Chapter 3 IT Security.pdf

Last revised (Transmittal 15-038) March 10, 2026

Guide to Judiciary Policy Vol. 15: Information Technology

Ch. 3: IT Security (Note: No unauthorized disclosure of this policy guidance outside the judiciary is permitted.)

§ 310 Information Technology (IT) Security Overview § 310.10 Overview § 310.20 Security Management Responsibilities

§ 320 IT Security Coordination § 320.20 Security Incident Response Handling

§ 330 Judiciary Network Security § 330.05 Encryption § 330.10 Network Management § 330.20 Request for Access to Judiciary Networks § 330.25 Antivirus Software § 330.30 Accessing the Internet from the Judiciary Network § 330.40 Ban on Peer-to-Peer File Sharing, Chat Rooms, Instant Messaging § 330.50 Personal Web Email Account Access Discouraged § 330.60 Remote Access to Private Judiciary Networks § 330.65 International Access to Judiciary Networks, Systems, and Data § 330.70 Connecting Wireless LANs to Private Judiciary Networks § 330.80 Voicemail System Security § 330.90 Publicly Accessible Judiciary Networks

§ 340 IT Security Training and Awareness § 340.10 For New Users § 340.20 For All Users § 340.25 IT Professionals § 340.27 Employees with Elevated Privileges § 340.30 Developing an IT Security Training and Awareness Program

§ 350 Witness Security Cases

§ 360 System Backups § 360.10 Frequency of Backups § 360.20 Testing of Backup Media and Procedures § 360.30 Storage of Backup Media § 360.40 Documentation for Producing and Storing Backups

§ 370 Managing System Vulnerabilities § 370.10 Security Log Management § 370.20 Security Patch Management https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-1-governance-and-authorities/ch-1-guide-introduction-and-public-disclosure#120

Guide to Judiciary Policy, Vol. 15, Ch. 3 Page 2

§ 380 Security Policy Exceptions

§ 390 Identification and Authentication

§ 310 Information Technology (IT) Security Overview

§ 310.10 Overview

(a) Responsibility

Chief judges, court unit executives, federal public defenders (FPDs), and the Director of the Administrative Office of the U.S. Courts (AO) must ensure that local procedures are developed and implemented to protect the confidentiality, integrity, and availability of information residing on, processed on, or transmitted by their respective judiciary IT assets. See:

§ 330; JCUS-SEP 2005, p. 27; Report of the Committee on Information Technology: Judiciary Network Security and Privacy.

(b) Definitions

(1) As used in this chapter, the term “court unit executive” (CUE) includes:

• circuit executives;

• district court executives;

• clerks of court;

• chief probation and pretrial officers;

• senior staff attorneys;

• chief circuit mediators;

• bankruptcy administrators; and

• circuit librarians.

(2) As used in this chapter, the term “user” includes the following individuals who require access to judiciary networks:

• judiciary permanent, temporary, and term personnel, including judges;

• contractors;

• employees detailed or temporarily assigned from non-judiciary

U.S. government agencies;

• work training program participants (see: Guide, Vol. 12, § 555.30 (Definitions); and

• volunteer employees (including student volunteers) (see: Guide, Vol. 12, § 550.27 (Definitions)).

https://www.uscourts.gov/file/2152/download https://jnet.ao.dcn/information-technology/judiciary-network-security-and-privacy https://jnet.ao.dcn/information-technology/judiciary-network-security-and-privacy https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-12-human-resources/ch-5-employment#555_30 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-12-human-resources/ch-5-employment#555_30 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-12-human-resources/ch-5-employment#550_27 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-12-human-resources/ch-5-employment#550_27

Guide to Judiciary Policy, Vol. 15, Ch. 3 Page 3

(c) Internal Control

For relevant internal control requirements, see: Guide, Vol. 11, Ch. 6.

§ 310.10.10 IT Assets

The judiciary’s IT assets include:

(a) Networks and their infrastructure (e.g., servers, switches, cables, firewalls):

(1) the judiciary’s wide-area networks (WAN) (e.g., the Data Communications Network (DCN), Public Access to Court Electronic Records (PACER-Net), and Defender Services (DWAN));

(2) judiciary local area networks (LANs);

(3) judiciary-provided private and public wireless networks;

(4) courtroom IT systems; and

(5) phone systems.

(b) Devices and equipment owned by the judiciary that do not connect to judiciary systems or networks (e.g., information systems used in support of WITSEC).

(c) Devices and equipment forming or connected to judiciary systems or networks:

(1) judiciary-owned workstation computers and peripherals (e.g., printers, copiers, phones, fax machines);

(2) judiciary-owned portable computers and other mobile devices (e.g., laptops, tablets, smart phones, cell phones);

(3) digital media (including internal and external hard drives, USB drives, CDs, DVDs, and tapes); and

(4) supporting systems (e.g., power supply, HVAC systems in IT closets and facilities, communications connections).

(d) Software residing on judiciary systems, whether judiciary-developed (e.g., CM/ECF) or commercial (e.g., MS Word, Office 365, Outlook).

