Attachment_002-_FRTIB_Rules_of_Behavior.docx

Federal Retirement Thrift Investment Board’s TIB-2018-RFP-0004 Rules of Behavior for Accessing IT Systems Outside Legal Counsel

In accordance with FRTIB’s Enterprise Information Security and Risk Management (EISRM) directive and policies, and to protect the confidentiality, integrity and availability of data processed and owned by FRTIB, users must follow the FRTIB Rules of Behavior for Accessing IT Systems.

√ I acknowledge that users are accessing an FRTIB information system. Use by unauthorized persons, or for personal business, is prohibited and may constitute a violation of 18 U.S.C. 1030 and other Federal laws. USERS HAVE NO REASONABLE EXPECTATION OF PRIVACY while performing work on any information system that processes, transmits, or stores FRTIB data.

√ I acknowledge that all data contained on information systems in support of FRTIB is owned by the FRTIB and may be monitored, intercepted, recorded, read, copied, or captured in any manner and disclosed in any manner, by authorized personnel. FRTIB may give law enforcement officials any potential evidence of crime, fraud or employee misconduct found on FRTIB information systems. Furthermore, law enforcement officials may be authorized to access and collect evidence from this system. USE OF THIS SYSTEM BY ANY USER, AUTHORIZED OR UNAUTHORIZED, CONSTITUTES EXPRESS CONSENT TO THIS MONITORING.

√ I acknowledge that monitoring includes but is not limited to: review of audit logs of any IT device used to support FRTIB; review for inappropriate access and use of the Internet; review of electronic communication activity for inappropriate content; and review of any workstations or servers used to process FRTIB data (regardless if the workstation or server is owned by FRTIB or a Contractor).

√ I acknowledge that all users requiring access to FRTIB information systems shall successfully complete FRTIB Cyber Security Awareness and General Privacy training on an initial and annual basis as required or risk having their access suspended.

√ I acknowledge that I may have access to sensitive information depending on my job duties.

√ I acknowledge my responsibility to ensure the confidentiality, integrity, and availability of FRTIB information in a manner consistent with its sensitivity.

√ By being granted access to potential sensitive information, I am obligated to protect this information from unauthorized disclosure.

√ I will obtain, use or disclose such data only in connection with the performance of my official duties solely for authorized purposes. I will not disclose any data to other agencies or persons not expressly authorized to receive or have access to the data. I will make any such authorized disclosures in accordance with established regulations and procedures.

√ I will encrypt any Personally Identifiable Information (PII) downloaded from FRTIB information systems on any portable storage device.

√ I will erase PII data downloaded from FRTIB information systems immediately when its official use is no longer required.

√ I will immediately report any security breach, password compromises, anomalies in system performance, or suspicious activities to FRTIB’s Service Desk.

√ I will protect my passwords and/or authentication tokens from disclosure and loss at all times. I will employ passwords in accordance with FRTIB’s EISRM policies.

√ I will never reveal my passwords to unauthorized individuals. I will not construct my password from obvious personal data, (i.e. social security number, telephone numbers, relative's names, pet's name, etc.).

√ I understand that I am accountable for all actions taken under my User ID. I will not allow others to use my User ID and I will not access other users' accounts. I will not attempt to access accounts or data that are not expressly authorized to me.

√ I understand that when logged on, workstations are never to be left unattended. If I must leave my workstation unattended, I will ensure my workstation is locked prior to leaving. All activity occurring when the workstation is functioning is the responsibility of the logged-on user.

√ I understand that users may not install, use, or reproduce unauthorized or illegally obtained software. Privately owned software is prohibited from being used on government owned workstations. All installed software applications must be legally licensed to, or in support of, the FRTIB. Users may not reproduce copyrighted software without the vendor's written authorization. Compliance with copyright protections is required.

√ I understand that users shall not connect any unauthorized devices to ANY information system or network under any circumstance.

√ I understand that any changes in my employment status or changes in my job responsibilities may require my access to be modified or terminated.

√ I will ensure that any work performed remotely or off-site will be provided the same level of protection as provided at the office.

√ I understand that I am using an unclassified information system and that I am NEVER authorized to originate, process, and/or store classified information on an unclassified system.

