Attachment_003_FRTIB_Rules_of_Behavior.pdf

Federal Retirement Thrift Investment Board’s

Rules of Behavior for Accessing IT Systems

In accordance with FRTIB’s Enterprise Information Security and Risk Management (EISRM) policy and to protect the confidentiality, integrity and availability of data processed and owned by FRTIB, users of

FRTIB information systems must accept and follow the FRTIB Rules of Behavior for Accessing IT

Systems.

1. I understand and acknowledge that I HAVE NO REASONABLE EXPECTATION OF

PRIVACY while performing work on any information system that processes, transmits, or stores

FRTIB data.

2. I understand and acknowledge that all data contained on information systems in support of

FRTIB is owned by the FRTIB. User activity may be monitored, intercepted, recorded, read, copied, captured, or disclosed by authorized FRTIB personnel. FRTIB may give law enforcement officials any potential evidence of crime, fraud, or employee misconduct found on

FRTIB information systems. Furthermore, law enforcement officials may be authorized to access and collect evidence from this system. USE OF THIS SYSTEM BY ANY USER, AUTHORIZED OR UNAUTHORIZED, CONSTITUTES EXPRESS CONSENT TO

MONITORING.

3. I understand and acknowledge that monitoring includes, but is not limited to:

a. review of audit logs of any IT device used to support FRTIB;

b. review of access and use of the Internet while on the FRTIB network;

c. review of electronic communication activity; and

d. review of any device used to process FRTIB data (regardless of device ownership).

4. I understand and acknowledge that I shall successfully complete FRTIB Cyber Security

Awareness training and General Privacy training on an initial and annual basis as required or risk having my access suspended to FRTIB information systems.

5. I understand and acknowledge that I may have access to sensitive information depending on my job duties. I shall protect the confidentiality , integrity

, and availability of FRTIB information in a manner consistent with its sensitivity.

6. I understand and acknowledge that I will use FRTIB information only in connection with the performance of my official duties. I will not disclose FRTIB information to unauthorized persons.

I will not use non-FRTIB email accounts (i.e., Hotmail, Yahoo, AOL), or other external resources to conduct FRTIB business, thereby ensuring that official business is never confused with personal business.

7. I understand and acknowledge that I will encrypt Personally Identifiable Information (PII) or sensitive information:

a. downloaded from FRTIB information systems onto a FRTIB authorized portable storage device;

b. downloaded to any FRTIB authorized device; or

c. emailed to any entity external to the FRTIB organization (to a non “TSP.GOV” email address.)

1 NISTIR 7298, Revision 2 “Glossary of Key Information Security Terms” defines confidentiality as “The property that sensitive information is not disclosed to unauthorized individuals, entities, or processes.”

2 NISTIR 7298, Revision 2 defines integrity as “The property that sensitive data has not been modified or deleted in an unauthorized and undetected manner.”

3 NISTIR 7298, Revision 2 defines availability as “The property of being accessible and useable upon demand by an authorized entity.”

8. I understand and acknowledge that I will delete PII data downloaded from FRTIB information systems immediately when its official use is no longer required.

9. I understand and acknowledge that I will immediately report a security breach, password compromise, anomaly in system performance, or suspicious activity to FRTIB’s Service Desk.

10. I understand and acknowledge that I will protect my passwords and/or authentication tokens from disclosure and loss at all times. I will never reveal my passwords. I will not construct my password from obvious personal data (i.e. social security number, telephone numbers, relative's names, pet's name, etc.)

11. I understand and acknowledge that I am accountable for all actions taken under my User ID. I will not allow others to use my User ID and I will not access other users' accounts. I will not attempt to access accounts or data that are not expressly authorized to me.

12. I understand and acknowledge that when logged on, I will lock my workstation prior to leaving my workstation. All activity occurring when the workstation is active is the responsibility of the logged-on user.

13. I understand and acknowledge that I may not install, use, or reproduce unauthorized or illegally obtained software. Privately-owned software is prohibited from being used.

14. I understand and acknowledge that I shall not connect unauthorized devices to FRTIB information systems under any circumstance. Examples include, but are not limited to, personal external hard drives, personal flash/thumb drives, networked cameras, or microphones.

15. I understand and acknowledge that changes in my employment status or changes in my job responsibilities may require my access to be modified or terminated.

16. I understand and acknowledge that I am using an unclassified information system. I am NEVER authorized to originate, process, and/or store classified information on an unclassified system.