(e) Judiciary applications that are maintained on privately owned computers and mobile devices.

https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-11-internal-control/ch-6-information-systems-and-security

Guide to Judiciary Policy, Vol. 15, Ch. 3 Page 4

(f) Data and information:

(1) data and information maintained on judiciary systems and devices, including information available to the public on judiciary systems (e.g., CM/ECF, the judiciary’s websites, public kiosks);

(2) judiciary data and information on third-party systems by judiciary contract or other formal agreement (e.g., backup sites, alternate sites) (see: Documenting IT Security Agreements);

(3) judiciary data and information on the privately owned devices of users; and

(4) sensitive judiciary information, such as payroll records, contract files, etc.

§ 310.10.20 Importance of Security

The confidentiality, integrity, and availability of IT assets in the judiciary must be appropriately protected.

(a) Confidentiality

Non-public judiciary information must be protected from unauthorized access and disclosure. Such information includes, but is not limited to:

• chambers work product (e.g., draft opinions, confidential briefs, pre-released opinions, and orders);

• warrants;

• sealed cases (e.g., juvenile cases);

• budget and accounting material;

• personnel data (e.g., personal information about judiciary personnel, payroll); and

• source selection information.

(b) Integrity and Availability

(1) The integrity (accuracy) and availability (accessibility) of all IT assets in the judiciary must also be protected.

(A) Integrity ensures judiciary IT assets are protected from unauthorized modifications.

(B) Availability ensures judiciary IT assets are accessible when needed to conduct judiciary business.

https://jnet.ao.dcn/sites/default/files/information_technology/doc/security/documenting_it_security_agreements_rp.docx

Guide to Judiciary Policy, Vol. 15, Ch. 3 Page 5

(2) Examples of judiciary information for which integrity and availability are the primary concerns (rather than confidentiality):

• public information accessible via PACER (e.g., published decisions); and

• any information on judiciary public websites.

§ 310.10.30 Types of Security Threats

The confidentiality, integrity, and availability of the judiciary’s IT assets are vulnerable to both external and internal threats.

(a) External threats include, but are not limited to:

(1) Cyber-criminals, hackers or hacktivists (hackers who exploit technology for social causes), and other hostile actors such as nation states who may want to:

• learn the outcome of a case in advance;

• destroy or alter court electronic records or information available on a court website;

• disrupt the operations of the judiciary; or

• steal judiciary information, such as user credentials.

(2) Malicious software, such as spyware, phishing, ransomware, viruses, and worms.

(3) Natural and man-made environmental conditions, including:

• floods,

• blizzards,

• power outages,

• high temperature,

• high humidity,

• fire, or

• leaking water pipes.

(b) Internal threats include inadvertent (e.g., careless or negligent activity, activity from a compromised account) or deliberate (e.g., disgruntled employees, opportunists) actions by users who have been granted access to judiciary networks and systems, or by third-party compromise (i.e., related to vendor or contractor activity). Internal threats can result from a number of activities, including but not limited to:

(1) “shoulder surfing” to obtain user credentials or view sensitive information;

Guide to Judiciary Policy, Vol. 15, Ch. 3 Page 6

(Note: “Shoulder surfing” is when a user “looks over the shoulder” of another user to gain login and password information or to view judiciary information the user is not authorized to view.)

(2) performing or becoming a victim of social engineering (see: Social Engineering: Beware of Friendly Hackers);

(3) losing or having IT assets stolen;

(4) sharing sensitive judiciary data with untrusted third parties (e.g., forwarding sensitive judiciary information to a personal internet account, such as email or social media, or an online storage provider with whom the judiciary does not have a formal agreement to protect the stored information);

(5) failing to install updates and patches that protect IT systems from exposure to external threats, such as viruses and other malicious software; or

(6) failing to properly configure judiciary IT systems and assets (e.g., not using standard system images, not testing against industry recognized security benchmarks, and not disabling unnecessary services).

§ 310.20 Security Management Responsibilities

The development of information security policies, standards, and procedures is a collaborative effort between court units, federal public defender offices (FPDOs), and the AO.

(a) AO Director

(1) The AO Director is responsible for designating a senior professional to serve as the AO’s IT security officer (ISO).

(2) The AO Director also manages the judiciary’s IT security program activities subject to the oversight of the Judicial Conference. See:

28 U.S.C. § 612(j); Report of the Committee on Information Technology: Judiciary Network Security and Privacy; JCUS- SEP 2005, p. 27; Guide, Vol. 15, § 130.

(3) Under the direction of the AO Director, the AO’s Department of Technology Services’ IT Security Office carries out day-to-day administration of the national IT security program.

https://jnet.ao.dcn/information-technology/security/security-training-and-awareness-resources/security-awareness-brochures/friendly-hackers https://jnet.ao.dcn/information-technology/security/security-training-and-awareness-resources/security-awareness-brochures/friendly-hackers https://www.law.cornell.edu/uscode/text/28/612#j https://jnet.ao.dcn/information-technology/judiciary-network-security-and-privacy https://jnet.ao.dcn/information-technology/judiciary-network-security-and-privacy https://www.uscourts.gov/file/2152/download https://www.uscourts.gov/file/2152/download https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-1-overview#130

Guide to Judiciary Policy, Vol. 15, Ch. 3 Page 7

(b) Project Managers

Project managers of national and locally developed software applications are responsible for creating and maintaining a system security plan (SSP) that documents specific data protection requirements and processes for their applications and describes the safeguards fulfilling these requirements. Note: Court units and FPDOs are also responsible for developing SSPs to document safeguards protecting their LANs and any locally developed systems that are distributed across courts for national use. See: § 310.20.09.

