloading, viewing, storage, copying, or transmission of sexually explicit and/or sexually oriented materials, or materials related to gambling, illegal weapons, terrorist activities, and any other illegal activities or activities otherwise prohibited.

USPTO, in compliance with the Consolidated Appropriations Act, 2023, No TikTok on Government Devices Act, strictly prohibits the downloading, installing, or using of the TikTok application onto government, issued devices. This also applies to Contractor Furnished Equipment, (CFE) Bring your own device (BYOD), User Furnished Equipment (UFE) or any device that stores, transmits, or processes data on behalf of USPTO. This restriction also applies to any successor application or service developed or provided by ByteDance Limited or an entity owned by ByteDance Limited. Exceptions to this policy must be expressly approved by the

USPTO CIO.

USPTO prohibits the use of generative AI tools on USPTO IT systems and on any personal (BYOD/UFE) and corporate IT equipment without approval from the CIO. A generative AI tool is defined as software tools that can programmatically generate novel content (including but not limited to text, images, and video). Some examples of generative AI include, but are not limited to ChatGPT, Bing Chat, Jasper, Stable Diffusion, and Cohere. If in doubt, please reach out to GenerativeAIQuestions@uspto.gov.

In the normal course of operations and maintenance activities, your usage of USPTO resources may be monitored at any time in order to ensure the continued operational effectiveness and integrity of the PTOnet, USPTO Wireless Network, USPTO information systems and other computing resources.

Unauthorized or improper use of the information systems will be investigated, and official sanctions, including disciplinary actions up to and including removal from the federal service, may be imposed as a result of such use. If criminal activity is discovered, information will be provided to the appropriate law enforcement officials.

Rule #2: Save federal records

The Federal Records Act requires all federal agencies to create and preserve records that document the agency’s organization, function, policies, decisions, procedures, and transactions. These records must be managed in accordance with subchapter B, chapter XII, of Title 36, Code of Federal Regulations (CFR) and chapters 29, 31, 33, and 35 of Title 44, United States Code (U.S.C.). It also calls for agencies to establish a records management program consisting of policies, procedures, and activities to manage recorded information. The Presidential and Federal Records Act Amendments of 2014 modernize records management by requiring the transfer of records from federal agencies to the National Archives and Records Administration (NARA) in digital or electronic form to the greatest extent possible.

Records are managed using the three phases of the records lifecycle:

1. Creation or Receipt

2. Maintenance and Use http://ptoweb.uspto.gov/cco/media-policy.html

Office of the Chief Information Officer Version 7.2 5

3. Disposition – Dispose or destroy (temporary records) or transfer to NARA (permanent records)

Effective and efficient management of records provides the information foundation for decision-making at all levels, mission planning and operations, personnel services, legal inquiries, business continuity, and preservation of U.S. history.

• Ensure all systems, processes, and tools are compliant with all records management requirements

• Only dispose of records in accordance with a USPTO/NARA approved disposition authority (see the Comprehensive Records Schedule for more details)

• Save records, including their metadata, in approved repositories

• Do not remove any official records from the Agency without Office of General Law and/or

Records and Information Compliance Program Office approval

• Complete the appropriate separation checklist for records management prior to separating from the Agency

If you have any questions about the determination or disposition of a record, or need assistance in managing records, please contact your business area’s records liaison or recordsmanagement@uspto.gov.

Complying with the ethical use of USPTO resources

The opportunities that PTOnet, USPTO Wireless Network, and USPTO information systems provide USPTO employees to share information come with the responsibility to use the information systems in accordance with USPTO standards of conduct. These standards are described in the IT security awareness training that all employees are required to take annually in accordance with the OCIO-POL-19 IT Security Education Awareness Training Policy.

Appropriate use of PTOnet, USPTO Wireless Network, and USPTO information systems includes maintaining the security of the information systems, protecting privacy, and conforming to applicable laws, particularly copyright and harassment prevention laws.

Rule #3: Do not let anyone know your password

While you should feel free to let others know your username (this is the name by which you are known to the PTOnet, USPTO Wireless Network, USPTO information systems and internet community), never reveal your account passwords.

Giving someone else your password is like giving them a signed blank check or a credit card. You should never reveal your password or “lend” your account to anyone temporarily. Anyone who has your password can use your account, and any activities will be traced back to your username. If your username or account is connected to abusive or otherwise inappropriate usage, the agency will hold you responsible.

