PBGC Information Security Policy
|
|
|
- Barry York
- 8 years ago
- Views:
Transcription
1 PBGC Information Security Policy 1. Purpose. The Pension Benefit Guaranty Corporation (PBGC) Information Security Policy (ISP) defines the security and protection of PBGC information resources. 2. Reference. Office of Management and Budget (OMB) Circular A-130, The Computer Security Act (Public Law ), Executive Order and other applicable guidelines and laws. 3. Applicability. The provisions of the ISP apply to all Pension Benefit Guaranty Corporation (PBGC) employees and contractors (hereby known as PBGC staff) who use and access a portable computer or computer system to process information for the PBGC. 4. Interim Policy. It is the policy of the PBGC to apply the maximum cost-effective level of protection to PBGC Information Systems (IS), and to comply with applicable Federal statutes, regulations, policies, standards and guidelines. 5. Responsibilities. a. PBGC Executive Director shall: Designate a senior official to have the primary responsibility for developing, monitoring and disseminating PBGC's ISP. b. Chief Information Officer shall: Establishes the PBGC s computer security program and is responsible for overseeing the program goals, objectives, and priorities in order to support the mission of PBGC. c. Director, Information Resources Management Department (IRMD) shall: (1) oversee the development, maintenance and dissemination of the PBGC's ISP; (2) appoint an Information Systems Security Officer (ISSO); and 1
2 (3) review and approve information security policies, standards, procedures, architecture and implementation plans developed by the ISSO. d. Information Systems Security Officer (ISSO). The ISSO shall: (1) develop, maintain, implement and manage the ISP and act as the PBGC IS security focal point; (2) develop PBGC IS security strategy, standards, and architecture; (3) ensure in coordination with the PBGC Training Institute that IS security staff, PBGC managers, users, system administrators, contractors are provided effective security awareness training in compliance with the PBGC Computer Security Awareness and Training Program guidelines; (4) coordinate IS security plans, risk analyses, contingency plans and certifications with FASD, department representatives and IRMD staff; (5) assist the PBGC Disclosure Officer in the location and review of computerized record systems; (6) develop the capability to conduct periodic announced and unannounced security inspections, and/or reviews of computer files of PBGC IS users in accordance with the PBGC Audit and Monitoring Policy; (7) document and advise the PBGC Inspector General on matters pertaining to the illegal or unauthorized use of PBGC computer resources; (8) coordinate security procedure functions with the PBGC Inspector General; (9) establish a management control process to ensure that appropriate administrative, physical, and technical safeguards are incorporated into existing and new IS applications and information technology infrastructure; 2
3 (10) respond to IS security incidents in a timely manner, report to management on a regular scheduled basis on security incidents and maintain documentation of any suspected security violation; (11) develop, in coordination with the PBGC Procurement Department and the originating department, computer security requirements and appropriate contractual clauses for solicitations and contracts for the acquisition or operation of computer facilities, equipment, software packages and/or related services; (12) certify that contractor operated PBGC IS meet documented and approved security specifications/standards and comply with applicable Federal regulations, policies and standards prior to and after implementation; and (13) establish procedures to ensure that PBGC customer s rights to privacy, as stated in the Privacy Act of 1974 and the Freedom of Information Act (FOIA), are protected and that the integrity of data is maintained. e. IRMD, Help Desk. The IRMD Help Desk shall: (1) support PBGC staff with problems related to the security of hardware and software systems. This support includes the technical assistance, software procedures, and instruction necessary to clean up virus infected PCs and diskettes; (2) issue and reset user ID passwords on PBGC IS; (3) document and immediately notify the ISSO and the LAN Administrators whenever a breach of PC or LAN security becomes known in accordance with the PBGC Computer Security Incident Procedures; and (4) provide direct user support for questions dealing with systems hardware/software and user access in accordance with the IRMD Help Desk/LAN Administrators Standard Operating Procedures Handbook. f. Department Directors shall: (1) report any known or suspected misuse of computer resources to the ISSO; 3
4 (2) select a department representative to coordinate security-related efforts with the ISSO, as requested; (3) control access to computer-related equipment located in their department to ensure that resources are used for PBGC business activities; that computer resources are only used by authorized personnel; that equipment is secured from theft and unauthorized use; (2) identify sensitive systems, applications, and files which are department controlled and request the assistance of the ISSO to identify sensitive information resources in accordance with the PBGC Access and Physical Security Procedures; and (3) provide written authorization for approving users access to information resources. g. The Inspector General shall: (1) conduct reviews of data in computer files of individual users when an on-going investigation indicates that there is probable cause to believe that a violation of law, regulation or the policies is occurring; and (2) perform evaluations of the security controls for the information technology management that PBGC data, applications, and systems are adequately protected against risks which could result from the inadvertent or deliberate disclosure, alteration, or destruction. h. PBGC Disclosure Officer shall: (1) coordinate with Department Directors and/or their representative(s) to determine the sensitivity of data on PBGC's IS; (2) coordinate with the ISSO to ensure that the record safeguards mandated by the Privacy Act of 1974 are maintained on all PBGC IS; (3) determine if data maintained in PBGC IS can be disclosed based on PBGC disclosure guidelines; and (4) ensure that systems of records maintained in computerized format are included in PBGC's System of Records announcements in the Federal Register as required by the Privacy Act of