(c) Chief Judges

(1) Chief judges are responsible for designating in writing a senior professional to serve as a court unit’s ISO.

(2) Additionally, chief circuit judges are responsible for designating in writing a senior professional to serve as the circuit ISO. See:

§ 310.20.07.

(3) The names of the designated ISOs and any alternates must be entered into InfoWeb. See: § 310.20.05.

(d) Court Unit Executives

The CUEs have the primary responsibility for information security within their court units.

(1) They are responsible for ensuring that security issues are coordinated with the court unit’s ISO and the AO.

(2) They should also coordinate with the General Services Administration (GSA) the regular testing and inspection of fire suppression equipment in computer facilities to ensure it is functioning properly. (3) Delegations of these responsibilities must be in writing. For further guidance on information security issue coordination, see: § 320.

(e) Defender Services Office Chief

The DSO Chief (or designee) has primary responsibility for information security for defender systems and FPDOs.

(1) The DSO Chief is responsible for ensuring security issues are coordinated with the AO.

https://infoweb.ao.dcn/net/Login

Guide to Judiciary Policy, Vol. 15, Ch. 3 Page 8

(2) The DSO Chief has authorized the National IT Operations and Applications Development (NITOAD) Branch to manage the day-to-day operation of the FPDOs’ national IT security program.

(f) Federal Public Defenders

FPDs, or their designees, have primary responsibility for information security within their offices.

(1) They are responsible for ensuring that their offices adhere to applicable IT security policy guidance found in Guide, Vol. 15, as well as policies published by the AO’s Defender Services Office

(DSO).

(2) They should also coordinate with GSA the regular testing and inspection of fire suppression equipment in computer facilities to ensure it is functioning properly.

(3) Delegations of these responsibilities must be in writing.

§ 310.20.05 Court Unit, FPDO, and AO IT Security Officer Responsibilities

(a) Each court unit, FPDO, and the AO must assign one individual in writing as its ISO and designate that individual (and any alternates) as such in the judiciary’s InfoWeb. The ISO designated in InfoWeb has primary, day-to-day responsibility for coordinating and facilitating information security issues within the court unit. See: Sample ISO Designation and Notification Letters.

(b) Each court unit, FPDO, and AO ISO is responsible for:

(1) implementing information security policies and procedures within his or her respective judiciary organization; and

(2) ensuring that all exceptions to IT security policies are documented and granted consistent with the local exceptions policy or consistent with national policy if a local exceptions policy does not exist. See: § 380 (Security Policy Exceptions).

§ 310.20.07 Circuit IT Security Officer Responsibilities

(a) The circuit ISO reports to the assistant circuit executive for automation (ACE). At the circuit executive’s (CE) discretion, the circuit ISO may report to the deputy CE or the CE (if there is no deputy CE position in the unit) instead of the ACE. See: Guide, Vol. 12, § 615.40.10(c)(1).

https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology https://infoweb.ao.dcn/net/Login https://jnet.ao.dcn/information-technology/security/sample-iso https://jnet.ao.dcn/information-technology/security/sample-iso https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-12-human-resources/ch-6-pay#615_40

Guide to Judiciary Policy, Vol. 15, Ch. 3 Page 9

(b) Under the ACE’s (or deputy CE’s or CE’s) direction, the circuit ISO has day-to-day responsibility for coordinating security issues that cross court boundaries and for addressing security issues that affect the whole circuit.

(c) The circuit ISO is responsible for communicating regularly (at least semiannually) with court unit and FPDO IT managers/ISOs (collectively referred to as “IT security stakeholders”) within each circuit and for coordinating with those stakeholders as well as the AO national IT security program to review information security matters. A significant portion of circuit ISO time should be dedicated to supporting IT security initiatives of court units and other IT security stakeholders within the circuit.

(d) The ACEs (or deputy CEs or CEs) supervise the circuit ISO’s implementation of the Judiciary IT Security Scorecard (Scorecard), resources, and associated processes (such as methods for completing and submitting the Scorecard). Each circuit ISO reviews the Scorecard, supporting resources, and associated processes at least annually and submits recommendations for their improvement to the AO as needed.

(e) ACEs assist the circuit ISOs in providing guidance on the Scorecard’s implementation to IT security stakeholders within their respective circuits and advise judiciary units on methods for scoring metrics in a repeatable, accurate, consistent, and independently verifiable manner across circuits.

See: § 310.20.20.

(f) Excepting Scorecard-related implementation support, circuit ISO participation in national projects and projects outside their circuits will be considered for approval by the circuit’s ACE (or deputy CE or CE).

§ 310.20.09 System Security Plans

Court units, FPDOs, and the AO are responsible for developing SSPs that document the security of the IT assets within their system boundary, such as their LAN. An SSP provides an overview of the security requirements for an information system and describes the safeguards (in place, inherited, or planned for implementation) selected to protect the information processed. For assistance creating SSPs, see: Judiciary Information Security Framework Self-Help Portal.

§ 310.20.10 System Security Policies and Procedures

(a) Each court unit, FPDO, and the AO must have documented information security policies in place that are available to all users, reviewed at least annually, and updated as necessary.

