Chapter 6 Information Systems and Security.pdf
PDF 223 KB Posted
- Solicitation number
- USCA26R0001
- Issued by
-
Administrative Office of the U.S. Courts
About this file
This document is a policy guidance chapter from the Guide to Judiciary Policy establishing minimum internal control requirements for the federal judiciary's information technology systems.
The policy mandates separation of duties whereby employees administering access rights cannot be the sole administrators of audit trails. Court unit executives and federal public defenders must conduct annual internal control assessments addressing IT security self-assessment requirements. All records and documentation must be maintained consistent with applicable judiciary records disposition schedules, with conflicts resolved by retaining records for the longer period. The Administrative Office Director, chief judges, and chief circuit judges must designate in writing senior professionals to serve as IT security officers, with designations entered into InfoWeb. Court unit executives and federal public defenders retain primary information security responsibility and must document this delegation in writing if assigned to others. Organizations must develop and maintain written information security policies reviewed at least annually, including system security plans, contingency/disaster recovery plans with off-site backup storage, configuration management documentation, local incident response procedures, physical security protections for IT facilities, security training and awareness procedures, and password policies consistent with specified standards. Anti-virus software with current malware definitions is mandatory on all judiciary-owned and non-judiciary-owned IT assets accessing judiciary networks. Access must be restricted to individuals with legitimate work-related need and terminated immediately upon separation, except for recall-eligible bankruptcy and magistrate judges. Vendor access terminates upon completion of scheduled activities. Data traveling outside judiciary networks or stored on mobile devices must be encrypted if capable of causing harm or embarrassment if disclosed. Security assessments must precede system deployment, security logs must be managed, user access reviewed annually, and unannounced annual reviews conducted by personnel other than access administrators to verify access rights conform to approved access. IT equipment with hard drives and memory devices must be sanitized of sensitive information.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| USCA26R0001_0001 4.3.26.pdf | ||
| Chapter 5 Managing IT Resources.pdf | ||
| ATTACHMENT 7 - Response to Questions USCA26R0001_0001 FE.pdf | ||
| Chapter 3 IT Security.pdf | ||
| 7 - Attachment 6 - Statement of Work Final FE.pdf | ||
| 7 - Attachment 1 - National Drug Lab Price Sheet FE.xlsx | XLSX spreadsheet | |
| 7 - Attachment 5 - Installation Plan.xlsx | XLSX spreadsheet | |
| 7 - Attachment 4 - Equipment and Reagent Requirements FE.docx | DOCX document | |
| 7 - Attachment 2 - Lab Location Info.xlsx | XLSX spreadsheet | |
| 7 - USCA26R0001 - RFP FE.pdf | ||
| 7 - Questions Submission Form Template.xlsx | XLSX spreadsheet | |
| 7 - Attachment 3 - Specifications for PACTS Interface.pdf |
Show all 12
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Last revised (Transmittal 11-019) July 28, 2023
Guide to Judiciary Policy Vol. 11: Internal Control
Ch. 6: Information Systems and Security
(Note: No unauthorized disclosure of this policy guidance outside the judiciary is permitted.)
§ 610 Overview
§ 620 Separation of Duties
§ 630 Internal Control Assessment
§ 635 Records Retention
§ 640 Assignment of Responsibility
§ 650 Appropriate Records and Documentation
§ 660 Access Restrictions
§ 670 Verification and Review
§ 610 Overview This chapter sets forth the minimum internal control requirements for the judiciary’s information technology systems. For more complete guidance, see:
• Guide, Vol. 15, Ch. 3 (IT Security)
• Guide, Vol. 15, Ch. 5 (Managing IT Resources)
• Judiciary Security Operations Center’s Incident Response Plan
• IT Security Training and Awareness Resources page of JNet
• Information Security Framework
• Guide to Implementing the Judiciary Information Security Framework
§ 620 Separation of Duties
If an employee is responsible for: The employee may not:
Administering access rights be the only person to administer audit trails.
https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-1-governance-and-authorities/ch-1-guide-introduction-and-public-disclosure#120 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-3-security https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-5-managing-it-resources https://jnet.ao.dcn/information-technology/security/judiciary-security-operations-center-incident-response-plan https://jnet.ao.dcn/information-technology/security/training-and-awareness https://jnet.ao.dcn/information-technology/security/information-security-framework/security-framework-self-help-portal https://jnet.ao.dcn/information-technology/security/framework-shp/jisf-guide
Guide to Judiciary Policy, Vol. 11, Ch. 6 Page 2
§ 630 Internal Control Assessment
(a) Court unit executives (CUEs) and federal public defenders (FPDs) must assess the adequacy of internal control systems and practices at least annually. See: Guide, Vol. 11, § 180 (Internal Control Assessment).
