**Dear PEPS Applicant:**

Thank you for your interest in the U.S. Department of Education's
Postsecondary Education Participants System (PEPS). In order to receive
a User ID to access PEPS, you need to complete the attached security
package. The security package consists of the following:

**[Security cover Sheet (Page 2)]{.underline}** -- Please complete all
items in "**black**" ink only.

**[Access Authorization Request Form (Page 3)]{.underline}** -- Complete
items in Section I -- "Requesting User's Identification" ONLY. Please
use "black" ink only.

-   Full Name - Print your Last Name, First Name and Middle Initial

-   Social Security Number - Enter the last four (**4**) digits of your
    Social Security Number

-   Date of Birth

-   Phone Number - Enter your office phone number and extension

-   User's Signature - Please sign and enter today's date

**[Notice of Criminal Liability under the Privacy Act /Rules of Behavior
Form (Page 4]{.underline})** -- Please read this page carefully. Please
sign your name and today's date in "black" ink.

**[Security Information and Awareness Form (Pages 5-7]{.underline})** --
Please read the Security Information and Awareness Training document
carefully before submitting your security forms to PEPS.

Please FAX your completed security package to (202) 275-4518, Attn: Nita
Washington, PEPS Security Officer. If you have any questions, please
feel free to contact me on 202-377-4316.

Sincerely,

Nita Washington

PEPS Security Officer

Enclosures

U.S. DEPARTMENT OF EDUCATION

FEDERAL STUDENT AID

POSTSECONDARY EDUCATION PARTICIPANTS SYSTEM

SECURITY COVER SHEET

LAST NAME: \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
FIRST NAME: \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
MIDDLE INITIAL:\_\_\_\_\_

PHONE: (\_\_\_\_\_\_\_) \_\_\_\_\_\_\_\_ -
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ EXTENSION:
\_\_\_\_\_\_\_\_\_\_\_\_\_

EMAIL ADDRESS
(**REQUIRED**)\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

PLEASE CHECK ONE OF THE FOLLOWING:

GUARANTEE AGENCY: \_\_\_\_\_\_\_\_\_\_\_ STATE LICENSING AGENCY:
\_\_\_\_\_\_\_\_\_\_\_

ACCREDITING AGENCY: \_\_\_\_\_\_\_\_\_\_\_ OTHER: \_\_\_\_\_\_\_\_\_\_\_

COMPANY NAME:
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

ADDRESS: \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

> (Room No.) (Building)
>
> \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
>
> (Street)
>
> \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
>
> (Street)
>
> \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
> \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
>
> (City) (State)
>
> \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
> \_\_\_\_\_\_\_\_\_\_\_
>
> (Zip Code) (+Four)

SUPERVISOR'S FULL NAME:
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

SUPERVISOR'S EMAIL ADDRESS:
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

U.S. DEPARTMENT OF EDUCATION

ACCESS AUTHORIZATION REQUEST FORM

SECTION I

REQUESTING USER'S IDENTIFICATION

LAST NAME: \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
FIRST NAME: \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
MIDDLE INITIAL: \_\_\_\_\_\_

LAST 4 DIGITS OF YOUR SSN: \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ DATE OF
BIRTH: \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

PHONE: (\_\_\_\_\_\_\_) \_\_\_\_\_\_\_\_ -
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ EXTENSION:
\_\_\_\_\_\_\_\_\_\_\_\_\_

PRINT USER'S FULL NAME:
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

USER'S SIGNATURE:
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
DATE: \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

SECTION II

PROJECT AUTHORIZATION

PROJECT NAME: POSTSECONDARY EDUCATION PARTICIPANTS SYSTEM (PEPS)

P.O.C. FSA/PEPS

PEPS SYSTEM SECURITY OFFICER:
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ DATE:
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

> (NITA WASHINGTON)

SECTION III

SECURITY INFORMATION

CURRENT ED CLEARANCE LEVEL: \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

PERSONNEL SECURITY INFORMATION FOR A LEVEL:
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

CLEARANCE WAS SUBMITTED TO OIG DATE: \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

CSO FOR USERS P.O.C.:
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ DATE:
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

PSO FOR PROGRAM P.O.C.:
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ DATE:
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

**Notice of Criminal Liability under the Privacy Act - October 28,
2003**

The information provided to me by the Department of Education is
protected by the Privacy Act of 1974, as amended. The protection of this
information, once entrusted to me, becomes my responsibility. Therefore,
I agree to protect the privacy of all information that has been provided
to me as an agent of the Department. I understand that the criminal
penalties identified below may be enforced if I violate the requirements
of the Privacy Act.