(b) These security policies must be referred to in the SSP within the applicable safeguard section.

https://jnet.ao.dcn/information-technology/security/framework-shp/ https://jnet.ao.dcn/information-technology/security/framework-shp/

Guide to Judiciary Policy, Vol. 15, Ch. 3 Page 10

(c) Court units may choose to develop these policies in collaboration with other court units at the district or circuit level. Likewise, FPDOs and the AO may choose to collaborate policy development efforts with other organizations of similar scope and purpose.

(d) Corresponding standard operating procedures for each policy must be developed.

(e) At a minimum, before operational deployment of IT systems, local policies and procedures must be developed for each topic area (section) addressed in this chapter, as well as:

(1) System configuration and hardening (e.g., use of standard system images, testing against industry recognized security benchmarks, and disabling unnecessary services);

(2) Data management, including information backup, system logging, contingency planning, disaster recovery, and access control; and

(3) Appropriate use of judiciary computer systems (see: Guide, Vol. 15, § 515.30 and § 525.40).

(f) The following resources will assist with the execution of security management responsibilities:

(1) Guidance Related to National IT Security Policy

(2) Circuit IT Security Officer Position Description

(3) Court Unit IT Security Officer Position Description

(4) IT Security Self-Assessment Scorecard

(5) Judiciary Information Security Framework Self-Help Portal, which provides access to resources, including:

• Judiciary Information Security Framework

• Guide to Implementing the Judiciary Information Security

Framework

• Defining the System Boundary Resource Packet

(6) Guide, Vol. 15, Ch. 5 (Managing IT Resources)

(7) Incident Reporting and Response (JASIRC)

(8) IT Security Office Best Practices and Resource Packets https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-5-managing-it-resources#515_30 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-5-managing-it-resources#515_30 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-5-managing-it-resources#525_40 https://jnet.ao.dcn/information-technology/security/training-and-awareness/resources/national-it-security-policies-and-guidance https://jnet.ao.dcn/human-resources/human-resources-management/cps-position-description-samples/professional-administrative/cl-29-it-security-officer-circuit https://jnet.ao.dcn/human-resources/human-resources-management/cps-position-description-samples/professional-administrative/cl-28-it-security-officer-court-unit https://jnet.ao.dcn/information-technology/security/self-assessment-scorecard https://jnet.ao.dcn/information-technology/security/framework-shp https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-5-managing-it-resources https://jnet.ao.dcn/information-technology/security/training-and-awareness/incident-reporting-and-response-jasirc https://jnet.ao.dcn/information-technology/security/best-practices

Guide to Judiciary Policy, Vol. 15, Ch. 3 Page 11

(9) Standard for IT Security Logging

§ 310.20.20 IT Security Self-Assessment

(a) Periodic IT security self-assessments provide insight into the effective operation of local IT security programs relative to a critical subset of security performance measures. The results of the self-assessment inform IT security investments and security risk management activities within local and national IT security programs.

(b) Chief judges, CUEs, FPDs, and the AO Director must ensure that procedures are developed for conducting IT security self-assessments for their LANs.

(1) Court units, FPDOs, and the AO must conduct IT security self-assessments each calendar year consistent with locally developed procedures, which include the retention of supporting materials that substantiate metric scoring for the most recently submitted self-assessment.

(2) The results of the IT security self-assessment are recorded using the most current Judiciary IT Security Scorecard, which contains key performance metrics and benchmarks for its completion.

(A) The court unit ISO provides the completed self-assessment to the relevant CUEs, chief judge, chief circuit judge, circuit ISO, and the judiciary’s Chief Information Security Officer

(CISO).

(B) The FPDO ISO provides the completed self-assessment to the FPD, chief circuit judge, circuit ISO, NITOAD, and the judiciary’s CISO.

(C) The AO ISO provides the completed scorecard to the AO Director and the judiciary’s CISO.

(c) The AO is responsible for the administration of the self-assessment program, which includes:

(1) Performing routine maintenance of the scorecard, supporting resources, and associated processes (such as methods for completing and submitting the self-assessment);

(2) Managing changes to the self-assessment program using established governance structures, such as advisory councils, Judicial Conference committees, and working groups;

https://fedcourts.sharepoint.com/sites/zUSC-IT-Stds/Active_Standards/Forms/AllItems.aspx?id=%2Fsites%2FzUSC%2DIT%2DStds%2FActive%5FStandards%2FIT%5FSecurity%5FLogging%5FStandard%2Epdf&parent=%2Fsites%2FzUSC%2DIT%2DStds%2FActive%5FStandards https://jnet.ao.dcn/information-technology/security/self-assessment-scorecard https://jnet.ao.dcn/information-technology/security/self-assessment-scorecard

Guide to Judiciary Policy, Vol. 15, Ch. 3 Page 12

(3) Ensuring the scorecard and supporting guidance are available to judiciary IT security stakeholders by the first business day of the calendar year; and

(4) Assessing the accuracy of metric scoring during the court unit’s periodic (not to exceed five years) independent IT security assessment (see: Court Unit IT Security Assessment Service).

§ 320 IT Security Coordination

§ 320.20 Security Incident Response Handling

(a) Definition

A security incident or malicious activity is any real or suspected adverse event impacting the security of judiciary IT assets (see: § 310.10.10) and users. These include, but are not limited to:

• attempts to gain unauthorized access to a system or its data;

• unauthorized disclosure of non-public judiciary data

• unwanted disruption or denial of service;

• unauthorized use of a system for processing, accessing, or modifying, or destroying data; and

• changes to system hardware, firmware, software, or access control characteristics without the owner’s consent.