(b) CUEs and FPDs must address the requirements in Guide, Vol. 15, § 310.20.20 (IT Security Self-Assessment) for their annual internal control self assessment to be complete.
§ 635 Records Retention
(a) The court unit or federal public defender organization (FPDO) must maintain records and documentation required in Guide, Vol. 15 (Information Technology) consistent with the applicable judiciary records disposition schedule (Guide, Vol. 10, Appx. 6A, Appx. 6B, or Appx. 6C).
(b) If there is a conflict between the retention periods identified in Volume 15 and Volume 10, the records must be retained for the longer period.
§ 640 Assignment of Responsibility IT security designations must be made consistent with Guide, Vol. 15, § 310.20.10 (System Security Policies and Procedures), including the following requirements.
(a) The AO Director is responsible for designating a senior professional to serve as the AO’s IT security officer (ISO).
(b) Project managers of national and locally developed software applications are responsible for creating and maintaining a system security plan (SSP) that documents specific data protection requirements and processes for their applications and describes the safeguards fulfilling these requirements.
(c) Chief Judges
(1) Chief judges are responsible for designating in writing a senior professional to serve as a court unit’s ISO.
(2) Chief circuit judges are responsible for designating in writing a senior professional to serve as the circuit ISO. See: Guide, Vol. 15, § 310.20.07 (Circuit IT Security Officer Responsibilities).
https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-11-internal-control/ch-1-overview#180 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-3-security#310_20_20 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-3-security#310_20_20 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-10-public-access-and-records/ch-6-records-management/appx-6a-records-disposition-schedule-1 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-10-public-access-and-records/ch-6-records-management/appx-6b-records-disposition-schedule-2 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-10-public-access-and-records/ch-6-records-management/appx-6c-records-disposition-schedule-3 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-3-security#310_20_10 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-3-security#310_20_10 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-3-security#310_20_07 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-3-security#310_20_07
Guide to Judiciary Policy, Vol. 11, Ch. 6 Page 3
(3) New chief judges should review designations made by their predecessors, but it is not necessary to reissue a designation signed by a previous chief judge unless a change is desired.
(d) Court Unit Executives and Federal Public Defenders
(1) CUEs and FPDs have the primary responsibility for information security within their respective organizations.
(2) If CUEs or FPDs delegate these responsibilities, they must do so in writing.
(e) The names of the designated ISOs must be entered into InfoWeb.
§ 650 Appropriate Records and Documentation Court units, FPDOs, and the AO are responsible for developing and maintaining the following written policies and procedures.
(a) Each organization must have documented information security policies in place that:
(1) are available to all users;
(2) are reviewed at least annually;
(3) are updated as necessary consistent with Guide, Vol. 15, § 310.20.10 (System Security Policies and Procedures); and
(b) The security policies in each organization must address the following requirements:
(1) Each organization must have SSPs that document the security of the IT assets within their system boundary (e.g., their LAN), consistent with Guide, Vol. 15, § 310.20.09 (System Security Plans).
(2) Each organization must have a Contingency/Disaster Recovery Plan for resuming operations, including procedures for the off-site storage of backups. See: Guide, Vol. 15, § 360 (System Backups).
(3) Each organization must have a configuration management process and current documentation on system configuration, to include a list of current hardware installed on the network and all local and national software running on the network, including the version or https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-3-security#310_20_10 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-3-security#310_20_10 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-3-security#310_20_09 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-3-security#310_20_09 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-3-security#360
Guide to Judiciary Policy, Vol. 11, Ch. 6 Page 4 release of each. See: Guide to Implementing the Judiciary Information Security Framework.
(4) Each organization must have a policy and plan for a local incident response program that includes procedures for the reporting and handling of IT security incidents consistent with Guide, Vol. 15, § 320.20(c)–(d) (Local Incident Response Plans).