5 i. The Human Resources Department. PBGC Security Officer will arrange for suitability determinations of PBGC staff in IS related positions in accordance with Federal laws, regulations and Executive Orders. j. The PBGC Contracting Officer shall: (1) assure that the ISSO is consulted during the planning phase of all IS related solicitations; (2) be responsible for ensuring that all IS-related solicitations and contracts contain provisions for computer mandated security requirements; (3) ensure that contractors of PBGC projects are aware of their responsibility to assign only contractor staff who can meet certain suitability criteria. (4) include the responsibilities assigned by the PBGC ISP to PBGC Contractors in the appropriate contractual document(s); and (5) verify that PBGC contract staff are following the guidelines in the PBGC Separation Clearance Procedures for Contract Staff. k. Local Area Network (LAN) Administrator. Each LAN Administrator shall coordinate IS Security procedures with the ISSO and follow guidelines as outlined in the IRMD Help Desk/LAN Administrators Standard Operating Procedures Handbook. The LAN Administrators shall implement security controls within network elements and servers in accordance with PBGC platform security standards. l. Authorized PBGC IS Users. Security of information cannot be the sole responsibility of the ISSO and Department Directors. The PBGC IS user determines the effectiveness of most security safeguards. PBGC staff who work with PBGC IS resources shall: (1) immediately report known or suspected unauthorized use or disclosure of user ID's and/or passwords, misuse of computer resources, violations of security, or unusual occurrences to the IRMD Help Desk and his or her immediate manager; 5
6 (2) notify the Inspector General of any known or suspected thefts, and other known or suspected criminal activity related to PBGC IS resources; (3) be aware of, and understand their responsibility to comply with the ISP; (4) use PBGC IS resources only for lawful and authorized PBGC business purposes as defined in the PBGC Electronic Communications Policy; (5) recognize his/her accountability for all activity taking place with his/her personal user ID in accordance with the PBGC Password Usage Policy ; (6) comply with any safeguards, policies, or procedures that prevent accidental or deliberate access by unauthorized persons to IS resources and/or sensitive information; (7) comply with safeguards and procedures that prevent unauthorized access to PBGC IS via a modem as outlined in PBGC Modem Usage Policy; (8) comply with the terms and conditions of licensed software that is authorized for use at PBGC in accordance with the PBGC Software Management Policy; (9) not copy licensed PBGC software as outlined in the PBGC Software Acquisition Policy; (10) attend Computer Security Awareness Training as outlined in the PBGC Computer Security Awareness and Training Program guidelines; and (11) understand that PBGC reserves the right to confiscate and remove unauthorized software and hardware and to take disciplinary action against those PBGC employees who do not comply with the PBGC ISP. m. Contracting Officer s Technical Representative (COTR) shall: (1) Ensure the contractor designates a security representative who will: (a) coordinate all IS security procedures with the ISSO; 6
7 (b) (c) (d) (e) ensure that all contractor personnel are informed of, and comply with, PBGC security related policies, procedures and directives; ensure compliance with any written security related instructions from the ISSO; and promptly report known or suspected unauthorized use, or disclosure of user ID's and/or passwords, misuse of computer resources, violations of security, or unusual occurrences to the IRMD Help Desk and his or her immediate manager; and initiate the PBGC Form 169C Separation Clearance for Contract Staff for each departing contract employee in accordance with the PBGC Separation Clearance Procedures for Contract Staff. NOTE: PBGC Contract Staff at FBA sites, will have the PBGC Form 169C initiated at the site and forwarded to their COTR or designee for completion and routing to the IRMD Help Desk in accordance with the PBGC IOD WAN Manual, Section 4.1 New WAN Account Requests and Employee Separation Procedures. (2) Provide a list of on-site/off-site personnel working on contracts who require IS privileges, including job title and function to the ISSO. n. Facilities and Services Department. Shall arrange for suitability determinations of contractor personnel in IS related positions. 6. Obtaining Access to PBGC IS. IRMD has established procedures which, in conjunction with appropriate request forms, will allow personnel to access PBGC IS. These forms are available from the IRMD Help Desk and must be properly completed by PBGC staff and submitted to the IRMD Help Desk to obtain access in accordance with the PBGC Access and Physical Security Procedures. 7. Employee or Contractor Departing PBGC. PBGC staff who have access to PBGC IS, must have all access to PBGC s IS terminated before departing the Agency. PBGC Federal employees and contract staff must obtain or initiate either PBGC Form 169 Separation Clearance for Federal Employees or PBGC Form 169C Separation Clearance for Contract Staff in accordance with the guidelines stated in the Separation Clearance 7