(b) National Intrusion Detection Systems

At the national level, intrusion detection systems are employed at the judiciary’s internet gateways to detect, investigate, and report suspected or confirmed malicious activities.

(c) Local Incident Response Plans

(1) Court units, FPDOs, and the AO must develop a local incident response plan that addresses the effective handling of security incidents. At a minimum, the incident response plan must contain:

• documented incident response roles and responsibilities;

• incident reporting and response procedures;

• incident notification procedures;

• testing; and

• incident response training and awareness activities

(see: § 320.20.10).

https://jnet.ao.dcn/information-technology/security/court-unit-it-security-assessment

Guide to Judiciary Policy, Vol. 15, Ch. 3 Page 13

(2) For court units and FPDOs that provide IT services to other court units and FPDOs, respectively, ensure the local incident response plan includes how incidents are handled for supported organizations. Service level agreements (SLAs) must include how incidents are handled for the supported organization. The following resources may be helpful:

• Cybersecurity Sample Agreement Requirements

• Shared Administrative Services

(d) Addressing and Reporting Security Threats

(1) The ISOs must address security threats directed against local IT assets within their respective system boundaries.

(2) All critical incidents (e.g., spread of malware to the DCN) and serious incidents (e.g., courthouse protest accompanied by cyberattacks) must be reported immediately to the Security Operations Center (SOC), by email or by phone at 202-502-4370.

This support is available 24 hours a day, seven days a week.

(3) For FPDOs, all critical incidents and serious incidents must be reported immediately to NITOAD by email or by phone at 210-308- 3200.

(4) For detailed guidance on incident handling and roles and responsibilities for ISOs and for a detailed description of a critical or serious incident, see: Judiciary Security Operations Center:

Incident Response Plan.

§ 320.20.10 Resources for Developing Security Incident Response Documentation

(a) Court units, FPDOs, and the AO must have published procedures for reporting suspected or confirmed IT security incidents, and employees must be made aware of these procedures.

(b) The following resources may be useful for developing a local security incident response policy, plan, and corresponding procedures:

(1) Examples of IT Security Incident Response Policies;

(2) Incident Response Resource Packet;

(3) Judiciary Security Operations Center: Incident Response Plan; and

(4) For AO only: AO Manual, Volume 9 (Information Technology), Chapter 5 (Security Policies), § 510.50 (Protective Measures).

https://jnet.ao.dcn/information-technology/security/security-engineering-resources/cybersecurity-sample-agreement-requirements https://jnet.ao.dcn/financial-management/shared-administrative-services mailto:soc@ao.uscourts.gov mailto:Security_Support@fd.org https://jnet.ao.dcn/information-technology/security/judiciary-security-operations-center-incident-response-plan https://jnet.ao.dcn/information-technology/security/judiciary-security-operations-center-incident-response-plan https://jnet.ao.dcn/information-technology/security/best-practices-resource-packets-and-guidelines/compendium-it-security-policies https://jnet.ao.dcn/sites/default/files/information_technology/library/security/it_security_incident_response_rp.docx https://jnet.ao.dcn/information-technology/security/judiciary-security-operations-center-incident-response-plan

Guide to Judiciary Policy, Vol. 15, Ch. 3 Page 14

§ 330 Judiciary Network Security This section describes the minimum requirements governing judiciary network security.

Court units, FPDOs, and the AO may impose more restrictive policies for their respective LANs.

§ 330.05 Encryption

Data that may cause the U.S. government, or a party to a case, harm or embarrassment if released or disclosed by accident or theft must be encrypted if it travels or is stored outside of judiciary networks, including mobile devices.

§ 330.10 Network Management

The judiciary’s private enterprise network is composed of:

• WANs (e.g., DCN, PACER-Net, DWAN);

• all LANs (most notably, court unit, FPDO, and AO wired or wireless LANs) interconnected by WANs; and

• the national services deployed to connect users to the minimum resources they need to get their work done, including directory services, asset, content, and network control.

The following tools assist to secure judiciary networks and their related infrastructures.

(a) Centrally managed court-unit premises firewalls must be installed as the DCN device that delineates the DCN from the court-unit LAN. These firewalls will reside within the DCN information system boundary.

(b) Centrally managed firewalls must be installed on the FPDO premises directly in-line between the infrastructure that connects the DWAN to the FPDO LAN. These firewalls will be managed by NITOAD and will reside within the DWAN information system boundary.

(c) The identity, credentials, and access management (ICAM) solution across the judiciary is a foundational and critical element of an effective zero trust architecture, as well as a logical framework for an effective multi-factor authentication system. The ICAM solution requires that:

(1) all court units must fully collapse (migrate) both their user and computer objects into the National Active Directory, which allows centralized management at the national level; and

Guide to Judiciary Policy, Vol. 15, Ch. 3 Page 15

(2) users must only log in to devices that are accessing judiciary assets with their national credentials (i.e., their JENIE password).

§ 330.10.10 Authority

The Judiciary Network Security and Privacy Report, developed by the Committee on Information Technology and approved by the Judicial Conference in 2005, authorizes the establishment of judiciary network security and management policies. See: JCUS- SEP 2005, p. 27; Network Management Policy [2007-05].