17. I understand and acknowledge that any user who does not comply with or violates these rules may be subject to appropriate administrative action, including suspension or cancellation of system privileges and/or disciplinary action up to and including removal from the Federal service. Under some circumstances, noncompliance or violation of these rules may result in criminal prosecution. FRTIB will enforce the use of appropriate penalties against any user who fails to comply or violates EISRM policies.

18. I understand and acknowledge that this agreement shall not nullify or affect in any manner any other confidentiality or nondisclosure agreement which I have executed or may execute with

FRTIB.

19. I understand and acknowledge that I shall never attempt to tamper with, circumvent, or otherwise impede the security of any FRTIB system. I understand and acknowledge that I shall never install or utilize any tools designed to assist in doing the same.

20. I understand and acknowledge that I am not authorized to post organizational data to social media or social networking sites. Only authorized users with cleared content by the Office of

External Affairs or the Office of Communications and Education may post to social media or social networking sites as required to support the organizational mission. I understand and acknowledge that personal use of social media while on work time or equipment must be limited with minimal cost to the government (see EISRM “Limited Personal Use” Policy) and must not interfere with my official FRTIB duties and responsibilities. I further understand and acknowledge that I may never use or reference my formal position when writing in a nonofficial capacity, may not use my FRTIB e-mail address to register on social networks, blogs, or other online tools utilized for personal use and that misconduct committed on social media that has a nexus to my position at FRTIB may result in appropriate discipline. I understand and acknowledge that when using social medial tools, whether on behalf of FRTIB or on my own time, I am bound by the Standards of Ethical Conduct for Employees of the Executive Branch, 5

C.F.R. Part 2635 and the Hatch Act (5 U.S.C. §§ 7321-7326).

21. I understand and acknowledge that I shall not take any government-furnished equipment (such as an FRTIB laptop or Blackberry device) outside the United States or the territories of the United

States without documented approval by the Chief Technology Officer.

My signature below affirms that I have read all twenty one (21) articles of the FRTIB Rules of Behavior listed above and that I understand and acknowledge my responsibilities under these rules of behavior and will comply with these rules of behavior whenever accessing FRTIB systems or Information.

Printed Name, Title, Department Signature Date

Addendum: FRTIB Rules of Behavior for Privileged User Accounts

The FRTIB Rules of Behavior for Privileged User Accounts is an addendum to the FRTIB Rules of

Behavior for Accessing IT Systems and provides common rules on the appropriate use of FRTIB information technology resources for FRTIB privileged users, including Federal employees, interns, and contractors. Privileged user account roles have elevated privileges above those in place for general user accounts regardless of account scope (e.g., including both local and domain administrator accounts).

Potential compromise of privileged user accounts carries a risk of substantial damage and therefore privileged user accounts require additional safeguards.

All users of privileged accounts must read these rules and sign the accompanying acknowledgement form in addition to the FRTIB Rules of Behavior for Accessing IT Systems before accessing FRTIB information, systems and/or networks in a privileged role.

I understand and acknowledge that as a Privileged User, I shall:

1. Use my privileged user account(s) for official administrative actions only;

2. Protect all privileged account credentials (passwords, tokens, etc.) at a security level commensurate with the highest level of data that the privileged account can access on the associated information system;

3. Protect the administrative or root-level authentication information at the highest level demanded by the sensitivity of the system;

4. Comply with all system/network administrator responsibilities in accordance with EISRM policies;

5. Use special access privileges only when they are needed to carry out a specific system function that requires elevated privileges on assigned systems;

6. Use a non-privileged (i.e., general user) account whenever administrative privileges are not required (e.g., e-mail, web browsing);

7. Logon to my non-privileged account and then from that login to my privileged account to perform actions requiring privileges (to the maximum extent possible). For example, on a UNIX operating system, the user must login to a non-privileged account before logging in as “root,” and on a

Microsoft Windows computer, the user must login to a non-privileged account before performing a privileged function that requires authentication as a privileged user;

8. Notify the respective system owner immediately when privileged access is no longer required;

9. Use precautionary procedures to protect a privileged account from fraudulent use;

10. Watch for signs of inappropriate or illegal (e.g., hacker) activities or other attempts at unauthorized access and report them to the Service Desk or Security Operations Center immediately upon discovery;

11. Read and enforce the system security controls as defined in the system security plan; and

12. Complete any specialized role-based security or privacy training as required before receiving privileged system access.

