+----------------------------------------+--------------+--------------+
| ![](media/image1.png){width="1.0in"    | TYPE AND     |              |
| height="0.4166666666666667in"}         | NUMBER       |              |
+----------------------------------------+--------------+--------------+
|                                        | ### Cir      |              |
|                                        | cular 1310.5 |              |
+----------------------------------------+--------------+--------------+
|                                        | CONTACT      | TELEPHONE    |
|                                        |              | NUMBER       |
+----------------------------------------+--------------+--------------+
|                                        | ####### R    | \(703\)      |
|                                        | ussell Davis | 516-5107     |
+----------------------------------------+--------------+--------------+
|                                        | DATE         |              |
+----------------------------------------+--------------+--------------+
|                                        | September    |              |
|                                        | 18, 2001     |              |
+----------------------------------------+--------------+--------------+
|                                        | DATE OF      |              |
|                                        | CANCELLATION |              |
|                                        | *(Bulletins  |              |
|                                        | Only)*       |              |
+----------------------------------------+--------------+--------------+
|                                        |              |              |
+----------------------------------------+--------------+--------------+

+-------------------+--------------------------------------------------+
| **TO**:           | All FDIC Employees and Contractors               |
+-------------------+--------------------------------------------------+
| **FROM**:         | > Carol M. Heindel                               |
|                   |                                                  |
|                   | Acting Chief Information Officer                 |
+-------------------+--------------------------------------------------+
| **SUBJECT**:      | ##### Encryp                                     |
|                   | tion and Digital Signatures for Electronic Mail  |
+-------------------+--------------------------------------------------+
|                   |                                                  |
+-------------------+--------------------------------------------------+
| **1. Purpose**    | To issue policy governing encryption and digital |
|                   | signatures in corporate E-mail consistent with   |
|                   | the Corporation's current security services and  |
|                   | to provide guidance outlining when encryption is |
|                   | appropriate.                                     |
+-------------------+--------------------------------------------------+
|                   |                                                  |
+-------------------+--------------------------------------------------+
| **2. Scope**      | The provisions of this circular apply to all     |
|                   | FDIC employees and contractors who use or        |
|                   | develop FDIC automated information systems.      |
+-------------------+--------------------------------------------------+
|                   |                                                  |
+-------------------+--------------------------------------------------+
| **3. Background** | FDIC is required by the authorities listed below |
|                   | to establish methods for using and accepting     |
|                   | electronic signatures and to implement a type of |
|                   | technical non-repudiation service to protect the |
|                   | availability, integrity, and confidentiality of  |
|                   | FDIC data.                                       |
|                   |                                                  |
|                   | a\. Security Memorandum 98-012;                  |
|                   |                                                  |
|                   | b\. FDIC Encryption/Digital Signature and Public |
|                   | Key Infrastructure (PKI) Standard;               |
|                   |                                                  |
|                   | c\. Government Paperwork Elimination Act (PL     |
|                   | 105-277);                                        |
|                   |                                                  |
|                   | d\. The Electronic Signatures in Global and      |
|                   | National Commerce Act (PL 106-229);              |
|                   |                                                  |
|                   | e\. OMB M-00-15 OMB Guidance on Implementing     |
|                   | Electronic                                       |
|                   |                                                  |
|                   | Signatures in Global and National Commerce Act;  |
|                   | and                                              |
|                   |                                                  |
|                   | f.  The Government Information Security Reform   |
|                   |     Act (GISRA).                                 |
+-------------------+--------------------------------------------------+

