---------------------------------------- --------------- ---------------
  ![](media/image1.png){width="1.0in"      TYPE AND NUMBER 
  height="0.4166666666666667in"}                           

                                           Circular        
                                           1360.15         

                                           CONTACT         TELEPHONE
                                                           NUMBER

                                           Sherman Howell  703-516-1284

                                           DATE            

                                           September 24,   
                                           2003            

                                           DATE OF         
                                           CANCELLATION    
                                           *(Bulletins     
                                           Only)*          

                                                           
  ---------------------------------------- --------------- ---------------

+-------------------+--------------------------------------------------+
| **TO**:           | All Employees and Contractors                    |
+-------------------+--------------------------------------------------+
| **FROM**:         | Vijay G. Deshpande, Acting Director              |
|                   |                                                  |
|                   | Division of Information Resources Management     |
|                   | (DIRM)                                           |
+-------------------+--------------------------------------------------+
| **SUBJECT**:      | [Access Control for Automated Information        |
|                   | Systems]{.underline}                             |
+-------------------+--------------------------------------------------+
|                   |                                                  |
+-------------------+--------------------------------------------------+
| **1. Purpose**    | To issue revised policies and roles and          |
|                   | responsibilities for managing access to FDIC     |
|                   | Automated Information Systems (AISs) and data.   |
+-------------------+--------------------------------------------------+
|                   |                                                  |
+-------------------+--------------------------------------------------+
| **2. Scope**      | The provisions of this circular apply to all     |
|                   | FDIC employees, contractors, and users of FDIC   |
|                   | AISs; all FDIC AISs on mainframes, Local Area    |
|                   | Networks (LANs), client-server systems, or       |
|                   | personal computers (PCs); associated FDIC        |
|                   | networks and remote dial-in connections; and all |
|                   | associated FDIC data and system utilities.       |
+-------------------+--------------------------------------------------+
|                   |                                                  |
+-------------------+--------------------------------------------------+
| **3. Revision**   | FDIC Circular 1360.15, Access Control for        |
|                   | Automated Information Systems, dated March 24,   |
|                   | 2000, is hereby revised and superseded.          |
+-------------------+--------------------------------------------------+
|                   |                                                  |
+-------------------+--------------------------------------------------+
| **4. Background** | The FDIC operates LANs, client server systems,   |
|                   | PCs, and mainframe AISs in support of its        |
|                   | mission. The Corporation's information           |
|                   | processing requirements are satisfied by a       |
|                   | variety of hardware and software architectures   |
|                   | and platforms that store, communicate, and       |
|                   | manage large quantities of sensitive data. The   |
|                   | FDIC has established a program to monitor and    |
|                   | protect access control for AISs. Mandatory       |
|                   | access forms and processes, such as forms FDIC   |
|                   | 1370/02, Computer Access Authorization, 1370/07, |
|                   | New, Transfer, or Detailed User Access           |
|                   | Authorization, and 1370/03, Application Fact     |
|                   | Sheet, have been developed to outline and        |
|                   | enforce AIS access and authorization             |
|                   | requirements. Management systems are in place to |
|                   | track access requests and maintain user access   |
|                   | profiles and authorization histories.            |
|                   | Additionally, training programs such as the      |
|                   | Security Awareness Orientation Program, have     |
|                   | been developed and content will be               |
+-------------------+--------------------------------------------------+