§ 330.10.20 Areas of Responsibility

Department or Group Responsibilities

(a) Court Unit/FPDO Management of LANs up to, but not including, the AO-provided WAN devices, and maintenance of security for all IT components (e.g., servers, copiers, switches) connected to the LAN.

(b) AO’s Defender Services Office, NITOAD

• Management of the DWAN up to and including the routers and firewalls that connect the FPDO LANs.

• Intrusion detection and prevention, vulnerability scanning, remote access, and event correlations and analytics at the national gateways for the DWAN.

• Blocking of malicious activities or use of prohibited technologies at the DWAN internet gateways or national managed firewalls that may cause security breaches. These responsibilities include the use of technologies to detect vulnerabilities and block malicious activity anywhere within the DWAN, including within encrypted connections.

(c) AO’s Department of Technology Services, Cloud Hosting and Networks Office, Enterprise Operations Center

Installation and management of the DCN up to and including court-unit premises Judiciary Firewall Service, WAN switches, and WAN routers that connect the court LANs to the DCN.

(d) AO’s Department of Technology Services, IT Security Office

• Intrusion detection and prevention;

• Incident response;

• Security testing (includes vulnerability scanning, penetration testing, comprehensive security assessment);

• Emergency measures;

• Event correlation and analysis; and

• Blocking malicious activity, such as connectivity to known hostile sites and the use of prohibited technologies at the national internet gateways (e.g., peer-to-peer with external parties) that may cause security breaches.

https://jnet.ao.dcn/information-technology/judiciary-network-security-and-privacy https://www.uscourts.gov/file/2152/download https://www.uscourts.gov/file/2152/download https://jnet.ao.dcn/information-technology/network-management-policy

Guide to Judiciary Policy, Vol. 15, Ch. 3 Page 16

§ 330.10.20 Areas of Responsibility

Department or Group Responsibilities

Note: These responsibilities include the use of technologies to detect vulnerabilities and block malicious activity in IT assets anywhere within judiciary networks, including within encrypted connections. Best efforts must be made to protect the confidentiality of network communications.

(e) AO’s Department of Technology Services, System Development and Support Office

• Directory services;

• Full identity lifecycle management;

• Identity, credential, and access management;

• Providing software systems that store, organize and provide access to directory information in order to unify network resources by using transparency for both protocols and network topology, permitting users to access resources regardless of the physical location of the devices.

§ 330.10.25 Default Settings

Vendor and default credentials must be changed before deployment of information systems and devices.

§ 330.10.30 Network Security Management Activities

To ensure efficient use of capacity and the integrity of the entire network, system managers must coordinate efforts with their respective ISO to utilize a variety of network management tools and strategies. The following are examples of network security management activities that can be used to manage the WAN and LANs:

(a) Using enterprise-licensed security tools. See: Tools – Security Operations Center (SOC).

(b) Performing routine vulnerability scans and incident detection and response activities. See: IT Security Assessment Services; IT Security Incident Response Resource Packet.

(c) Implementing configuration and change management techniques. See:

Configuration Management Resource Packet.

(d) Performing continuous monitoring of safeguard effectiveness. See:

Continuous Monitoring of Safeguard Effectiveness Resource Packet.

https://jnet.ao.dcn/information-technology/security#security_tools_and_related_services https://jnet.ao.dcn/information-technology/security#security_tools_and_related_services https://jnet.ao.dcn/information-technology/security#assessment_and_testing https://jnet.ao.dcn/sites/default/files/information_technology/library/security/it_security_incident_response_rp.docx https://jnet.ao.dcn/sites/default/files/information_technology/library/security/it_security_incident_response_rp.docx https://jnet.ao.dcn/information-technology/security/configuration-management-resource-packet https://jnet.ao.dcn/sites/default/files/information_technology/library/security/Conti_Mon_Control_Effectiveness_RP.docx

Guide to Judiciary Policy, Vol. 15, Ch. 3 Page 17

(e) Disconnecting inactive sessions or activating password-protected screen savers after a defined period of inactivity to prevent unauthorized system access.

§ 330.10.40 IT Security Architecture

(a) Chief judges, CUEs, and the AO Director must ensure that:

(1) Court units and the AO, including national program offices, implement nationally supported solutions provided by the AO for the protection of judiciary IT assets (see: § 310.10.10);

(2) Data generated by nationally supported solutions (see: paragraph (c), below) are forwarded for examination by a centralized AO-managed service, and local court units will retain access to their local data;

(Note: This process allows the AO to analyze the judiciary’s IT operational and security status, improve its network performance and health, and strengthen its overall cybersecurity posture. The AO Director must implement protections to maintain this data’s confidentiality.)

(3) Exceptions are documented according to § 380 only when use of a nationally supported solution is not technically or financially feasible; and

(4) Individual court units may employ additional tools provided that they do not interfere with the functionality of the nationally supported solutions.

(b) FPDs must ensure that:

(1) FPDOs implement nationally supported solutions provided by NITOAD for the protection of judiciary IT assets;

(2) Data generated by nationally supported solutions is sent for examination by a centralized NITOAD-managed service, with local FPDOs retaining access to their local data;

(Note: The Chief of the AO’s Defender Services Office must, through providing funding to NITOAD, implement protections to maintain this data’s confidentiality.)