I understand and acknowledge that as a Privileged User, I shall not:

1. Share privileged user account(s) or password(s);

2. Create or logon to a group or shared user account;

3. Remove or destroy system audit, security, event, or any other log data unless authorized by the system owner in writing;

4. Acquire, possess, trade, or use hardware or software tools that could be employed to evaluate, compromise, or bypass information systems security controls;

5. Introduce unauthorized or malicious code into FRTIB information systems or networks;

6. Knowingly write, code, compile, store, transmit, or transfer malicious software code, to include viruses, logic bombs, worms, and macro viruses;

7. Use privileged user account(s) for day-to-day communications (to include accessing the Internet);

8. Use privileged user account(s) to access data or other information unless I am explicitly authorized to do as part of my official duties;

9. Elevate the privileges of any user without prior approval from the system owner;

10. Use special privileges for personal business, gain, or entertainment;

11. Use privileged access to circumvent EISRM policies or security controls; or

12. Use a privileged user account for Web access.

I have read the Addendum: FRTIB Rules of Behavior for Privileged User Accounts. I understand and acknowledge that any user who does not comply with or violates these rules may be subject to appropriate administrative action, including suspension or cancellation of system privileges and/or disciplinary action up to and including removal from the Federal service. Under some circumstances, noncompliance or violation of these rules may result in criminal prosecution. FRTIB will enforce the use of appropriate penalties against any user who fails to comply or violates ERISM policies. I understand and acknowledge that exceptions to the FRTIB Rules of Behavior for Privileged User Accounts must be authorized in advance in writing by the Chief Information Security Officer or his/her designee.

Addendum: FRTIB Rules of Behavior for Remote Access

In accordance with FRTIB’s Enterprise Information Security and Risk Management (EISRM) directive and policies, and to protect the confidentiality, integrity and availability of data processed and owned by FRTIB, users must accept and follow the FRTIB Rules of Behavior for Remote Access in order to be permitted to perform FRTIB duties from a remote location.

FRTIB Rules of Behavior for Remote Access apply to all FRTIB users (which includes government staff, contractors, vendors, and agents with a FRTIB-owned or personally-owned computer or workstation used to connect to the

FRTIB network.) FRTIB Rules of Behavior for Remote Access apply to remote access connections used to do work on behalf of FRTIB, including reading or sending email and viewing Intranet web resources. Remote access implementations that are covered include, but are not limited to, dial-in modems, frame relay, ISDN, DSL, VPN, SSH, and cable modems, etc.

1. Users (which includes FRTIB staff, contractors, vendors, and agents) with remote access privileges to

FRTIB's network are responsible for ensuring that their remote access connection is given the same security considerations as the user's on-site connection when connecting to FRTIB. For example, if an individual is processing sensitive personnel information via remote access, they would not process that information from a public facility such as a coffee shop or bookstore.

2. The user is responsible for ensuring unauthorized users do not access the FRTIB network, do not perform illegal activities, and do not use the access for outside business interests. The user bears responsibility for the consequences if the access is misused. Misuse of the user’s access by a non-FRTIB employee may result in disciplinary action, to and including removal from Federal service.

3. The user must strictly secure remote access. FRTIB will enforce access control public/private keys with strong pass-phrases.

4. Users are prohibited from sharing any FRTIB network passwords (email, SANDD, etc.) with any other person or entity.

5. Users with remote access privileges must ensure that their FRTIB-owned or personal computer is not connected to any other network at the same time.

6. Users with remote access privileges to FRTIB’s network must not use non- FRTIB email accounts (i.e., Hotmail, Yahoo, AOL), or other external resources to conduct FRTIB business, thereby ensuring that official business is never confused with personal business.

7. Reconfiguration of a home user's equipment for the purpose of split-tunneling or dual homing is not permitted at any time. Split-tunneling is having simultaneous direct access to a non-FRTIB network

(such as the Internet, or a home network) from a remote device (PC, PDA, WAP phone, etc.) while connected into FRTIB’s corporate network via a VPN tunnel. Dual homing is having concurrent connectivity to more than one network from a computer or network device. Examples include being logged into the FRTIB network via a local Ethernet connection and then dialing into AOL or another

Internet Service Provider; or being on a FRTIB-provided VPN tunnel and then connecting into a spouse’s remote access tunnel to their employment.

8. All hosts (which can include but are not limited to laptops, desktops, workstations, etc.) that are connected to FRTIB internal networks via remote access technologies must use the most up-to-date anti-virus software and definitions, this includes personal computers.

I have read the Addendum: FRTIB Rules of Behavior for Remote Access. My signature below is my acknowledgement that I understand and acknowledge my responsibilities and that I will comply with these rules of behavior.