+-------------------+--------------------------------------------------+
| > **Background**  | provided to all users of the FDIC AISs to        |
| >                 | support understanding of, and compliance with,   |
| > **(cont'd)**    | this circular.                                   |
+-------------------+--------------------------------------------------+
|                   |                                                  |
+-------------------+--------------------------------------------------+
| **5. Policy**     | It is the policy of FDIC that:                   |
|                   |                                                  |
|                   | a\. A combination of access controls,            |
|                   | accountability provisions, data integrity        |
|                   | checks, and audit trails be established to serve |
|                   | as strong deterrents to misuse of AIS resources; |
|                   |                                                  |
|                   | b\. Sensitive AISs (as well as other AISs) and   |
|                   | data be protected from unauthorized access,      |
|                   | disclosure, and use;                             |
|                   |                                                  |
|                   | c\. Access to sensitive systems shall be         |
|                   | permitted only for FDIC business purposes, as    |
|                   | approved by a supervisor (or contract Oversight  |
|                   | Manager or Technical Monitor) and an application |
|                   | access approver;                                 |
|                   |                                                  |
|                   | d\. Access shall be terminated when it is no     |
|                   | longer required. Termination of access can only  |
|                   | be requested by the following individuals:       |
|                   | Administrative Officer for a departing           |
|                   | employee/contractor; Point of Contact (POC) for  |
|                   | Network Resources (i. e., folders, lists,        |
|                   | mailboxes, groups, etc.); Resource Administrator |
|                   | for application specific access; and Information |
|                   | Security Manager for review cleanups;            |
|                   |                                                  |
|                   | e\. Individual and organizational activities     |
|                   | shall be audited and monitored for compliance    |
|                   | with this circular;                              |
|                   |                                                  |
|                   | f\. Procedures shall exist to ensure secure      |
|                   | movement of data from development to production; |
|                   | and                                              |
|                   |                                                  |
|                   | g\. Movement of data from development to quality |
|                   | assurance and from quality assurance to          |
|                   | production shall be properly authorized.         |
+-------------------+--------------------------------------------------+
|                   |                                                  |
+-------------------+--------------------------------------------------+
| **6.              | #                                                |
| Definitions**     |                                                  |
|                   | Terms used in this circular are defined below:   |
|                   |                                                  |
|                   | a\. **Access Control**. The administrative and   |
|                   | procedural process that governs and regulates    |
|                   | each individual's access privileges to FDIC      |
|                   | AISs.                                            |
|                   |                                                  |
|                   | b\. **Application Access Approver (AAA)**. An    |
|                   | individual who is assigned the responsibility by |
|                   | the sponsoring Division or Office for reviewing  |
|                   | and granting requests for access to an           |
|                   | application.                                     |
|                   |                                                  |
|                   | c\. **Appropriate Authority**. The individual    |
|                   | notified when an access violation occurs.        |
|                   | Depending on the circumstance surrounding the    |
|                   | access violation, the appropriate authority can  |
|                   | be the supervisor(s), Information Security       |
|                   | Manager, Program                                 |
+-------------------+--------------------------------------------------+

+-------------------+--------------------------------------------------+
| **Definitions**   | # Manager, DIRM Information Security Staff       |
|                   | (ISS), or the Office of Inspector General (OIG). |
| **(cont'd)**      |                                                  |
|                   | #                                                |
|                   |                                                  |
|                   | # d. Access Violation. A violati                 |
|                   | on that occurs when attempting to access an AIS. |
|                   |                                                  |
|                   | # e. Authorization. The granting                 |
|                   | of access rights to a user, program, or process. |
|                   |                                                  |
|                   | #                                                |
|                   |                                                  |
|                   | # f. Automated Information System (A             |
|                   | IS). An application of information technology th |
|                   | at is used to process, store, or transmit inform |
|                   | ation and includes, but is not limited to, mainf |
|                   | rame systems, mini/microcomputer systems, person |
|                   | al computers, gateways, private branch exchanges |
|                   |  (PBXs), and the networks that connect them and  |
|                   | related software. AISs also include commercial a |
|                   | nd custom developed software, removable media, e |
|                   | lectronic and paper input documents, and output. |
|                   |                                                  |
|                   | # g. Collabor                                    |
|                   | ative Working Group (CWG). A group of business r |
|                   | epresentatives assigned management authority ove |
|                   | r a data family and/or related sets of data. The |
|                   | se working groups or business level data steward |
|                   | s are responsible for managing each corporate da |
|                   | ta family in the best interests of the Corporati |
|                   | on. The representatives are also responsible for |
|                   |  representing the interests of external stakehol |
|                   | ders of corporate data with whom they interact.  |
|                   |                                                  |
|                   | #                                                |
|                   |                                                  |
|                   | #                                                |
|                   |  h. Data Family. A high-level, logical category  |
|                   | of corporate data (e.g., Open Institution Data,  |
|                   | and Compliance and Consumer Affairs Data). Each  |
|                   | family provides overall context for categorizing |
|                   |  the Corporation\'s information, regardless of i |
|                   | ts format (e.g., database management systems, el |
|                   | ectronic document, and hardcopy). Each discrete  |
|                   | data fact can be mapped to only one data family. |
|                   |                                                  |
|                   | #                                                |
|                   |                                                  |
|                   | # i. Generic ID. An access control ID that is kn |
|                   | own to, and can be used by, more than one person |
|                   | , process, and/or device. These may include IDs  |
|                   | for testing and training as well as service IDs. |
|                   |                                                  |
|                   | # j. Information Security Manager (ISM). An FDIC |
|                   |  employee assigned to ensure division or office  |
|                   | compliance with FDIC security directives, implem |
|                   | ent business-specific security practices, and se |
|                   | rve as primary liaison to DIRM ISS and his/her d |
|                   | ivision or office management. ISMs are responsib |
|                   | le for assisting the program manager and project |
|                   |  manager in developing and ensuring appropriate  |
|                   | security controls are included in new and existi |
|                   | ng applications and for coordinating the develop |
|                   | ment of security plans. ISMs work in conjunction |
|                   |  with DIRM ISS staff to develop and implement FD |
|                   | IC information security policies and procedures. |
+-------------------+--------------------------------------------------+