√ I understand that any user who does not comply with these rules is subject to adverse actions, including suspension or cancellation of system privileges, possible criminal prosecution, or termination of employment. FRTIB will enforce the use of penalties against any user who willfully violates EISRM policies.

√ I understand that this agreement shall not nullify or affect in any manner any other secrecy or nondisclosure agreement which I have executed or may execute with FRTIB.

√ I understand that I shall never attempt to tamper with, circumvent, or otherwise impede the effectiveness of any security controls. I understand that I shall never install or utilize any tools designed to assist in doing the same.

Top of Form My sigMyMy signature below is my acknowledgement that I understand my responsibilities and that I will comply with these rules of behavior.

Bottom of Form

Addendum: FRTIB Rules of Behavior for Privileged User Accounts The FRTIB Rules of Behavior for Privileged User Accounts is an addendum to the FRTIB Rules of Behavior for Accessing IT Systems and provides common rules on the appropriate use of FRTIB information technology resources for FRTIB privileged users, including Federal employees, interns, and contractors. Privileged user account roles have elevated privileges above those in place for general user accounts regardless of account scope (e.g., including both local and domain administrator accounts). Potential compromise of privileged user accounts carries a risk of substantial damage and therefore privileged user accounts require additional safeguards.

All users of privileged accounts must read these rules and sign the accompanying acknowledgement form in addition to the FRTIB Rules of Behavior for Accessing IT Systems before accessing FRTIB information, systems and/or networks in a privileged role.

I understand that as a Privileged User, I shall:

· Use my privileged user account(s) for official administrative actions only;

· Protect all privileged account credentials (passwords, tokens, etc.) at a security level commensurate with the highest level of data the that privileged account can access on the associated information system;

· Protect the administrative or root-level authentication information at the highest level demanded by the sensitivity of the system;

· Comply with all system/network administrator responsibilities in accordance with EISRM policies;

· Use special access privileges only when they are needed to carry out a specific system function that requires elevated privileges;

· Use a non-privileged (i.e., general user) account whenever administrative privileges are not required (e.g., e-mail, web browsing);

· Logon to my non-privileged account and then from that login to my privileged account to perform actions requiring privileges (to the maximum extent possible). For example, on a UNIX operating system, the user must login to a non-privileged account before logging in as “root,” and on a Microsoft Windows computer, the user must login to a non-privileged account before performing a privileged function that requires authentication as a privileged user;

· Notify the respective system owner immediately when privileged access is no longer required;

· Use precautionary procedures to protect a privileged account from fraudulent use;

· Watch for signs of inappropriate or illegal (e.g., hacker) activities or other attempts at unauthorized access and report them upon discovery;

· Read and enforce the system security controls as defined in the system security plan; and

· Complete any specialized role-based security or privacy training as required before receiving privileged system access.

I understand that as a Privileged User, I shall not:

· Share privileged user account(s) or password(s);

· Remove or destroy system audit, security, event, or any other log data unless authorized by the system owner in writing;

· Acquire, possess, trade, or use hardware or software tools that could be employed to evaluate, compromise, or bypass information systems security controls;

· Introduce unauthorized or malicious code into FRTIB information systems or networks;

· Knowingly write, code, compile, store, transmit, or transfer malicious software code, to include viruses, logic bombs, worms, and macro viruses;

· Use privileged user account(s) for day-to-day communications;

· Elevate the privileges of any user without prior approval from the system owner;

· Use special privileges for personal business, gain, or entertainment;

· Use privileged access to circumvent EISRM policies or security controls; or

· Use a privileged user account for Web access.

I have read the Addendum: FRTIB Rules of Behavior for Privileged User Accounts. I understand and agree to comply with its provisions. I understand that violations of the FRTIB Rules of Behavior for Privileged User Accounts or information security policies and standards may lead to disciplinary action, up to and including termination of employment; removal or debarment from work on FRTIB contracts or projects; revocation of access to FRTIB information, information systems, and/or facilities; and may also include criminal penalties and/or imprisonment. I understand that exceptions to the FRTIB Rules of Behavior for Privileged User Accounts must be authorized in advance in writing by the Chief Information Security Officer or his/her designee.

Page 1 (November 2013)