When creating or changing your password, always use a password that you can easily remember but is unique enough that it cannot be easily guessed by your coworkers, such as the names of family members or familiar dates (i.e., birthdates).

https://usptogov.sharepoint.com/sites/a142efd3/Documents/OCIO-POL-19%20-%20IT%20Security%20Education%20Awareness%20Training.pdf https://usptogov.sharepoint.com/sites/a142efd3/Documents/OCIO-POL-19%20-%20IT%20Security%20Education%20Awareness%20Training.pdf

Office of the Chief Information Officer Version 7.2 6

The USPTO may operate a few systems which require shared accounts/passwords due to limited information system functionalities. These are exceptional cases that should be documented in the impacted information System Security and Privacy Plans (SSPPs) and officially approved by the organizational designated officials including the Authorizing Officials (AOs).

These password requirements are found in OCIO-POL-21, Password Management Policy.

The provisions of this policy apply to all USPTO employees, contractors, and the public accessing, using, or operating USPTO laptops/desktop, servers, applications, websites, or information systems, as well as to contractors providing telecommunications and information system services to the USPTO.

Rule #4: Do not violate the privacy of other users

All federal employees have a shared responsibility to ensure that individual privacy is protected, and must keep that in mind when using USPTO networks and information systems. PTOnet, USPTO Wireless Network, and all USPTO information systems are in place to facilitate the sharing of information among USPTO employees, our international partners, and customers. As a user of USPTO resources, make sure that your actions do not violate the privacy of other users, even if unintentionally.

Some specific areas to avoid include the following:

• Do not attempt to access the files or directories of another user without clear authorization from that user.

• Do not attempt to intercept or otherwise monitor any network communications not explicitly intended for you.

• Do not use Personally Identifiable Information (PII) in communications that might be of a sensitive or confidential nature, unless there’s a need-to-know and the situation requires it.

This rule does not prohibit authorized USPTO employees from carrying out activities needed for the USPTO to meet its legal, security, or other requirements. Some individuals may be required to complete some of these activities as part of their official duties to include Union Officials. It is the individual’s responsibility when handling this information to ensure it is handled in accordance with applicable laws and regulations.

• Do not intentionally seek information about, browse, obtain copies of, or modify files, mail, or passwords belonging to others, whether they are at the USPTO or elsewhere, unless specifically authorized to do so.

• Do not attempt to decrypt or translate encrypted material belonging to or intended for another person or organization.

• Do not attempt to alter the “From” line of your PTOnet user ID or other attributes of origin in electronic mail, messages, or news group postings.

• Do not create any shared programs that collect information about USPTO users without their consent.

• Any email that contains Personally Identifiable Information (PII) that is sent using an automatic forwarding rule may result in a privacy breach and is a PII incident that must be reported to the U.S. Department of Commerce Chief Privacy Office and the U.S.

Department of Commerce Enterprise Security Operations Center (ESOC).

https://usptogov.sharepoint.com/sites/a142efd3/Documents/OCIO-POL-21%20-%20Password%20Management%20Policy.pdf

Office of the Chief Information Officer Version 7.2 7

Rule #5: Do not transmit classified or sensitive data without proper protection

Every attempt has been made to ensure that appropriate security mechanisms are in place for protecting information from unintended access. However, these mechanisms alone are not sufficient. PTOnet, USPTO Wireless Network, and USPTO information systems users should ensure that they take appropriate action to safeguard classified or sensitive data. All USPTO users are instructed to implement the following requirements:

• Do not transmit classified data, data subject to a secrecy order, or data under seal through the internet or email, unless it has been properly protected in accordance with appropriate controls commensurate with its classification levels.

• Do not store or transmit sensitive data without proper protection as defined in applicable federal laws and regulations. Sensitive data should be safeguarded during collaboration sessions and should not be posted in open discussion groups or other social media sites.

Data should be considered sensitive if it might be exempt from Freedom of Information Act (FOIA) disclosure or protected under the Privacy Act. Sensitive data includes records about individuals in which there is a reasonable expectation of privacy, trade secrets or confidential business information, and confidential information related to patent and trademark applications.

• The USPTO Media Protection Procedures restricts access to sensitive media, including but not limited to diskettes, magnetic tapes, external/removable hard drives, flash/thumb drives, compact disks, digital video discs, and non-digital media (e.g., paper and microfilm), to authorized personnel within approved USPTO secure locations, based on approved access control lists.