+-------------------+--------------------------------------------------+
| > **Definitions** | k\. **Information Security Technician (IST)**. A |
| >                 | designated individual authorized to request      |
| > **(cont'd)**    | access on behalf of users. ISTs perform their    |
|                   | function under policies, procedures, and         |
|                   | guidelines established by DIRM ISS.              |
|                   |                                                  |
|                   | #                                                |
|                   |                                                  |
|                   | # l. Nonstandard ID. An access control ID        |
|                   |  that does not conform to standards and policies |
|                   |  as set forth by the FDIC for each AIS platform. |
|                   |                                                  |
|                   | #                                                |
|                   |                                                  |
|                   | # m. Password. A prot                            |
|                   | ected/private character string used to authentic |
|                   | ate an identity and to authorize access to data. |
|                   |                                                  |
|                   | # n. Sensitive Data. FDIC data tha               |
|                   | t meets any of the following criteria (including |
|                   |  data that resides and operates on microcomputer |
|                   | s, LANs, FDIC mainframes, disk, magnetic media): |
|                   |                                                  |
|                   | # (1) Data covered by the Privacy Act of 1974;   |
|                   |                                                  |
|                   | #                                                |
|                   |                                                  |
|                   | # (2) Data or informatio                         |
|                   | n protected from disclosure by any applicable st |
|                   | atute, law, regulation, order, or privilege; and |
|                   |                                                  |
|                   | #                                                |
|                   |                                                  |
|                   | # (3) Bu                                         |
|                   | dget and payroll data, as well as financial data |
|                   |  used to produce checks or requisition supplies. |
|                   |                                                  |
|                   | # o. Sensitive System. An AIS that requ          |
|                   | ires special protection because it processes sen |
|                   | sitive data or because of the risk and magnitude |
|                   |  of loss or harm that could result from improper |
|                   |  operation or deliberate manipulation of the sys |
|                   | tem. Internal controls and computer security req |
|                   | uirements are more strenuous for highly sensitiv |
|                   | e systems than for moderately sensitive systems. |
|                   |                                                  |
|                   | # p. Spon                                        |
|                   | soring Division. The division that owns the AIS. |
|                   |                                                  |
|                   | #                                                |
|                   |                                                  |
|                   | # q. System Development Life                     |
|                   |  Cycle (SDLC). A process that contains the requi |
|                   | red tasks, products, and responsibilities necess |
|                   | ary to produce an IT project such as a software  |
|                   | develop-ment project. The SDLC provides a struct |
|                   | ured framework and organizes roles, responsibili |
|                   | ties, and development activities by clearly defi |
|                   | ned stages and phases. The phases of the SDLC ar |
|                   | e delineated by formal end products, quality rev |
|                   | iews, and milestone concurrence and approval. Se |
|                   | e FDIC Circular 1320.3, Systems Development Life |
|                   |  Cycle (SDLC) Version 3.0, for more information. |
|                   |                                                  |
|                   | #                                                |
|                   |                                                  |
|                   | # r. Technical Monitor. An indivi                |
|                   | dual designated by an Oversight Manager (OM) to  |
|                   | assist in monitoring a contractor's performance. |
|                   |                                                  |
|                   | s\. **User**. An individual requiring access to  |
|                   | FDIC information resources in the course of      |
|                   | his/her assignment/job/work or who               |
+-------------------+--------------------------------------------------+