5 U.S.C. § 522a, as amended,

\(1\) Any officer or employee of an agency, who by virtue of his
employment or official position, has possession of, or access to, agency
records which contain individually identifiable information the
disclosure of which is prohibited by this section or by rules or
regulations established thereunder, and who knowing that disclosure of
the specific material is so prohibited, willfully discloses the material
in any manner to any person or agency not entitled to receive it, shall
be guilty of a misdemeanor and fined not more than \$5,000.

\(2\) Any officer or employee of any agency who willfully maintains a
system of records without meeting the notice requirements of subsection
(e)(4) of this section shall be guilty of a misdemeanor and fined not
more than \$5,000.

\(3\) Any person who knowingly and willfully requests or obtains any
record concerning an individual from an agency under false pretenses
shall be guilty of a misdemeanor and fined not more than \$5,000.

I certify that I have read and understand the criminal penalties of the
Privacy Act, as stated above, and that I agree to comply with the
government's requirements for the protection of any information covered
by the privacy Act.

**Rules of Behavior:**

**For the Postsecondary Education Participants System (PEPS)**

In addition to the PEPS Rules of Behavior listed below, Departmental
employees are subject to the EDNET Rules of Behavior. At a minimum all
users are responsible for these principles:

-   PEPS is a U.S. Department of Education computer system, which may be
    accessed and used only for official Government business by
    authorized personnel.

-   Unauthorized access or use of PEPS may subject violators to
    criminal, civil, and/or administrative action.

-   Ensuring that PEPS data is used for the purpose of managing
    participation and oversight of federal student financial aid
    programs as identified under the Higher Education Act of 1965 as
    amended.

-   Immediately reporting all security incidents and potential threats
    and vulnerabilities involving computing resources to designated
    computer security personnel.

-   Protecting authenticators, such as passwords.

-   Reporting any compromise or suspected compromise of a User ID and/or
    Password to designated computer security personnel.

-   Accessing only systems, networks, data, control information, and
    software for which they are authorized.

-   Ensuring that system media and system outputs are marked according
    to their sensitivity and are properly controlled and stored.

-   Preventing physical damage to the system.

Signature:
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
Date: \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

![](media/image1.wmf){width="1.070138888888889in"
height="1.0743055555555556in"}

POSTSECONDARY EDUCATION PARTICIPANTS SYSTEM

PEPS

SECURITY INFORMATION AND AWARENESS

All users, partners and contractors with PEPS access, need to understand
how to protect their resources and customers\' privacy. This document
provides you with a clear and concise view of Security Policy
Information. It also outlines the necessary procedures you should use to
minimize risks.

**Why This Applies to You**

If you use a computer system, you are accepting security risks. Each
time you open an email attachment or load material from a floppy disk,
you are accepting risks. You must accept these risks because nothing in
our world of interconnected computer networks is free of security risks.
As part of our commitment to improved customer service, reduced unit
costs, and improved employee satisfaction, we are all responsible for
managing these risks. Commitment to information security protects our
customers' privacy, avoids fraud, and builds confidence in our partners
and in the public.

Without effective security practices, a single employee can have a
devastating impact on the entire organization. A person can unknowingly
launch a virus program attached to an email that erases data, causes
servers to crash, and interrupts information flow with our customers.

**What Threats Face Us**

Security is about managing risks, and that means understanding the
threats that cause these risks. Threats jeopardize two vital parts of
the student aid delivery system: (1) our ***Internal*** systems,
(including both the hardware and software that make up these systems,
and the data they contain) and (2) our ***Partners\'* *systems.***
Threats fall into three major categories:

-   Confidentiality -- Information must be protected from unauthorized
    disclosure;

-   Data Integrity -- Information must be reliable, therefore accurate;
    and

-   Availability -- Information and systems must be accessible when
    needed.

These three fundamental Computer Security concerns are often referred to
as ***CIA***: **Confidentiality**, **Integrity**, and A**vailability**.

**Confidentiality** risks arise from the failure to keep information
private and the failure to limit access to authorized individuals only.
Keeping private information private is one of the central promises we,
and our partners, make to our customers.