• Do not transmit data that is part of the USPTO internal decision-making process to members of the public.

• All USPTO management and staff are required to use their assigned USPTO email account for official communications and not their personal email account.

• Do not automatically forward electronic mail via rule, macro, or script to an address outside the USPTO network. Automatic forwarding potentially creates a serious operational threat and an unjustified risk to confidentiality obligations. Sensitive USPTO information may inadvertently be transmitted and stored in a public medium without protection. Senders using automatic forwarding have no knowledge or control of the content that is being forwarded and have no way to filter sensitive information from being forwarded. Therefore, auto forwarding of email outside the USPTO network is prohibited. Auto-replies or out-of-office settings that do not use auto-forwarding are permissible.

• The following are examples of sensitive data that should not be discussed or transmitted on PTOnet or related computing services:

o Any sensitive personnel data such as names with Social Security numbers, leave balances, salaries, or employee benefits.

o Anything dealing with the details surrounding an employee relations or union issue.

Union officials may store sensitive data related to employee relations or union issues as permitted by an agreement.

http://www.justice.gov/oip/amended-foia-redlined.pdf http://www.justice.gov/oip/amended-foia-redlined.pdf http://www.justice.gov/opcl/privstat.htm https://usptogov.sharepoint.com/sites/a142efd3/Documents/OCIO-PRC-11%20-%20USPTO%20Media%20Protection%20Procedures.pdf

Office of the Chief Information Officer Version 7.2 8 o Sensitive procurement information (any procurement amounting to $1 million or more; not purchase orders).

o Anything dealing with the details surrounding contract award prior to an award.

o All information categorized as Source Selection Information by Section 27 of the

Office of Federal Procurement Policy Act (41 U.S.C. 423) that concerns the number, identity, ranking, or evaluation of offerors in response to an ongoing procurement action.

o Information marked by an offer or as proprietary.

o Source selection information, including bid prices prior to bid opening, proposed costs/prices in response to a solicitation, source selection plans, technical evaluation of proposals, cost or price evaluations, competitive range determinations, ranking of offers, and reports or evaluations of source selection panels.

o Anything dealing with budget policy prior to the budget submission, particularly as it may deal with USPTO employees.

o Passwords or other computer security related items.

o Do not access and use unapproved cloud storage providers from USPTO systems to transfer and store USPTO data. Use only the USPTO OneDrive and Kiteworks for transferring and storing USPTO data.

Rule #6: Do not copy or misuse copyrighted material, including software

The use of the PTOnet, USPTO Wireless Network, and USPTO information systems, including the ability to access external information via the internet, offers an opportunity to more effectively perform your job.

While using these resources, be aware of copyright restrictions. Many computer programs and related materials, such as documentation, are owned by individual users or third parties and are protected by copyright and other laws together with licenses and other contractual agreements. Copyright considerations also apply to some of the non-computer related documents that are obtainable through the USPTO’s access to the internet. Failure to abide by legal and contractual restrictions on the use of copyrighted products could make you subject to civil and criminal prosecution. Therefore, you should observe the following restriction:

• Copyrighted and licensed materials, including software, should not be used on USPTO information systems or collected or disseminated via PTOnet, USPTO Wireless Network, or distributed through email or other collaboration systems without the copyright or license owner’s approval.

Only software that has been evaluated, tested, and approved for use on the USPTO production network/domain may be installed on USPTO workstations in accordance with OCIO-POL-66, Workstation Software Installation and Usage Policy.

Rule #7: Do not use USPTO resources to store or transmit offensive material or harass anyone in any way

The USPTO is proud of its efforts to create a work environment free from all forms of harassment. As a PTOnet, USPTO Wireless Network, and USPTO information systems user, do not use these resources in any way that unreasonably interferes with anyone’s work or creates an atmosphere where others feel https://usptogov.sharepoint.com/sites/3db77428/UserAssistanceDocuments/Forms/AllItems.aspx?id=%2Fsites%2F3db77428%2FUserAssistanceDocuments%2FOCIO%20Tech%20Tips%20%2D%20Kiteworks%20FAQs%2Epdf&useFiltersInViewXml=1&FilterField1=Document%5Fx0020%5FCategory&FilterValue1=Miscellaneous&FilterType1=Choice&FilterOp1=In&parent=%2Fsites%2F3db77428%2FUserAssistanceDocuments https://usptogov.sharepoint.com/sites/a142efd3/Documents/OCIO-POL-66%20-%20Workstation%20Software%20Installation%20and%20Usage%20Policy.pdf https://usptogov.sharepoint.com/sites/a142efd3/Documents/OCIO-POL-66%20-%20Workstation%20Software%20Installation%20and%20Usage%20Policy.pdf