(5) Each organization must have a policy and plan that protects its IT facilities (e.g., computer rooms, tape library, server, communication closets) from unauthorized access, loss, and theft. See: Guide, Vol. 15, § 310.20(d)(2) and (e)(2); § 330.70.25 (Physical Security for WLAN Operations); and § 330.80(b) (Voice Mail System Security).
(6) Each organization must have local security training and awareness procedures consistent with Guide, Vol. 15, § 340 (IT Security Training and Awareness).
(7) Each organization must develop password policy consistent with Guide, Vol. 15:
• § 330.10.25 (Default Settings),
• § 330.20(b)(2) (Request for Access to Judiciary Networks),
• § 330.60.60(c) (Security Responsibilities for Remote-Access
Users),
• § 330.80(e) (Voice Mail System Security), and
• § 390 (Identification and Authentication).
(8) Each organization must ensure that local procedures are developed and implemented to use host-based intrusion prevention system software consistent with Guide, Vol. 15, § 330.90(c)(4) (Publicly Accessible Judiciary Networks).
§ 660 Access Restrictions
(a) Anti-virus software with current malware definitions is mandatory on all judiciary-owned and non-judiciary-owned IT assets (e.g., computers, laptops, servers, mobile devices) that access judiciary networks, including virtual machines. See: Guide, Vol. 15, § 330.25 (Antivirus Software).
(b) Each court unit, FPDO, and the AO must restrict internet access consistent with the respective organization’s appropriate-use policy. See:
Guide, Vol. 15, § 525.40 (Appropriate Personal Use).
https://jnet.ao.dcn/information-technology/security/framework-shp/jisf-guide https://jnet.ao.dcn/information-technology/security/framework-shp/jisf-guide https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-3-security#320_20 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-3-security#320_20 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-3-security#310_20 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-3-security#310_20 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-3-security#330_70_25 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-3-security#330_70_25 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-3-security#330_80 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-3-security#330_80 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-3-security#340 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-3-security#340 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-3-security#330_10_25 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-3-security#330_20 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-3-security#330_60_60 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-3-security#330_60_60 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-3-security#330_80 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-3-security#390 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-3-security#330_90 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-3-security#330_90 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-3-security#330_25 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-5-managing-it-resources#525_40
Guide to Judiciary Policy, Vol. 11, Ch. 6 Page 5
(c) Access to court systems must be restricted to those individuals with legitimate work-related need. See: Guide, Vol. 15, §§ 330.20 (Request for Access to Judiciary Networks) and 330.20.10 (Volunteer Access to Non-Public Judiciary Networks, Systems, and Electronically Stored Data).
(d) Access to systems must be terminated immediately when a user separates from the judiciary for any reason, except as provided in Guide, Vol. 15, § 330.60.55 (Judiciary Network Remote Access for Recall-Eligible Bankruptcy and Magistrate Judges). See: Guide, Vol.15, § 330.60.80 (Suspension or Termination of Remote Access).
(e) Vendor access to judiciary assets must be terminated upon completion of scheduled activities for those vendors who provide periodic support to judiciary IT systems either on-site or remotely. See: Guide, Vol. 15, § 330.60.50(c)(3) (Eligibility for Remote Access).
(f) To prevent unauthorized system access, inactive sessions must be disconnected, or password-protected screen savers must activate after a specific period of inactivity.
(g) Data that may cause the federal government or a party to a case harm or embarrassment if released or disclosed by accident or theft must be encrypted if it travels or is stored outside of judiciary networks, including mobile devices.
(h) All IT systems must display the “Notice to Users” warning banner before the login screen consistent with Guide, Vol. 15, § 515.30 (Banner Notice).
§ 670 Verification and Review
(a) A security assessment is performed before national or local systems become operational. See: Guide, Vol. 15, § 310.20.10(e) (System Security Policies and Procedures).
(b) Court units, FPDOs, and the AO must manage security logs consistent with Guide, Vol. 15, § 370.10 (Security Log Management).
(c) Court units, FPDOs, and the AO should review user access periodically — not less than annually — to ensure the ongoing legitimacy of user access consistent with Guide, Vol. 15, § 330.20(b) (Request for Access to Judiciary Networks).