8 Procedures for Federal Employees or Contract Staff. The ISSO and responsible LAN Administrator must ensure that systems access is terminated and files are transferred to the individual manager for retention determinations in compliance with the IRMD Help Desk/LAN Administrators Standard Operating Procedures Handbook. 8. Emergency Systems Access Termination. PBGC managers, COTRs, or contractor managers who wish to have computer access authorization revoked or terminated for PBGC staff in an emergency should immediately contact the IRMD Help Desk. The IRMD/CSD Manager will ensure that proper measures are invoked to protect information and computer resources accessible through the User ID. The requestor of an emergency termination action must follow-up with the appropriate PBGC request form(s) as outlined in the IRMD Help Desk/LAN Administrators Standard Operating Procedures Handbook. 9. Access Control for PBGC's Data Center. Access to IRMD Data Center is controlled at all times. Authorization for gaining access to the Data Center will be granted solely by the IRMD Data Center Facilities Management COTR or the Manager, IRMD/Technical Infrastructure Division. Authorized visitors can gain escorted access to the Data Center via the IRMD Help Desk. Visitors must obtain approval from the supervisor of the Data Center when requesting access during other than normal working hours. 10. Ownership and Management Responsibility. Ownership of PBGC IS, resources, and equipment resides with the department purchasing the peripheral(s), managing the data or developing the applications. Department Directors should assign ownership to a PBGC organizational entity. Owners' responsibilities should not be construed as replacing or diluting the ISSO's or the Department Directors' responsibilities for compliance with IS security requirements. The designated owners of PBGC's various IS assets have the responsibility to: a. acknowledge ownership of resources and identify those containing or processing sensitive data as defined in the PBGC IS Containing Sensitive Data Guidelines to the ISSO; b. coordinate with the ISSO to develop protection controls; c. authorize access to resources under their control; 8
9 d. educate managers and users on control and protection requirements as established in the PBGC Password Usage Policy and the PBGC Modem Usage Policy. e. monitor compliance with established security regulations, directives, and circulars and periodically review control processes; and f. participate in risk assessment and developing contingency plans, when necessary. 11. Disaster Recovery and System Availability. Ownership of the PBGC IS COOP is under the IRMD/Technical Infrastructure Division. These plans are developed and implemented to facilitate the timely restoration of PBGC computer, network, telecommunications equipment and business processing applications and underlying infrastructure in the event of an unscheduled disruption. 12. PBGC IS Change Management. PBGC staff responsible for system hardware and software changes, must adhere to the procedures described in the PBGC Change Management Handbook for initiating and completing changes to the PBGC IS network(s). These procedures include submitting change requests, notification procedures, participation in change meetings, coordinating activities, approval processes, testing of new applications, installing test servers, and actual implementation of changes. 9
TABLE OF CONTENTS. 2006.1259 Information Systems Security Handbook. 7 2006.1260 Information Systems Security program elements. 7
PART 2006 - MANAGEMENT Subpart Z - Information Systems Security TABLE OF CONTENTS Sec. 2006.1251 Purpose. 2006.1252 Policy. 2006.1253 Definitions. 2006.1254 Authority. (a) National. (b) Departmental. 2006.1255
APHIS INTERNET USE AND SECURITY POLICY
United States Department of Agriculture Marketing and Regulatory Programs Animal and Plant Health Inspection Service Directive APHIS 3140.3 5/26/2000 APHIS INTERNET USE AND SECURITY POLICY 1. PURPOSE This
TABLE OF CONTENTS. University of Northern Colorado
TABLE OF CONTENTS University of Northern Colorado HIPAA Policies and Procedures Page # Development and Maintenance of HIPAA Policies and Procedures... 1 Procedures for Updating HIPAA Policies and Procedures...
LAMAR STATE COLLEGE - ORANGE INFORMATION RESOURCES SECURITY MANUAL. for INFORMATION RESOURCES
LAMAR STATE COLLEGE - ORANGE INFORMATION RESOURCES SECURITY MANUAL for INFORMATION RESOURCES Updated: June 2007 Information Resources Security Manual 1. Purpose of Security Manual 2. Audience 3. Acceptable
U.S. Department of the Interior's Federal Information Systems Security Awareness Online Course
U.S. Department of the Interior's Federal Information Systems Security Awareness Online Course Rules of Behavior Before you print your certificate of completion, please read the following Rules of Behavior
Wright State University Information Security
Wright State University Information Security Controls Policy Title: Category: Audience: Reason for Revision: Information Security Framework Information Technology WSU Faculty and Staff N/A Created / Modified
FISH AND WILDLIFE SERVICE INFORMATION RESOURCES MANAGEMENT. Chapter 7 Information Technology (IT) Security Program 270 FW 7 TABLE OF CONTENTS
TABLE OF CONTENTS General Topics Purpose and Authorities Roles and Responsibilities Policy and Program Waiver Process Contact Abbreviated Sections/Questions 7.1 What is the purpose of this chapter? 7.2
Caldwell Community College and Technical Institute
Caldwell Community College and Technical Institute Employee Computer Usage Policies and Procedures I. PURPOSE: The purpose of this section is to define the policies and procedures for using the administrative
DHHIT Network Security Standards and Procedures
DHHIT Network Security Standards and Procedures Contents 1. Introduction 2 2. Scope 2 3. Definitions 2 4 Employment practices 2 5 Employee responsibility 3 6 Physical security 3 7 Network and Systems Security
Information Security Policy. Document ID: 3809 Version: 1.0 Owner: Chief Security Officer, Security Services
Information Security Policy Document ID: 3809 Version: 1.0 Owner: Chief Security Officer, Security Services Contents 1 Purpose / Objective... 1 1.1 Information Security... 1 1.2 Purpose... 1 1.3 Objectives...