Office of the Chief Information Officer Version 7.2 9 harassed. Do not use any USPTO resources to convey obscene, profane, discriminatory, abusive, or otherwise offensive material. Any USPTO employee who feels harassed should seek assistance and resolution of the complaint. To report any such improper use of the system, contact the Service Desk at

(571) 272-9000. Complaints of harassment are handled under Agency Administrative Order (AAO) 202- 955 and should be reported to the harassment intake points via harassment@uspto.gov or 571-270-7004.

Complying with the proper use of USPTO resources

PTOnet, USPTO Wireless Network, and USPTO information systems resources, as well as news groups, mail servers, and internet resources accessible through PTOnet, are powerful tools that can easily be misused.

Rule #8: Do not overload USPTO resources or abuse the network

In order for the USPTO to obtain maximum use of its PTOnet, USPTO Wireless Network, and USPTO information systems resources, carefully evaluate your use of these resources and do not overly tax their processing and storage capabilities in a manner that can affect others’ ability to access such resources.

You are required to observe the following:

• Avoid sending email attachments larger than 20 megabytes, which is a document of approximately 60 pages of text. With embedded graphics or spreadsheets, a document could easily be 20 MB in as little as one page. Internet bandwidth usage is monitored. Please be aware of your consumption. Stick to USPTO business usage only.

• Do not stream or download games, movies and videos for entertainment purposes.

• Limit streaming or downloading of audio and video files. Media-rich communications take up significant resources and increase bandwidth consumption that can negatively affect our ability to carry out mission-critical functions. While you may use media-rich videoconferencing systems and other collaborative tools for official business purposes, you should notify your supervisor in advance if you have a need to download or stream media files for other purposes.

• Do not develop unauthorized scripts, macros, web crawlers, utilities, local applications or other software or batch processes to automate tasks that are run on or are executed against workstations, servers, or other network resources. Unauthorized automation of tasks has the potential of adversely impacting information systems availability by significantly impacting its performance and availability. Solutions to automated tasks need to be designed carefully by authorized staff in the Office of the Chief Information Office (OCIO) or business executive management in accordance with USPTO System Development Life Cycle (SDLC) processes to prevent these occurrences. Under certain circumstances, you may be authorized to perform limited automated processes on your local workstation or collaboration site as afforded by your access rights.

Rule #9: Use proper digital etiquette

You are authorized and encouraged to communicate with others using the USPTO’s email service whenever appropriate. Please observe the following practices:

mailto:harassment@uspto.gov

Office of the Chief Information Officer Version 7.2 10

• Keep your messages brief and to the point.

• When sending an email, always fill out the subject line. Give a brief, clear description of the message.

• When sending messages to a group, ask yourself “Does everyone in this group need to see this message?”

• When replying to an email, limit the use of “Reply All” whenever possible.

• Never share any domain account password.

• Be careful with humorous or witty messages. Colleagues who know you may understand your meaning, but strangers may interpret such messages as offensive. Assume your message might someday be requested under FOIA or the Privacy Act.

• Your messages should not contain any obscene, profane, discriminatory, or otherwise offensive material.

• Some people view upper case or very large or red fonts as the equivalent of shouting. Keep in mind how you compose messages to avoid appearing offensive.

• Do not send email broadcast messages (i.e., messages addressed to a server and/or to all users). For messages to be widely disseminated, use authorized collaboration sites, shared folders, or an intranet page. The Office of the Chief Communications Officer can assist in coordinating agency-wide messages when appropriate.

Rule #10 Conduct virtual meetings responsibly

New types of collaboration tools are designed to promote meeting efficiency through information sharing and voice and video communications among campus-wide users, telecommuters working remotely, and external contacts around the globe. To foster a positive experience and protect information from unintended disclosure, be aware of the following:

• Take care to protect systems and sensitive information during video conferences and other collaboration sessions. Desktop sharing and peer-to-peer file transfers are both prohibited on unprotected networks or public computers.