(d) Court units and FPDOs, in coordination with GSA, should regularly test and inspect fire suppression equipment in computer facilities. See:
Guide, Vol. 15, § 310.20(d) and (e) (Security Management Responsibilities).
https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-3-security#330_20 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-3-security#330_20 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-3-security#330_20_10 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-3-security#330_20_10 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-3-security#330_60_55 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-3-security#330_60_55 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-3-security#330_60_55 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-3-security#330_60_80 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-3-security#330_60_80 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-3-security#330_60_50 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-3-security#330_60_50 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-5-managing-it-resources#515_30 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-3-security#310_20_10 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-3-security#310_20_10 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-3-security#370_10 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-3-security#330_20 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-3-security#330_20 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-3-security#310_20 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-3-security#310_20
Guide to Judiciary Policy, Vol. 11, Ch. 6 Page 6
(e) IT equipment with hard drives and memory devices must be sanitized of all sensitive information consistent with Guide, Vol. 15, § 550.30 (Media Sanitization).
(f) An unannounced review must be conducted at least annually of authorized users of sensitive systems to ensure that their access rights in the system conform with their approved access. This review must be conducted by someone other than the person who administers access rights for that system.
https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-5-managing-it-resources#550_30 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-5-managing-it-resources#550_30
| § 610 Overview |
| Guide, Vol. 15, Ch. 3 (IT Security) |
| Guide, Vol. 15, Ch. 5 (Managing IT Resources) |
| Judiciary Security Operations Center’s Incident Response Plan |
| IT Security Training and Awareness Resources page of JNet |
| Information Security Framework |
| Guide to Implementing the Judiciary Information Security Framework |
| § 620 Separation of Duties |
| § 630 Internal Control Assessment |
| (a) Court unit executives (CUEs) and federal public defenders (FPDs) must assess the adequacy of internal control systems and practices at least annually. See: Guide, Vol. 11, § 180 (Internal Control Assessment). |
| (b) CUEs and FPDs must address the requirements in Guide, Vol. 15, § 310.20.20 (IT Security Self-Assessment) for their annual internal control self assessment to be complete. |
| § 635 Records Retention |
| (a) The court unit or federal public defender organization (FPDO) must maintain records and documentation required in Guide, Vol. 15 (Information Technology) consistent with the applicable judiciary records disposition schedule (Guide, Vol. 10, Appx. ... |
| (b) If there is a conflict between the retention periods identified in Volume 15 and Volume 10, the records must be retained for the longer period. |
| § 640 Assignment of Responsibility |
| (a) The AO Director is responsible for designating a senior professional to serve as the AO’s IT security officer (ISO). |
| (b) Project managers of national and locally developed software applications are responsible for creating and maintaining a system security plan (SSP) that documents specific data protection requirements and processes for their applications and descri... |
| (c) Chief Judges |
| (1) Chief judges are responsible for designating in writing a senior professional to serve as a court unit’s ISO. |
| (2) Chief circuit judges are responsible for designating in writing a senior professional to serve as the circuit ISO. See: Guide, Vol. 15, § 310.20.07 (Circuit IT Security Officer Responsibilities). |
| (3) New chief judges should review designations made by their predecessors, but it is not necessary to reissue a designation signed by a previous chief judge unless a change is desired. |
| (d) Court Unit Executives and Federal Public Defenders |
| (1) CUEs and FPDs have the primary responsibility for information security within their respective organizations. |
| (2) If CUEs or FPDs delegate these responsibilities, they must do so in writing. |
| (e) The names of the designated ISOs must be entered into InfoWeb. |
| § 650 Appropriate Records and Documentation |
| (a) Each organization must have documented information security policies in place that: |
| (1) are available to all users; |
| (2) are reviewed at least annually; |
| (3) are updated as necessary consistent with Guide, Vol. 15, § 310.20.10 (System Security Policies and Procedures); and |