![](media/image2.wmf)**Integrity** risks deal with accuracy of data. We
minimize these risks by making sure data stored in our system is
protected from improper changes.

![](media/image3.wmf)**Availability** risks mean our system may not be
available to our customers, partners and users when they need them.
Systems become unavailable due to viruses, hacker attacks, improper
system changes, or failures in the supporting infrastructure (power,
communications, etc.). ***System outage equals customer outrage!***

We protect our system, information and resources against threats from
inside and outside by insisting on comprehensive system security plans,
by training our staff and our contractors, and by protecting private
information at all times. We also help our partners protect their
systems and customer data by requiring good computer security practices
throughout the student aid industry.

**What Can You Do**

As a user, your responsibility is simple: prevent the theft,
destruction, and unauthorized access of data and systems!

This sounds like an impossible job, but if we work together we can make
it happen. For example, though you need to make sure your own data is
backed up and stored safely, we make sure that the mass of data we
maintain on schools, borrowers and financial institutions is backed up
every day.

Our Data Center is making sure a well-managed firewall is protecting
your desktop computer from rogue Internet connections.

Learning your part in information security and privacy protection begins
by identifying your role as a PEPS end user.

**Responsibilities of End Users**

![](media/image4.wmf){width="1.1694444444444445in"
height="0.9986111111111111in"}

End Users are those who use information technology (IT) systems and / or
have access to customer and partner information.

Everyone working together creates a solid barrier to repel would-be
thieves. Each user supports a specific area of this shield, and is in
turn supported by the other users. Holes in this barrier create
vulnerabilities for criminals to exploit.

With our increasing dependence on networked computer systems and
exchange of information via the Internet, security lapses can translate
into millions of dollars of lost productivity and stolen assets.
Security failures can also affect our ability to perform our mission and
your ability to do your job.

Security is not another whim or trend that will be tacked on the office
bulletin board no more than locking the door on your house is a response
to advertising by the lock industry. Securing and protecting SFA
information and systems should become a part of everyone\'s daily
routine.

The Internet has improved your ability to share information among
student aid organizations. But this improved connectivity brings
increased risks because the ***access*** needed to share information is
the same access used by hackers and thieves to penetrate systems,
disrupt operations, steal privacy information and commit fraud.
Increased risk requires better security awareness and knowledge among
employees.

Let\'s now readdress the three fundamental computer security concerns:
**confidentiality**, **integrity**, and **availability** or ***CIA.***
As a user, all three of these concerns have significant implications for
you. A failure in any computer security area may prevent you from
completing your job, or expose you and us to liabilities. As users, few
are able to impact the integrity or availability of systems. However, in
the area of confidentiality, a user can have a direct impact. By
protecting your user ID and password, concealing applicant or borrower
private information, and properly disposing of sensitive data, users are
the front line of defense against those interested in exploiting
information.

![](media/image5.wmf)

Your ID and passwords are unique to you and are used to track your
activities as you use any system. (This should help you think twice
before you share your unique identity with someone else!) Sharing your
personal access codes is prohibited.

You will receive system privileges based on what you require to do your
job. Privileges are controlled this way to keep them at the lowest level
necessary to complete the job.

![](media/image6.wmf)

**Things To Do**:

-   **Complete** and submit your security paperwork

-   **Mark**, **control**, and **store** all media properly

-   **Stay alert** to your physical environment; report any abnormal
    packages, email, or activity immediately

-   **Request** system access through the appropriate administrator

-   **Change** passwords in accordance with instructions, more frequent
    is better

-   **Never** share or write down passwords (this includes notes
    underneath your keyboard or on your monitor)

-   **Never** leave logged-in systems unattended / unsecured (log off
    before leaving your workstation)

-   **Attend** system-specific training to learn special security
    features

```{=html}
<!-- -->
```
-   **Never** load your own software, to include unauthorized Internet
    downloads. Ask a system administrator to obtain and load new
    software for you

-   **Protect** remote access (dial-in) phone numbers and information

```{=html}
<!-- -->
```
-   **Know** what represents a security or privacy breach

-   **Know** the proper security official to whom you should report
    security incidents

-   **Report** all security breaches to the proper person

-   **Learn** what sensitive information you have access to, and proper
    information-handling procedures

-   **Clear** your work area of sensitive information when you are not
    there

-   **Dispose** of sensitive information properly