BEFORE THE BOARD OF COUNTY COMMISSIONERS FOR MULTNOMAH COUNTY, OREGON RESOLUTION NO. 05-050
BEFORE THE BOARD OF COUNTY COMMISSIONERS FOR MULTNOMAH COUNTY, OREGON RESOLUTION NO. 05-050 Adopting Multnomah County HIPAA Security Policies and Directing the Appointment of Information System Security
Appendix A: Rules of Behavior for VA Employees
Appendix A: Rules of Behavior for VA Employees Department of Veterans Affairs (VA) National Rules of Behavior 1 Background a) Section 5723(b)(12) of title 38, United States Code, requires the Assistant
INITIAL APPROVAL DATE INITIAL EFFECTIVE DATE
TITLE AND INFORMATION TECHNOLOGY RESOURCES DOCUMENT # 1107 APPROVAL LEVEL Alberta Health Services Executive Committee SPONSOR Legal & Privacy / Information Technology CATEGORY Information and Technology
Information Security Policy September 2009 Newman University IT Services. Information Security Policy
Contents 1. Statement 1.1 Introduction 1.2 Objectives 1.3 Scope and Policy Structure 1.4 Risk Assessment and Management 1.5 Responsibilities for Information Security 2. Compliance 3. HR Security 3.1 Terms
HIPAA Security. 2 Security Standards: Administrative Safeguards. Security Topics
HIPAA Security SERIES Security Topics 1. Security 101 for Covered Entities 5. 2. Security Standards - Organizational, Security Policies Standards & Procedures, - Administrative and Documentation Safeguards
Information Security Policy
Information Security Policy Author: Responsible Lead Executive Director: Endorsing Body: Governance or Assurance Committee Alan Ashforth Alan Lawrie ehealth Strategy Group Implementation Date: September
State HIPAA Security Policy State of Connecticut
Health Insurance Portability and Accountability Act State HIPAA Security Policy State of Connecticut Release 2.0 November 30 th, 2004 Table of Contents Executive Summary... 1 Policy Definitions... 3 1.
How To Protect Decd Information From Harm
Policy ICT Security Please note this policy is mandatory and staff are required to adhere to the content Summary DECD is committed to ensuring its information is appropriately managed according to the
INFORMATION TECHNOLOGY SECURITY STANDARDS
INFORMATION TECHNOLOGY SECURITY STANDARDS Version 2.0 December 2013 Table of Contents 1 OVERVIEW 3 2 SCOPE 4 3 STRUCTURE 5 4 ASSET MANAGEMENT 6 5 HUMAN RESOURCES SECURITY 7 6 PHYSICAL AND ENVIRONMENTAL
Office of Inspector General SECURITY OF SCIENCE AND ECOSYSTEMS SUPPORT DIVISION (SESD) LOCAL AREA NETWORK (LAN)
Office of Inspector General Report of Audit SECURITY OF SCIENCE AND ECOSYSTEMS SUPPORT DIVISION (SESD) LOCAL AREA NETWORK (LAN) SEPTEMBER 30, 1997 Audit Report E1NMF7-15-0001-7100309 Inspector General
Data Security Incident Response Plan. [Insert Organization Name]
![Data Security Incident Response Plan. [Insert Organization Name]](/thumbs/34/17160420.jpg "Data Security Incident Response Plan. [Insert Organization Name]")
Data Security Incident Response Plan Dated: [Month] & [Year] [Insert Organization Name] 1 Introduction Purpose This data security incident response plan provides the framework to respond to a security
Policy for the Acceptable Use of Information Technology Resources
Policy for the Acceptable Use of Information Technology Resources Purpose... 1 Scope... 1 Definitions... 1 Compliance... 2 Limitations... 2 User Accounts... 3 Ownership... 3 Privacy... 3 Data Security...
NETWORK AND AIS AUDIT, LOGGING, AND MONITORING POLICY OCIO-6011-09 TABLE OF CONTENTS
OFFICE OF THE CHIEF INFORMATION OFFICER NETWORK AND AIS AUDIT, LOGGING, AND MONITORING POLICY OCIO-6011-09 Date of Issuance: May 22, 2009 Effective Date: May 22, 2009 Review Date: TABLE OF CONTENTS Section
Information Resources Security Guidelines
Information Resources Security Guidelines 1. General These guidelines, under the authority of South Texas College Policy #4712- Information Resources Security, set forth the framework for a comprehensive
GAO INFORMATION SECURITY. Weak Controls Place Interior s Financial and Other Data at Risk. Report to the Secretary of the Interior
GAO United States General Accounting Office Report to the Secretary of the Interior July 2001 INFORMATION SECURITY Weak Controls Place Interior s Financial and Other Data at Risk GAO-01-615 United States
This procedure is associated with BCIT policy 6700, Freedom of Information and Protection of Privacy.