+-------------------+--------------------------------------------------+
|                   |                                                  |
+-------------------+--------------------------------------------------+
| ###               | FDIC uses encryption to prevent unauthorized     |
| #####  Background | personnel from reading sensitive information, to |
|                   | protect the privacy of information, and to       |
| > **(cont\'d)**   | ensure its integrity with digital signatures.    |
|                   |                                                  |
|                   | Secure Multipurpose Internet Mail Extensions     |
|                   | (S/MIME) is the standard used at the FDIC to     |
|                   | secure communications and is required for use by |
|                   | non-FDIC users who need secure E-mail exchange   |
|                   | with FDIC. The FDIC E-mail application package   |
|                   | uses                                             |
|                   |                                                  |
|                   | S/MIME to provide security. S/MIME is a protocol |
|                   | of how encryption and digital signatures must be |
|                   | established.                                     |
+-------------------+--------------------------------------------------+
|                   |                                                  |
+-------------------+--------------------------------------------------+
| **4. Policy**     | It is the FDIC's policy to secure sensitive      |
|                   | E-mail when warranted with the encryption        |
|                   | products specified by the Division of            |
|                   | Information Resources Management (DIRM),         |
|                   | Information Security Staff (ISS).                |
+-------------------+--------------------------------------------------+
|                   |                                                  |
+-------------------+--------------------------------------------------+
| ##                | Terms used in this circular are defined below:   |
| ## 5. Definitions |                                                  |
|                   | a\. **Digital Signature**. A cryptographic       |
|                   | process that binds the integrity of a signed     |
|                   | document to a signer. A digital signature is     |
|                   | unique to the signer, bound to the document      |
|                   | signed, and is easily verifiable by a third      |
|                   | party. It is **not** a cut and paste of a        |
|                   | digitized handwritten signature. Any alterations |
|                   | to a digitally signed document are detectable.   |
|                   |                                                  |
|                   | b\. **Encryption**. The process of converting    |
|                   | information to cipher text.                      |
|                   |                                                  |
|                   | c\. **S/MIME**. Secure Multipurpose Internet     |
|                   | Mail Extensions is a standard that includes an   |
|                   | interchangeable format for exchanging digitally  |
|                   | signed and encrypted objects. S/MIME is used     |
|                   | also to secure objects, such as those posted to  |
|                   | Web pages.                                       |
+-------------------+--------------------------------------------------+
|                   |                                                  |
+-------------------+--------------------------------------------------+
| **6. Guidelines** | E-mails that include private information are     |
|                   | candidates for encryption.                       |
|                   |                                                  |
|                   | The standard FDIC E-mail product uses S/MIME     |
|                   | encryption.                                      |
|                   |                                                  |
|                   | Users shall decide when encryption or digital    |
|                   | signatures should be used.                       |
|                   |                                                  |
|                   | Users who need secure E-mail shall use the       |
|                   | current desktop                                  |
|                   |                                                  |
|                   | E-mail encryption.                               |
+-------------------+--------------------------------------------------+

+-------------------+--------------------------------------------------+
|                   |                                                  |
+-------------------+--------------------------------------------------+
| ##                | **Information Security Staff**. The Assistant    |
|                   | Director, ISS shall designate a point of contact |
| ## 7.             | to ensure that proper encryption standards are   |
|  Responsibilities | used at FDIC. ISS personnel shall work with FDIC |
|                   | employees and contractors to ensure that this    |
|                   | policy is properly followed. ISS personnel shall |
|                   | ensure that current information is available to  |
|                   | support FDIC information security training and   |
|                   | awareness.                                       |
|                   |                                                  |
|                   | Users. Users shall use FDIC desktop capabilities |
|                   | for                                              |
|                   |                                                  |
|                   | digitally signed and encrypted E-mail files.     |
+-------------------+--------------------------------------------------+
|                   |                                                  |
+-------------------+--------------------------------------------------+
| **8. Potential    | Encryption and digital signatures are not        |
| Uses**            | required for the majority of E-mail. However,    |
|                   | E-mails and attachments that contain information |
| **for Encryption  | of a private or sensitive nature that are        |
| and**             | transmitted over unsecured communications        |
|                   | networks, such as the Internet, shall be         |
| ######### D       | encrypted and possibly include a digital         |
| igital Signatures | signature. Individual division/office managers   |
|                   | shall establish specific requirements regarding  |
| ######            | encrypting and digitally signing E-mail. E-mail  |
|                   | and attachments containing the following         |
|                   | sensitive information should be considered for   |
|                   | encryption:                                      |
|                   |                                                  |
|                   | a\. Procurement and bidding activities;          |
|                   |                                                  |
|                   | b\. Proprietary institution data used in an      |
|                   | examination process;                             |
|                   |                                                  |
|                   | c\. Personnel related actions; and               |
|                   |                                                  |
|                   | d\. Bank Closings.                               |
+-------------------+--------------------------------------------------+
|                   |                                                  |
+-------------------+--------------------------------------------------+
| **9. Questions**  | Questions regarding this circular should be      |
|                   | directed to the                                  |
|                   |                                                  |
|                   | Assistant Director, Information Security Staff,  |
|                   | DIRM.                                            |
+-------------------+--------------------------------------------------+
|                   |                                                  |
+-------------------+--------------------------------------------------+
| **10. Effective   | The provisions of this circular are effective    |
| Date**            | immediately.                                     |
+-------------------+--------------------------------------------------+