(3) Exceptions are requested from the Chief of the AO’s Defender Services Office, with documentation submitted to NITOAD

Guide to Judiciary Policy, Vol. 15, Ch. 3 Page 18 consistent with § 380, only when use of a nationally supported solution is not technically or financially feasible; and

(4) Individual FPDOs may employ additional tools provided that they do not interfere with the functionality of the nationally supported solutions.

(c) At a minimum, nationally supported solutions will perform:

(1) Periodic vulnerability scanning for the timely identification of system weaknesses;

(2) Patch management to ensure the timely remediation of system vulnerabilities, that are consistent with organizational risk tolerance (see: § 370.20);

(3) Centralized log management of all security-relevant events to identify system activity anomalies and to mitigate the effects of a compromise (see: § 370.10);

(4) Web-based threat protection to prevent malicious software from harming judiciary networks via their internet connections (see:

§ 330.90(c)(5));

(5) Endpoint protection to secure all judiciary-owned and non-judiciary-owned IT hardware assets (e.g., computers, laptops, servers) that access judiciary networks against malware and malicious intrusion (see: § 330.25); and

(6) Mobile device management to enable consistent administration of judiciary-issued mobile devices (see: Guide, Vol. 15, § 510, § 525, and § 570).

(d) For additional resources, configuration requirements, and information on requesting implementation of services, see:

• Vulnerability Scanning Service

• Patch and Asset Management Service

• National Logging Service

• Web-Based Threat Protection Service

• Endpoint Protection Service

• Mobile Device Management Service

• Standard for IT Security Logging https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-5-managing-it-resources#510 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-5-managing-it-resources#525 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-5-managing-it-resources#570 https://jnet.ao.dcn/information-technology/security/vulnerability-scanning-service https://jnet.ao.dcn/information-technology/security/patch-mgmt https://jnet.ao.dcn/information-technology/networks/national-logging-service https://jnet.ao.dcn/information-technology/security/local-web-based-threat-protection-service https://jnet.ao.dcn/information-technology/contracts-and-enterprise-agreements/symantec-endpoint-protection https://jnet.ao.dcn/information-technology/enterprise-communication/mobile-devices https://fedcourts.sharepoint.com/sites/zUSC-IT-Stds/Active_Standards/Forms/AllItems.aspx?id=%2Fsites%2FzUSC%2DIT%2DStds%2FActive%5FStandards%2FIT%5FSecurity%5FLogging%5FStandard%2Epdf&parent=%2Fsites%2FzUSC%2DIT%2DStds%2FActive%5FStandards

Guide to Judiciary Policy, Vol. 15, Ch. 3 Page 19

§ 330.20 Request for Access to Judiciary Networks

(a) Chief judges, CUEs, FPDs, and the AO Director must ensure that procedures for on-site access to judiciary networks are developed and access given only when authorized.

(b) To ensure on-site access is authorized, all access requests and approvals must be documented in a locally accepted format by a senior manager (e.g., CUE, IT director, or ISO). This documented process should include both the end-user accounts that require access and their level of access (e.g., all or a subset of court applications and the user’s associated privileges). Periodically, but not less than annually, these accounts should be reviewed for on-going legitimacy (e.g., a user may have changed duties and no longer requires access to a specific asset). The request and approval must be in writing.

(1) IT staff must work with appropriate court unit, FPDO, or AO management to determine and securely implement the proper level of access required by a user. Usage can be restricted, limiting access to single servers on the LAN or network segments, for specific times, and to certain services, if desired.

(2) Court units, FPDOs, and the AO must align local applications to make use of National Single Sign On wherever practical. When impractical, an exception to policy must be requested consistent with § 380.

(3) Access to judiciary networks for all users may only be provided after applicable background checks and/or investigations have been completed. If access is provided based upon a provisional appointment, this access must be restricted only to essential functions until the full results of a pending background check or investigation have been positively adjudicated. See: Guide, Vol. 12, § 570 (Background Checks and Investigations).

(4) If the on-site access request includes a request for remote access, appropriate court unit, FPDO, or AO management must make a determination that the remote connection is in the best interest of the judiciary and is necessary for the successful performance of an individual’s duties. See: § 330.60.

(5) Nationally managed credentials must be used for accessing judiciary IT assets.

https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-12-human-resources/ch-5-employment#570 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-12-human-resources/ch-5-employment#570

Guide to Judiciary Policy, Vol. 15, Ch. 3 Page 20

(c) Chief judges, CUEs, FPDs, and the AO Director must ensure that privileged user accounts are assigned only to those IT personnel requiring privileged access to local IT systems to execute their assigned duties.

(1) IT personnel may only use the privileged account for these duties.

(2) All other activities must be performed using non-privileged access.

(3) Privileged account activity must be logged and regularly reviewed by a designated privileged user distinct from the privileged user who performed the activity. See: § 370.10.

§ 330.20.10 Student Volunteer and Work Training Program Participant Access Limitations

(a) No student volunteers as defined in Guide, Vol. 12, § 550.27, or work training program participants as defined in Guide, Vol. 12, § 555.30, may receive JENIE credentials or be permitted access to any non-public judiciary networks, systems, or electronically stored data unless:

(1) The student volunteer or work training program participant has received a positive suitability determination from a background check or investigation commensurate with the sensitivity level of the information the volunteer will be able to access (see: Guide, Vol. 12, § 550.30(d), § 555.40(e), and § 570);

(2) The student volunteer or work training program participant only uses government-furnished equipment (GFE) when accessing non-public judiciary networks and systems; and

(3) The student volunteer or work training program participant only accesses judiciary IT assets and environments from within the United States and its territories.