Privacy Breach No.: 6700 PR2 Policy Reference: 6700 Category: Information Management Department Responsible: Privacy and Records Management Current Approved Date: 2012 May 01 Objectives This procedure
Information Security Manager Training
Information Security Manager Training Kent Swagler CCEP Director, Corporate Compliance Direct line (314) 923-3097 Cell (314) 575-8334 kswagler@metrostlouis.org Information Security Manager Training Overview
MCOLES Information and Tracking Network. Security Policy. Version 2.0
MCOLES Information and Tracking Network Security Policy Version 2.0 Adopted: September 11, 2003 Effective: September 11, 2003 Amended: September 12, 2007 1.0 POLICY STATEMENT The Michigan Commission on
IT SECURITY EDUCATION AWARENESS TRAINING POLICY OCIO-6009-09 TABLE OF CONTENTS
OFFICE OF THE CHIEF INFORMATION OFFICER Date of Issuance: May 22, 2009 Effective Date: May 22, 2009 Review Date: Section I. PURPOSE II. AUTHORITY III. SCOPE IV. DEFINITIONS V. POLICY VI. RESPONSIBILITIES
HIPAA Information Security Overview
HIPAA Information Security Overview Security Overview HIPAA Security Regulations establish safeguards for protected health information (PHI) in electronic format. The security rules apply to PHI that is
Information Security and Electronic Communications Acceptable Use Policy (AUP)
Policy No.: AUP v2.0 Effective Date: August 16, 2004 Revision Date: January 17, 2013 Revision No.: 1 Approval jwv / mkb Information Security and Electronic Communications (AUP) 1. INTRODUCTION Southwestern
EPA Classification No.: CIO-2150.3-P-09.1 CIO Approval Date: 08/06/2012 CIO Transmittal No.: 12-003 Review Date: 08/06/2015
Issued by the EPA Chief Information Officer, Pursuant to Delegation 1-19, dated 07/07/2005 INFORMATION SECURITY INTERIM MAINTENANCE PROCEDURES V1.8 JULY 18, 2012 1. PURPOSE The purpose of this procedure
FDOH Information and Privacy Awareness Training Learner Course Guide
Florida Department of Health FDOH Information and Privacy Awareness Training Learner Course Guide To protect, promote & improve the health of all people in Florida through integrated state, county, & community
R345, Information Technology Resource Security 1
R345, Information Technology Resource Security 1 R345-1. Purpose: To provide policy to secure the private sensitive information of faculty, staff, patients, students, and others affiliated with USHE institutions,
REMOTE ACCESS POLICY OCIO-6005-09 TABLE OF CONTENTS
OFFICE OF THE CHIEF INFORMATION OFFICER REMOTE ACCESS POLICY OCIO-6005-09 Date of Issuance: May 22, 2009 Effective Date: May 22, 2009 Review Date: TABLE OF CONTENTS Section I. PURPOSE II. AUTHORITY III.
Standard Operating Procedure Information Security Compliance Requirements under the cabig Program
Page 1 of 9 Pages Standard Operating Procedure Information Security Compliance Requirements under the cabig Program This cover sheet controls the layout and components of the entire document. Issued Date:
information systems security policy...
sales assessment.com information systems security policy... Approved: 2nd February 2010 Last updated: 2nd February 2010 sales assessment.com 2 index... 1. Policy Statement 2. IT Governance 3. IT Management
Chronic Disease Management
RESOURCE AND PATIENT MANAGEMENT SYSTEM Chronic Disease Management (BCDM) Version 1.0 Office of Information Technology (OIT) Division of Information Resource Management Albuquerque, New Mexico Table of
SUBJECT: SECURITY OF ELECTRONIC MEDICAL RECORDS COMPLIANCE WITH THE HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996 (HIPAA)
UNIVERSITY OF PITTSBURGH POLICY SUBJECT: SECURITY OF ELECTRONIC MEDICAL RECORDS COMPLIANCE WITH THE HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996 (HIPAA) DATE: March 18, 2005 I. SCOPE This
Introduction. General Use
Introduction Dane County provides a variety of technological resources to its employees to improve public service and maximize efficiency. The purpose of this policy is to advise users regarding the use
PINAL COUNTY POLICY AND PROCEDURE 2.50 ELECTRONIC MAIL AND SCHEDULING SYSTEM
PINAL COUNTY POLICY AND PROCEDURE 2.50 Subject: ELECTRONIC MAIL AND SCHEDULING SYSTEM Date: November 18, 2009 Pages: 1 of 5 Replaces Policy Dated: April 10, 2007 PURPOSE: The purpose of this policy is
micros MICROS Systems, Inc. Enterprise Information Security Policy (MEIP) August, 2013 Revision 8.0 MICROS Systems, Inc. Version 8.
micros MICROS Systems, Inc. Enterprise Information Security Policy (MEIP) Revision 8.0 August, 2013 1 Table of Contents Overview /Standards: I. Information Security Policy/Standards Preface...5 I.1 Purpose....5
Central Texas College District Human Resource Management Operating Policies and Procedures Manual Policy No. 294: Computer Security Policy
Central Texas College District Human Resource Management Operating Policies and Procedures Manual Policy No. 294: Computer Security Policy I. PURPOSE To identify the requirements needed to comply with
Estate Agents Authority
INFORMATION SECURITY AND PRIVACY PROTECTION POLICY AND GUIDELINES FOR ESTATE AGENTS Estate Agents Authority The contents of this document remain the property of, and may not be reproduced in whole or in
Data Management Policies. Sage ERP Online
Sage ERP Online Sage ERP Online Table of Contents 1.0 Server Backup and Restore Policy... 3 1.1 Objectives... 3 1.2 Scope... 3 1.3 Responsibilities... 3 1.4 Policy... 4 1.5 Policy Violation... 5 1.6 Communication...