• If you are hosting a virtual meeting that is being monitored or recorded, you must provide notification to all participants. Similarly, you must provide proper notification when attending a meeting that is hosted and recorded by other entities.

• If you are hosting a virtual meeting with speaker phones or other audio capabilities, you should take care to identify the names of participants and/or number of people listening in during the session.

• As with in-person meetings, be vigilant against inappropriate comments and offensive materials.

• Whether you are hosting or attending a WebEx, Microsoft Teams, or other online collaboration meeting, take precautions to ensure that unauthorized participants do not gain access to the collaborative session audio, video, or data.

• Do not forward collaborative meeting invitations to unauthorized parties.

• Do not connect to a collaborative conversation that you were not invited to.

• Be prepared. Know how to operate the tools to conduct a virtual meeting. For large meetings, prepare materials in advance and have a contingency plan for any disruptions.

For further details, check out virtual collaborative tools.

http://ptoweb.uspto.gov/ptointranet/cio/virtual_collab_tools/virtual_collab_tools.html

Office of the Chief Information Officer Version 7.2 11

Rule #11: Do not compromise the integrity of USPTO resources

Computer viruses represent a significant threat to the operational readiness and integrity of PTOnet, USPTO Wireless Network, and USPTO information systems. Given the USPTO’s increasing dependence on information processed and stored on information systems, it is important to understand and recognize the threat that computer viruses pose. You must learn how to protect against virus infections, detect their presence, and obtain assistance to repair the damage they cause. While there are no easy answers to these problems, you can help prevent threats and protect our agency’s assets and systems by doing the following:

• Use only U.S. government-acquired software obtained through proper USPTO distribution or requisition channels.

• Ensure any software above the image workstation baseline you received originally is approved for use on the USPTO production network/domain.

• You are prohibited from unauthorized acquisitions, use, reproduction, transmission, or distribution of any controlled unclassified information, including computer software and data that includes privacy information, copyrighted, trademarked or material with other intellectual property rights (beyond fair use), proprietary data, or export-controlled software or data.

• You are prohibited from downloading, installing, or transferring any software product, including public domain freeware or shareware without OCIO authorization

Rule #12: Protect PTOnet and USPTO information systems assets

The USPTO has invested heavily in establishing an automated environment that provides access to the computing resources and information. In order to ensure continuous service, do the following to protect USPTO assets:

• Do not reconfigure or modify USPTO computer hardware or software assets without OCIO authorization.

• Do not use IT hardware or software that has not been authorized and approved for use by OCIO, and has not been acquired through proper USPTO distribution or requisitioning channels.

• User Furnished Equipment (UFE) – You are prohibited from connecting personally owned hardware to any Government Furnished Equipment (GFE).

o When teleworking, you may connect your service provider’s router/modem to GFE

(the small office/home office or SOHO router, docking station or laptop).

o Only wired speakers, mice, keyboards, webcams, and headsets may be connected as long as drivers or software are not required for their functionality. These devices must not have any data storage capability.

o Webcams must not have a resolution higher than 1080P (excessive bandwidth consumption), no drivers, and must have an indicator light when active.

o Up to a maximum of two (2) monitors are supported with a resolution of 1920 x 1200 https://usptogov.sharepoint.com/sites/e10f3a96/Pages/search.aspx

Office of the Chief Information Officer Version 7.2 12 each, have no more than a 60Hz refresh rate, and any video cables that vary from PTO provided cables are the users responsibility. The resolution and refresh rate are the maximum supported by our current systems.

o Scanners and printers that are on the agency’s approved printer list are permitted.

Scanners and printers deviating from the approved list and requiring driver installation to function will not be permitted nor supported by the agency support staff.

• Use care when eating or drinking near USPTO computers. Food crumbs and spilled drinks can damage computer components.

• Do not allow unauthorized access to PTOnet resources and files. Forwarding official USPTO email and attachments to external email systems is prohibited as it provides access to those that operate and manage those external email systems, and exposes USPTO systems to the risk of unauthorized access.

• Never attempt to cut, break, or remove any lock or physical security device attached to any government-owned computer, printer, monitor, or other equipment.

• Do not try to perform your own repairs or in the event of monitors or other larger IT equipment, do not move the equipment on your own. Call the Service Desk at (571) 272- 9000 if your computer is malfunctioning or if equipment needs to be moved on campus.

• Check the placement of your computer, monitor, and other electronic computer equipment to make sure that air vents are not blocked or covered. An obstructed flow of air can cause the equipment to overheat and malfunction.