| (b) The security policies in each organization must address the following requirements: |
| (1) Each organization must have SSPs that document the security of the IT assets within their system boundary (e.g., their LAN), consistent with Guide, Vol. 15, § 310.20.09 (System Security Plans). |
| (2) Each organization must have a Contingency/Disaster Recovery Plan for resuming operations, including procedures for the off-site storage of backups. See: Guide, Vol. 15, § 360 (System Backups). |
| (3) Each organization must have a configuration management process and current documentation on system configuration, to include a list of current hardware installed on the network and all local and national software running on the network, including ... |
| (4) Each organization must have a policy and plan for a local incident response program that includes procedures for the reporting and handling of IT security incidents consistent with Guide, Vol. 15, § 320.20(c)–(d) (Local Incident Response Plans). |
| (5) Each organization must have a policy and plan that protects its IT facilities (e.g., computer rooms, tape library, server, communication closets) from unauthorized access, loss, and theft. See: Guide, Vol. 15, § 310.20(d)(2) and (e)(2); § 330.70... |
| (6) Each organization must have local security training and awareness procedures consistent with Guide, Vol. 15, § 340 (IT Security Training and Awareness). |
| (7) Each organization must develop password policy consistent with Guide, Vol. 15: |
| § 330.10.25 (Default Settings), |
| § 330.20(b)(2) (Request for Access to Judiciary Networks), |
| § 330.60.60(c) (Security Responsibilities for Remote-Access Users), |
| § 330.80(e) (Voice Mail System Security), and |
| § 390 (Identification and Authentication). |
| (8) Each organization must ensure that local procedures are developed and implemented to use host-based intrusion prevention system software consistent with Guide, Vol. 15, § 330.90(c)(4) (Publicly Accessible Judiciary Networks). |
| § 660 Access Restrictions |
| (a) Anti-virus software with current malware definitions is mandatory on all judiciary-owned and non-judiciary-owned IT assets (e.g., computers, laptops, servers, mobile devices) that access judiciary networks, including virtual machines. See: Guide... |
| (b) Each court unit, FPDO, and the AO must restrict internet access consistent with the respective organization’s appropriate-use policy. See: Guide, Vol. 15, § 525.40 (Appropriate Personal Use). |
| (c) Access to court systems must be restricted to those individuals with legitimate work-related need. See: Guide, Vol. 15, §§ 330.20 (Request for Access to Judiciary Networks) and 330.20.10 (Volunteer Access to Non-Public Judiciary Networks, System... |
| (d) Access to systems must be terminated immediately when a user separates from the judiciary for any reason, except as provided in Guide, Vol. 15, § 330.60.55 (Judiciary Network Remote Access for Recall-Eligible Bankruptcy and Magistrate Judges). Se... |
| (e) Vendor access to judiciary assets must be terminated upon completion of scheduled activities for those vendors who provide periodic support to judiciary IT systems either on-site or remotely. See: Guide, Vol. 15, § 330.60.50(c)(3) (Eligibility f... |
| (f) To prevent unauthorized system access, inactive sessions must be disconnected, or password-protected screen savers must activate after a specific period of inactivity. |
| (g) Data that may cause the federal government or a party to a case harm or embarrassment if released or disclosed by accident or theft must be encrypted if it travels or is stored outside of judiciary networks, including mobile devices. |
| (h) All IT systems must display the “Notice to Users” warning banner before the login screen consistent with Guide, Vol. 15, § 515.30 (Banner Notice). |
| § 670 Verification and Review |
| (a) A security assessment is performed before national or local systems become operational. See: Guide, Vol. 15, § 310.20.10(e) (System Security Policies and Procedures). |
| (b) Court units, FPDOs, and the AO must manage security logs consistent with Guide, Vol. 15, § 370.10 (Security Log Management). |
| (c) Court units, FPDOs, and the AO should review user access periodically — not less than annually — to ensure the ongoing legitimacy of user access consistent with Guide, Vol. 15, § 330.20(b) (Request for Access to Judiciary Networks). |
| (d) Court units and FPDOs, in coordination with GSA, should regularly test and inspect fire suppression equipment in computer facilities. See: Guide, Vol. 15, § 310.20(d) and (e) (Security Management Responsibilities). |
| (e) IT equipment with hard drives and memory devices must be sanitized of all sensitive information consistent with Guide, Vol. 15, § 550.30 (Media Sanitization). |
| (f) An unannounced review must be conducted at least annually of authorized users of sensitive systems to ensure that their access rights in the system conform with their approved access. This review must be conducted by someone other than the person... |
File details come from the government source that posted it. Updated .