UNIVERSITY OF MAINE SYSTEM STANDARDS FOR SAFEGUARDING INFORMATION ATTACHMENT C
UNIVERSITY OF MAINE SYSTEM STANDARDS FOR SAFEGUARDING INFORMATION ATTACHMENT C This Attachment addresses the Contractor s responsibility for safeguarding Compliant Data and Business Sensitive Information
DIRECTIVE TRANSMITTAL
U.S. NUCLEAR REGULATORY COMMISSION DIRECTIVE TRANSMITTAL TN: DT-05-04 To: Subject: Purpose: Office and Division of Origin: NRC Management Directives Custodians Transmittal of Management Directive 2.6,
INFORMATION SECURITY MANAGEMENT SYSTEM. Version 1c
INFORMATION SECURITY MANAGEMENT SYSTEM Version 1c Revised April 2011 CONTENTS Introduction... 5 1 Security Policy... 7 1.1 Information Security Policy... 7 1.2 Scope 2 Security Organisation... 8 2.1 Information
DETAIL AUDIT PROGRAM Information Systems General Controls Review
Contributed 4/23/99 by Steve_Parker/TBE/Teledyne@teledyne.com DETAIL AUDIT PROGRAM Information Systems General Controls Review 1.0 Introduction The objectives of this audit are to review policies, procedures,
Order. Directive Number: IM 10-3. Stephen E. Barber Chief Management Officer
Pension Benefit Guaranty Corporation Order Subject: Protecting Sensitive Information Directive Number: IM 10-3 Effective Date: 4/23/08 Originator: OGC Stephen E. Barber Chief Management Officer 1. PURPOSE:
Publication 805-A Revision: Certification and Accreditation
Postal Bulletin 22358 (3-7-13) Policies, Procedures, and Forms Updates Publication 805-A Revision: Certification and Accreditation Effective immediately, the January 2013 edition of Publication 805-A,
VMware vcloud Air HIPAA Matrix
goes to great lengths to ensure the security and availability of vcloud Air services. In this effort VMware has completed an independent third party examination of vcloud Air against applicable regulatory
ISO 27001 Controls and Objectives
ISO 27001 s and Objectives A.5 Security policy A.5.1 Information security policy Objective: To provide management direction and support for information security in accordance with business requirements
Town of Essex Comprehensive Public Records and Technology Policy
Town of Essex Comprehensive Public Records and Technology Policy Introduction: Public records and the use of technology are inextricably linked in our modern age. As such, this policy covers both topics,
BERKELEY COLLEGE DATA SECURITY POLICY
BERKELEY COLLEGE DATA SECURITY POLICY BERKELEY COLLEGE DATA SECURITY POLICY TABLE OF CONTENTS Chapter Title Page 1 Introduction 1 2 Definitions 2 3 General Roles and Responsibilities 4 4 Sensitive Data
Responsible Access and Use of Information Technology Resources and Services Policy
Responsible Access and Use of Information Technology Resources and Services Policy Functional Area: Information Technology Services (IT Services) Applies To: All users and service providers of Armstrong
Privacy Incident and Breach Management Policy
Privacy Incident and Breach Management Policy Privacy Office Document ID: 2480 Version: 2.1 Owner: Chief Privacy Officer Sensitivity Level: Low Copyright Notice Copyright 2014, ehealth Ontario All rights
AP 417 Information and Communication Services
AP 417 Information and Communication Services Background Access and use of information and communication services (ICS) are an integral component of the learning and working environment. The ability for
Guidelines Applicability... 2. Guidelines Statements... 2. Guidelines Administration... 4. Management Responsibility... 4
Guidelines Applicability... 2 Guidelines Statements... 2 Guidelines Administration... 4 Management Responsibility... 4 Administrative Data Ownership... 4 Data Custodian Responsibilities... 4 Data User
How To Audit The Mint'S Information Technology
Audit Report OIG-05-040 INFORMATION TECHNOLOGY: Mint s Computer Security Incident Response Capability Needs Improvement July 13, 2005 Office of Inspector General Department of the Treasury Contents Audit
Computer Security Policy (Interim)
Computer Security Policy (Interim) Updated May, 2001 Department of Information Systems & Telecommunications Table of Contents 1. SCOPE...1 2. OVERVIEW...1 3. RESPONSIBILITIES...3 4. PHYSICAL SECURITY...4
Service Children s Education
Service Children s Education Data Handling and Security Information Security Audit Issued January 2009 2009 - An Agency of the Ministry of Defence Information Security Audit 2 Information handling and
Procedure Title: TennDent HIPAA Security Awareness and Training
Procedure Title: TennDent HIPAA Security Awareness and Training Number: TD-QMP-P-7011 Subject: Security Awareness and Training Primary Department: TennDent Effective Date of Procedure: 9/23/2011 Secondary
Standard: Information Security Incident Management
Standard: Information Security Incident Management Page 1 Executive Summary California State University Information Security Policy 8075.00 states security incidents involving loss, damage or misuse of
Security Incident Procedures Response and Reporting Policy