• It is every USPTO employee’s and contractor’s responsibility to immediately report any suspected or actual physical and logical IT security violations and incidents involving sensitive information and or PII as soon as you become aware, by contacting the Security Operations Center (SOC) via e-email at SOC@uspto.gov or calling extensions x20060 or x29000. Report all incidents and virus infections directly to SOC@uspto.gov. Please refer to the USPTO Incident Response Plan and the OCIO Incident Handling and Response page for additional details.

• If you suspect that a computer is infected by a computer virus, disconnect it from the network immediately, leave it powered on, and make sure the machine is attended by someone to prevent others from using the system until a member of SOC arrives. Do not send an email to SOC or anyone else from the infected workstation. Please leave a voice message at 571-272-0060 with sufficient detail to identify the nature of the incident and a means to contact you if SOC’s staff is unable to answer the phone.

o Information systems can be disconnected from the network by removing the network cable from either the end that is connected to the network interface card (NIC) in the computer or from the end that is plugged into your network wall jack.

• Wireless devices are not authorized for use within the USPTO (e.g., wireless mice, keyboards, etc.) except for approved USPTO-issued wireless devices.

• Bluetooth devices are not permitted for personal use. OCIO-approved Bluetooth devices may be used in communal conference rooms or for reasonable accommodations.

• Only OCIO-approved removable media devices may be used on USPTO computers, monitors, or docking stations. No personally owned or third-party removable media devices shall be connected to USPTO systems with the exception of OCIO Office of the Chief Information Security Officer authorized media transfer stations. The use of removable media devices shall be limited to the greatest extent possible and used only for pre-approved, authorized purposes in accordance to the Removable Media Policy.

https://usptogov.sharepoint.com/sites/3db77428/UserAssistanceDocuments/Forms/AllItems.aspx?id=%2Fsites%2F3db77428%2FUserAssistanceDocuments%2FUSPTO%20Approved%20Printers%2Epdf&parent=%2Fsites%2F3db77428%2FUserAssistanceDocuments mailto:SOC@uspto.gov mailto:SOC@uspto.gov https://usptogov.sharepoint.com/sites/a142efd3/Documents/OCIO-PRC-33%20-%20USPTO%20Incident%20Response%20Plan.pdf http://ptoweb.uspto.gov/ptointranet/cisd/cio/it_security_ops/it_security_ops_ptocirt.html http://ptoweb.uspto.gov/ptointranet/cisd/cio/it_security_ops/it_security_ops_ptocirt.html

Office of the Chief Information Officer Version 7.2 13

Rule #13: Be mindful of your mobile environment

• Keep in mind that in a mobile environment, people could be watching as you enter your password or PIN and/or perform work. Be mindful of your surroundings while working on a mobile device in a public area. Individuals can attempt to obtain sensitive information by shoulder surfing. Therefore, avoid working in public places.

• If you’re working in an environment where someone could be standing behind you watching your activities, move to a private location where your work cannot be readily seen.

• Avoid access from public wireless access points and networks since they increase the risk to individual users. If access from public wireless access points or networks is required, be certain to utilize the USPTO virtual private network (VPN).

Rule#14: Do not attempt to circumvent security controls

• The USPTO has implemented security controls to prevent inappropriate access and monitor traffic. All users should be aware of the restrictions in place and never attempt to circumvent these controls. Any attempt to circumvent the implemented security controls will be viewed as malicious activity on the network.

• Do not attempt to connect unauthorized devices to the Enterprise Wireless (PTOPRIVATE) network. Only a PTO-provided Universal Laptop (UL) is authorized to connect to the Enterprise Wireless network, which requires using login ID, password, and a USPTO provided smartcard. UL is discouraged for use with USPTOGuest or PUBLIC access. The UL device is not authorized to access both wireless connection and direct connection to USPTO’s internal network at the same time. The wireless service is not to be connected to the USPTO wired internal network. The USPTO may terminate, modify, limit use of, make changes to, or modify the terms of service of this capability at any time without notice.

• You can connect to PTO PUBLIC via a personally-owned portable device such as a laptop computer, tablet, or other mobile devices.

Rule#15: Be mindful of special requirements when traveling abroad on USPTO business

USPTO has a responsibility to be extraordinarily vigilant in safeguarding intellectual property along with the processes and information related to granting IP rights, especially when traveling in foreign countries.