(b) For a student volunteer or work training program participant to receive JENIE credentials or be permitted access to non-public judiciary networks or systems, a written request must be submitted explaining the reason for the request, representing that the three criteria identified in paragraph (a) have been satisfied, and providing a detailed list of the non-public judiciary networks, systems, and/or electronically stored data the student volunteer or work training program participant will be able to access as well as a plan to protect the security and confidentiality of the judiciary’s IT networks, systems, and electronically stored data.

(1) A court or court unit must submit the request to the circuit’s information security officer.

https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-12-human-resources/ch-5-employment#550_27 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-12-human-resources/ch-5-employment#555_30 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-12-human-resources/ch-5-employment#550_30 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-12-human-resources/ch-5-employment#550_30 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-12-human-resources/ch-5-employment#555_40 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-12-human-resources/ch-5-employment#570

Guide to Judiciary Policy, Vol. 15, Ch. 3 Page 21

(2) The circuit executive or the circuit judicial council is responsible for approving court or court unit requests for exceptions.

(3) FPDOs must submit the written request to the FPDO information security officer.

(4) NITOAD is responsible for approving FPDO requests for exceptions.

§ 330.25 Antivirus Software

Antivirus software with current malware definition is mandatory on all judiciary-owned and non-judiciary-owned IT assets (computers, laptops, servers, and mobile devices) that access judiciary networks, including virtual machines. See: § 330.60.60.

§ 330.30 Accessing the Internet from the Judiciary Network

(a) For any computer connected to the judiciary network, access to the internet must be provided only through national gateway connections.

(b) Operations and security of those gateways are under the administrative, managerial, and logistical control of the AO, subject to the direction of the Judicial Conference or, where appropriate, Conference committees.

(c) All court units, FPDOs, and the AO must adopt their own policies that establish local responsibility for managing user access to and use of the internet and provide guidance on the responsible use of the internet. See:

JCUS-SEP 1997, pp. 52-53; JCUS-SEP/OCT 2001, pp. 43-44; Guide, Vol. 15, § 510.

§ 330.40 Ban on Peer-to-Peer File Sharing, Chat Rooms, Instant Messaging

(a) Judiciary users may only use instant messaging (IM) features on the DCN if they are provided in applications that function entirely within the DCN or DWAN (e.g., Office 365).

(b) The use of applications that employ peer-to-peer file sharing, chat rooms, and instant messaging for communicating outside the DCN is prohibited.

These applications, such as BitTorrent and Tor, pose extraordinary security risks to the judiciary’s IT infrastructure and can be blocked at the internet gateways until the security risks posed by their use can be mitigated.

(c) As with any gateway blocking, if an official need should arise, the blocking can be temporarily lifted or other methods can be used to allow access to https://www.uscourts.gov/file/2126/download https://www.uscourts.gov/file/2138/download https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-5-managing-it-resources#510 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-5-managing-it-resources#510

Guide to Judiciary Policy, Vol. 15, Ch. 3 Page 22 a particular site. Exceptions may also be granted for users with disabilities who use these technologies for official communication purposes.

(1) Requests for Exceptions

(A) Court units can request exceptions from the AO’s Chief Information Officer (CIO)/Associate Director for Technology Services.

(B) FPDOs may request exceptions from the Chief of the AO’s Defender Services Office.

(2) Approval of Requests

Final determination to grant such exceptions is made by the AO Director. See: § 310.20.

§ 330.50 Personal Web Email Account Access Discouraged

(a) Access to personal web email accounts (e.g., Gmail, Yahoo) from within the DCN or DWAN is strongly discouraged. Use of these accounts poses threats to the judiciary’s IT infrastructure because web email messages and their attachments bypass the existing network anti-virus protections in place at the internet gateways and email servers.

(b) Sending sensitive judiciary information to or through personal web email accounts outside the judiciary network is also discouraged because the email accounts do not afford the user sufficient security or privacy.

(c) Procedures further restricting the use of personal web email may be developed and implemented locally.

§ 330.60 Remote Access to Private Judiciary Networks

Chief judges, CUEs, FPDs, and the AO Director must ensure that local procedures are developed and implemented to grant remote access to judiciary networks only when authorized.

Note: This subsection describes when remote access is permitted and the security requirements to be applied whenever managers authorize remote connections to private judiciary networks by Virtual Private Network (VPN) or Remote Access Server (RAS) technologies.

§ 330.60.10 Purpose of Remote Access

The use of VPN and RAS technologies to access judiciary networks from remote locations effectively extends the judiciary network beyond the wired courthouse and

Guide to Judiciary Policy, Vol. 15, Ch. 3 Page 23 other judiciary locations. VPN and RAS technologies are used in the judiciary for remote judiciary-network access to telework or to perform other work-related activities on judiciary- or user-owned computers to ensure the transmission is protected while connected to the judiciary network.

§ 330.60.15 Resources for Further Information on Remote Access to Judiciary Networks

The following JNet resources may be useful in implementing the use of remote access to judiciary networks:

• Guide, Vol. 12, Ch.