Security Incident Procedures Response and Reporting Policy Approved By: \S\ James Palmer CSC Loss Prevention Director PCI Policy # 1030 Version # 1.0 Effective Date: MM/DD/YYYY Date 1.0 Purpose The purpose
STFC Monitoring and Interception policy for Information & Communications Technology Systems and Services
STFC Monitoring and Interception policy for Information & Communications Technology Systems and Services Issue 1.0 (Effective 27 June 2012) This document contains a copy of the STFC policy statements outlining
Information Security Policy and Handbook Overview. ITSS Information Security June 2015
Information Security Policy and Handbook Overview ITSS Information Security June 2015 Information Security Policy Control Hierarchy System and Campus Information Security Policies UNT System Information
University of Maryland Baltimore Information Technology Acceptable Use Policy
The UMB School of Nursing follows and adheres to the UMB Campus Information Technology Acceptable Use Policy. The UMSON further defines Authorized User to also include any person who receives a password
The Commonwealth of Massachusetts
A. JOSEPH DeNUCCI AUDITOR The Commonwealth of Massachusetts AUDITOR OF THE COMMONWEALTH ONE ASHBURTON PLACE, ROOM 1819 BOSTON, MASSACHUSETTS 02108 TEL. (617) 727-6200 No. 2008-1308-4T OFFICE OF THE STATE
Department of Veterans Affairs VA Handbook 6500. Information Security Program
Department of Veterans Affairs VA Handbook 6500 Washington, DC 20420 Transmittal Sheet September 18, 2007 Information Security Program 1. REASON FOR ISSUE: To provide specific procedures and establish
Marist College. Information Security Policy
Marist College Information Security Policy February 2005 INTRODUCTION... 3 PURPOSE OF INFORMATION SECURITY POLICY... 3 INFORMATION SECURITY - DEFINITION... 4 APPLICABILITY... 4 ROLES AND RESPONSIBILITIES...
Please review and make copies of the following documents for each designated staff in need of Valley Express access.
Welcome to Valley Express (VE) Valley Express is Valley Health Plan s (VHP) Authorization and Referral data system. By signing this document, the individual signifies that the County s User Responsibility
1.02 Authorized Recipient means an entity authorized by statute to receive background check information for noncriminal justice purposes.
SECURITY and MANAGEMENT CONTROL OUTSOURCING STANDARD The goal of this document is to provide adequate security and integrity for background check information while under the control or management of an
Lisbon School District 15 Newent Road Lisbon, CT 06351
Pur pose The purpose of this policy is to establish direction, procedures, requirements, and responsibilities to ensure the appropriate protection of the Lisbon Public Schools computer and telecommunication
COMPUTER AND NETWORK USAGE POLICY
COMPUTER AND NETWORK USAGE POLICY Respect for intellectual labor and creativity is vital to academic discourse and enterprise. This principle applies to works of all authors and publishers in all media.
HIPAA Security Alert
Shipman & Goodwin LLP HIPAA Security Alert July 2008 EXECUTIVE GUIDANCE HIPAA SECURITY COMPLIANCE How would your organization s senior management respond to CMS or OIG inquiries about health information
The Bureau of the Fiscal Service. Privacy Impact Assessment
The Bureau of the Fiscal Service Privacy Impact Assessment The mission of the Bureau of the Fiscal Service (Fiscal Service) is to promote the financial integrity and operational efficiency of the federal
Individuals affected by the breach How many individuals are affected by the breach? Who was affected by the breach: employees, public, contractors, clients, service providers, other organizations? Foreseeable
PERSONAL COMPUTER SECURITY
PERSONAL COMPUTER SECURITY April 2001 TABLE OF CONTENTS 1 INTRODUCTION... 1 1.1 PC INFORMATION SECURITY OVERVIEW... 1 1.2 EXCLUSIONS... 1 1.3 COMMENTS AND SUGGESTIONS... 1 2 PC INFORMATION SECURITY RESPONSIBILITIES...
Information Security Program
Stephen F. Austin State University Information Security Program Revised: September 2014 2014 Table of Contents Overview... 1 Introduction... 1 Purpose... 1 Authority... 2 Scope... 2 Information Security
Supplier IT Security Guide
Revision Date: 28 November 2012 TABLE OF CONTENT 1. INTRODUCTION... 3 2. PURPOSE... 3 3. GENERAL ACCESS REQUIREMENTS... 3 4. SECURITY RULES FOR SUPPLIER WORKPLACES AT AN INFINEON LOCATION... 3 5. DATA
Acceptable Use Policy
Acceptable Use Policy TABLE OF CONTENTS PURPOSE... 4 SCOPE... 4 AUDIENCE... 4 COMPLIANCE & ENFORCEMENT... 4 POLICY STATEMENTS... 5 1. General... 5 2. Authorized Users... 5 3. Loss and Theft... 5 4. Illegal
CONSOLIDATED RECORDS MANAGEMENT SYSTEM (CRMS) USER AGREEMENT
CONSOLIDATED RECORDS MANAGEMENT SYSTEM (CRMS) USER AGREEMENT I. PURPOSE STATEMENT The TENNESSEE FUSION CENTER (TFC) is an initiative of the Tennessee Bureau of Investigation (TBI) and the Department of
Appendix H: End User Rules of Behavior
Appendix H: End User Rules of Behavior 1. Introduction The Office of Management and Budget (OMB) has established the requirement for formally documented Rules of Behavior as set forth in OMB Circular A-130.