In light of this responsibility, the CIO staff has taken steps to be extra diligent in securing the technology our employees use when they travel to foreign countries.

Please be mindful of these policies and procedures:

• All USPTO travelers must certify they have read the Defensive Travel Briefing at least annually. Travelers must adhere to all guidelines in USPTO’s OCIO-POL-6 Information Security Foreign Travel Policy.

• Access to PTO network resources and systems from foreign countries is generally prohibited unless approved in advance. To obtain permission for unclassified, remote access from a foreign location, all travelers must fill out the User Agreement for Remote Access from Foreign Locations form found in Appendix A of USPTO’s OCIO- POL-6 Information http://ptoweb.uspto.gov/ptointranet/ptosecurity/ea_advisories/defensivetravelbrief.pdf#search%3DDefensive%20Travel%20Briefing https://usptogov.sharepoint.com/sites/a142efd3/Documents/OCIO-POL-6%20-%20Information%20Security%20Foreign%20Travel.pdf https://usptogov.sharepoint.com/sites/a142efd3/Documents/OCIO-POL-6_InfoSecurityForeignTravel.pdf https://usptogov.sharepoint.com/sites/a142efd3/Documents/Forms/All%20Approved%20Documents.aspx?viewpath=%2Fsites%2Fa142efd3%2FDocuments%2FForms%2FAll%20Approved%20Documents%2Easpx&useFiltersInViewXml=1&viewid=07d7deda%2D21dc%2D40af%2D81be%2D9cdb471c60ef https://usptogov.sharepoint.com/sites/a142efd3/Documents/OCIO-POL-6%20-%20Information%20Security%20Foreign%20Travel.pdf

Office of the Chief Information Officer Version 7.2 14

Security Foreign Travel Policy. The form must be filled out by the Traveler and signed by a supervisor. Refer to the USPTO’s OCIO-POL-6 Information Security Foreign Travel Policy for further details when there is a requirement for access while on official travel.

• Only USPTO equipment issued for foreign travel, Overseas Travel Equipment (OTE), may be used for conducting USPTO business overseas; no personal devices may be used for this purpose. Any laptops that are designated for overseas use include full disk, sophisticated encryption and automatic virus scanning for any removable devices mounted on it, such as memory cards, flash drives and similar equipment. In special circumstances, when there is an overriding need for an employee to use their normal, everyday USPTO equipment overseas, OCIO staff can specially configure such equipment for business use outside of the United States. This is a significant effort, and use of pre-configured OTE is strongly encouraged. Users shall not attempt to modify configuration (including the inventory of software applications on the device) of issued USPTO approved foreign travel devices, unless the user obtains documented approval from OCIO. The CIO asks that you request OTE 72 hours (three business days) prior to your departure date.

• USPTO equipment both leaving and returning from foreign travel will be security- scanned at check-out and turn-in, including an employee’s USPTO-owned mobile device (handhelds, tablets) that has been issued for daily use.

• Staff must ensure that no intellectual property or personally identifiable information is stored on overseas travel equipment.

• Employees should only use the USPTO-established ‘alias’ email account, through VPN, while overseas. The use of regular USPTO Outlook web access is explicitly prohibited.

• Employees on travel should secure equipment in locked storage when it is not directly under the control, for instance when attending a social activity with foreign colleagues.

Equipment should be in carry-on luggage when in transit.

• Do not allow unauthorized access to USPTO equipment by foreign representatives.

• USPTO-issued OTE is not authorized for employees’ use during personal foreign travel.

For instance, if a staff member takes annual leave at the conclusion of a foreign USPTO business trip to do pleasure traveling, the use of OTE is prohibited.

• Upon return from travel, travelers must turn removable media into the USPTO Computer Incident Response Team (CIRT) for forensic analysis and sanitization or destruction, as required.

For full details on the requirements for foreign travel, refer to the USPTO’s Information Security Foreign Travel Policy.

Rule #16: IT Systems and related components must be approved by the Chief Information Officer (CIO). Use of Shadow IT and Hidden IT is prohibited

“Shadow IT” or “Hidden IT” refers to Information Technology (IT) systems, components, infrastructure, equipment, programs or devices that are not fully transparent to the agency CIO. This definition includes IT resources and functionality used by employees or organizations that are included as a portion of a program when it is not primarily of an “information technology” purpose, but delivers IT capabilities or contains IT resources. It also includes programs that contain a portion of its spending on equipment, systems, or services that provide IT capabilities for supporting, administering, or delivering business related functions.

https://usptogov.sharepoint.com/sites/a142efd3/Documents/OCIO-POL-6%20-%20Information%20Security%20Foreign%20Travel.pdf https://usptogov.sharepoint.com/sites/a142efd3/Documents/OCIO-POL-6%20-%20Information%20Security%20Foreign%20Travel.pdf https://usptogov.sharepoint.com/sites/a142efd3/Documents/OCIO-POL-6_InfoSecurityForeignTravel.pdf https://usptogov.sharepoint.com/sites/a142efd3/Documents/OCIO-POL-6_InfoSecurityForeignTravel.pdf https://usptogov.sharepoint.com/sites/a142efd3/Documents/OCIO-POL-6%20-%20Information%20Security%20Foreign%20Travel.pdf https://usptogov.sharepoint.com/sites/a142efd3/Documents/OCIO-POL-6_InfoSecurityForeignTravel.pdf

Office of the Chief Information Officer Version 7.2 15

• The Federal Information Technology Acquisition Reform Act (FITARA) requires the CIO to authorize the use of USPTO funds to purchase and deliver IT systems and functionality.

All organizations, business units, and employees must coordinate directly with the appropriate groups within the Office of the CIO when IT systems are required in support of business requirements.

• Do not purchase or use IT systems, components, infrastructure, equipment, programs or devices in support of USPTO business that have not been authorized and approved by the

USPTO CIO.

• Personal equipment, systems, or other IT components should not be used in support of USPTO business requirements.

• Enhanced privileges, IT user accounts, employee, or organization-developed software must not be used to establish alternate or customized IT functionality, develop, or install software components, circumvent security controls, or configure other IT system components (including databases, SharePoint, or other IT systems and related solutions). This prohibition is applicable and includes situations when these actions have been initiated by organizations, business units, and employees.

V. RESPONSIBILITIES

The provisions of this policy apply to all USPTO employees and contractor employees using or operating USPTO computer systems, and to employees of contractor systems owned and operated on behalf of the

USPTO.

VI. EFFECT ON OTHER POLICIES

This policy affects all new, revised, or retired policies issued in Fiscal Year 2016.

VII. REFERENCES

• E-Government Act (Public Law 107-347), Title III - Federal Information Security Management Act (FISMA), December 2002.

• Federal Information Processing Standards (FIPS) Publication 140-3, Security Requirements for Cryptographic Modules, March 2019.

• Federal Information Processing Standards (FIPS) Publication 199, Standards for Security Categorization of Federal Information and Information Systems, February 2004.

• Federal Information Processing Standard (FIPS) Publication 200, Minimum Security Requirements for Federal Information and Information Systems, March 2006

• The Privacy Act of 1974, 5 U.S.C. §552a.

• U.S. Department of Commerce, Enterprise Cybersecurity Policy, September 2022.

• Federal Information Technology Acquisition Reform Act (FITARA).

• OMB Memorandum M-15-14, Management and Oversight of Federal Information

Technology http://www.gpo.gov/fdsys/pkg/PLAW-107publ347/pdf/PLAW-107publ347.pdf http://www.gpo.gov/fdsys/pkg/PLAW-107publ347/pdf/PLAW-107publ347.pdf https://csrc.nist.gov/pubs/fips/140-3/final https://csrc.nist.gov/pubs/fips/140-3/final https://csrc.nist.gov/pubs/fips/140-3/final http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.200.pdf https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.200.pdf http://www.justice.gov/opcl/privstat.htm https://connection.commerce.gov/sites/default/files/media/files/2022/doc_enterprise_cybersecurity_policy_1.1.pdf https://www.congress.gov/113/plaws/publ291/PLAW-113publ291.pdf#page%3D148%5D https://bidenwhitehouse.archives.gov/wp-content/uploads/legacy_drupal_files/omb/memoranda/2015/m-15-14.pdf https://bidenwhitehouse.archives.gov/wp-content/uploads/legacy_drupal_files/omb/memoranda/2015/m-15-14.pdf

Office of the Chief Information Officer Version 7.2 16

ISSUED BY:

Henry J. Holcombe Chief Information Officer United Stated Patent and Trademark Office

OFFICE OF PRIMARY INTEREST: Office of the Chief Information Security Officer (OCISO)