`DEPARTMENT OF VETERANS AFFAIRS VA SOUTHEAST NETWORK Automated Information System User Access Notice
`DEPARTMENT OF VETERANS AFFAIRS VA SOUTHEAST NETWORK Automated Information System User Access Notice I understand, accept, and agree to the following terms and conditions that apply to my access to, and
Security Framework Information Security Management System
NJ Department of Human Services Security Framework - Information Security Management System Building Technology Solutions that Support the Care, Protection and Empowerment of our Clients JAMES M. DAVY
CITY UNIVERSITY OF HONG KONG Information Security Incident Management Standard
CITY UNIVERSITY OF HONG KONG Information Security Incident Management Standard (Approved by the Information Strategy and Governance Committee in December 2013; revision 1.1 approved by Chief Information
The Internet and e-mail 2 Acceptable use 2 Unacceptable use 2 Downloads 3 Copyrights 3 Monitoring 3. Computer Viruses 3
Table of Contents 1 Acceptable use 1 Violations 1 Administration 1 Director and Supervisor Responsibilities 1 MIS Director Responsibilities 1 The Internet and e-mail 2 Acceptable use 2 Unacceptable use
ADMINISTRATIVE POLICY # 32 8 2 (2014) Information Security Roles and Responsibilities
Policy Title: Information Security Roles Policy Type: Administrative Policy Number: ADMINISTRATIVE POLICY # 32 8 2 (2014) Information Security Roles Approval Date: 05/28/2014 Revised Responsible Office:
Lawrence Police Department Administrative Policy. August 2013. A. Access to CJIS sensitive data is only available to authorized users.
Lawrence Police Department Administrative Policy SUBJECT Criminal Justice Information System (CJIS) APPLIES TO All Personnel EFFECTIVE DATE REVISED DATE August 2013 APPROVED BY Chief of Police TOTAL PAGES
Access Control Policy
Version 3.0 This policy maybe updated at anytime (without notice) to ensure changes to the HSE s organisation structure and/or business practices are properly reflected in the policy. Please ensure you
Rowan University Data Governance Policy
Rowan University Data Governance Policy Effective: January 2014 Table of Contents 1. Introduction... 3 2. Regulations, Statutes, and Policies... 4 3. Policy Scope... 4 4. Governance Roles... 6 4.1. Data
Policy on the Security of Informational Assets
Policy on the Security of Informational Assets Policy on the Security of Informational Assets 1 1. Context Canam Group Inc. recognizes that it depends on a certain number of strategic information resources
YMDDIRIEDOLAETH GIG CEREDIGION A CHANOLBARTH CYMRU CEREDIGION AND MID WALES NHS TRUST PC SECURITY POLICY
YMDDIRIEDOLAETH GIG CEREDIGION A CHANOLBARTH CYMRU CEREDIGION AND MID WALES NHS TRUST PC SECURITY POLICY Author Head of IT Equality impact Low Original Date September 2003 Equality No This Revision September
Boston Public Schools. Guidelines for Implementation of Acceptable Use Policy for Digital Information, Communication, and. Technology Resources
Boston Public Schools Guidelines for Implementation of Acceptable Use Policy for Digital Information, Communication, and Scope of Policy Technology Resources ACCEPTABLE USE POLICY AND GUIDELINES Boston
INFORMATION SECURITY OVERVIEW
INFORMATION SECURITY OVERVIEW December 2003 TABLE OF CONTENTS 1 INTRODUCTION... 1 1.1 SECURITY POLICY HIGHLIGHTS... 1 1.1.1 INFORMATION SECURITY POLICY RECAP... 1 1.1.2 NETWORK POLICY RECAP... 2 1.2 COMPUTER
Office 365 Data Processing Agreement with Model Clauses
Enrollment for Education Solutions Office 365 Data Processing Agreement (with EU Standard Contractual Clauses) Amendment ID Enrollment for Education Solutions number Microsoft to complete 7392924 GOLDS03081
The Use of Information Technology Policies and Policies
Information Technology Management Procedure June 1, 2015 Information Technology Management, page 1 of 7 Contents Responsibility for Local Information Technology Policies 3 Responsibility to Maintain Functionality
INFORMATION SECURITY POLICY. Contents. Introduction 2. Policy Statement 3. Information Security at RCA 5. Annexes
INFORMATION SECURITY POLICY Ratified by RCA Senate, February 2007 Contents Introduction 2 Policy Statement 3 Information Security at RCA 5 Annexes A. Applicable legislation and interpretation 8 B. Most