+-------------------+--------------------------------------------------+
| **Definition**    | is accountable for some identifiable set of      |
|                   | activities in an AIS computer environment.       |
| **(cont'd)**      |                                                  |
+-------------------+--------------------------------------------------+
|                   |                                                  |
+-------------------+--------------------------------------------------+
| **7. Roles and    | a\. **DIRM Information Security Staff (ISS)**    |
| R                 | shall:                                           |
| esponsibilities** |                                                  |
|                   | > \(1\) Manage, monitor, and enforce             |
|                   | > corporate-wide compliance with this circular,  |
|                   | > especially access to data activities by        |
|                   | > individuals and organizations;                 |
|                   | >                                                |
|                   | > \(2\) Develop and maintain a program to        |
|                   | > measure the effectiveness of the FDIC's access |
|                   | > control policies and implement appropriate     |
|                   | > corrective measures;                           |
|                   | >                                                |
|                   | > \(3\) Lead FDIC staff in the establishment and |
|                   | > publishing of policies, procedures, and        |
|                   | > standards relating to access control, password |
|                   | > administration, compliance monitoring, and     |
|                   | > enforcement for new and existing technologies; |
|                   | >                                                |
|                   | > \(4\) Cooperate with those responsible for     |
|                   | > auditing (e.g., FDIC OIG, General Accounting   |
|                   | > Office (GAO), access to FDIC IT resources;     |
|                   | >                                                |
|                   | > \(5\) Manage mainframe access control facility |
|                   | > software operations at FDIC's Virginia Square  |
|                   | > Data Center;                                   |
|                   | >                                                |
|                   | > \(6\) Lead the development of standard         |
|                   | > operating procedures for accessing mainframe,  |
|                   | > UNIX, LAN, PC, and client-server based         |
|                   | > applications;                                  |
|                   | >                                                |
|                   | > \(7\) Provide guidance regarding FDIC password |
|                   | > standards and participate in periodic reviews  |
|                   | > to ensure compliance;                          |
|                   | >                                                |
|                   | > \(8\) Monitor and periodically review access   |
|                   | > control administration practices;              |
|                   | >                                                |
|                   | > \(9\) Approve/deny requests for generic and    |
|                   | > non-standard IDs;                              |
|                   | >                                                |
|                   | > \(10\) Implement procedures to terminate       |
|                   | > access privileges when a user leaves FDIC or   |
|                   | > access is no longer needed;                    |
|                   | >                                                |
|                   | > \(11\) Implement procedures to update/modify   |
|                   | > user access when an employee is                |
|                   | > transferred/detailed from division or office,  |
|                   | > or within a division or office;                |
|                   | >                                                |
|                   | > \(12\) Coordinate ISS response to OIG, GAO,    |
|                   | > and other third party access control           |
|                   | > inquiries;                                     |
|                   | >                                                |
|                   | > \(13\) Provide overall security coordination   |
|                   | > with ISMs, ISTs, and the user community;       |
+-------------------+--------------------------------------------------+

+-------------------+--------------------------------------------------+
| > **Roles and**   | > \(14\) Provide periodic training to ISMs on    |
| >                 | > general access control practices;              |
| > **R             | >                                                |
| esponsibilities** | > \(15\) Develop standard operating procedures   |
| >                 | > for monitoring system security settings and    |
| > **(cont'd)**    | > day-to-day system access activities;           |
|                   | >                                                |
|                   | > \(16\) Perform AIS security and integrity      |
|                   | > monitoring to identify potential violations by |
|                   | > unauthorized users across all platforms;       |
|                   | >                                                |
|                   | > \(17\) Distribute monitoring reports to        |
|                   | > appropriate personnel for follow-up;           |
|                   | >                                                |
|                   | > \(18\) Coordinate with AIS contingency         |
|                   | > planning and disaster recovery teams and ISMs  |
|                   | > to ensure that access control procedures are   |
|                   | > not violated during emergency conditions;      |
|                   | >                                                |
|                   | > \(19\) Provide guidance for access control     |
|                   | > security issues and related information to     |
|                   | > division or office management in conjunction   |
|                   | > with ISMs; and                                 |
|                   | >                                                |
|                   | > \(20\) Administer and evaluate security        |
|                   | > requirements for the Internet firewall and     |
|                   | > make recommendations for updates and           |
|                   | > enhancements.                                  |
|                   |                                                  |
|                   | b\. The **Information Security Manager (ISM)**   |
|                   | shall:                                           |
|                   |                                                  |
|                   | > \(1\) Communicate access control security      |
|                   | > issues and related information to division or  |
|                   | > office management, DIRM ISS, and the           |
|                   | > Information Security Management Committee**;** |
|                   | >                                                |
|                   | > \(2\) Implement FDIC access control policies   |
|                   | > and procedures as specified by DIRM ISS;       |
|                   | >                                                |
|                   | > \(3\) Review the assignment of user privileges |
|                   | > to sensitive AISs within his/her specific      |
|                   | > division or office;                            |
|                   | >                                                |
|                   | > \(4\) Coordinate with application developers   |
|                   | > and system managers in the development of      |
|                   | > business**-**specific access control           |
|                   | > requirements;                                  |
|                   | >                                                |
|                   | > \(5\) Participate in the design, development,  |
|                   | > testing, and implementation of new automated   |
|                   | > application systems and enterprise systems to  |
|                   | > ensure compliance with the corporate access    |
|                   | > control requirements, and proper integration   |
|                   | > with the DIRM ISS system used to manage        |
|                   | > corporate access control;                      |
|                   | >                                                |
|                   | > \(6\) Participate in the user account          |
|                   | > management/reconciliation process;             |
+-------------------+--------------------------------------------------+

+-------------------+--------------------------------------------------+
| > **Roles and     | > \(7\) Monitor computer security privileges of  |
| > R               | > users that have access to applications         |
| esponsibilities** | > sponsored by the ISM's division or office,     |
| >                 | > review access control related security         |
| > **(cont'd)**    | > monitoring reports, perform required follow-up |
|                   | > procedures in coordination with DIRM ISS,      |
|                   | > report suspected access violations to DIRM     |
|                   | > ISS, and work with them to take appropriate    |
|                   | > corrective action(s);                          |
|                   | >                                                |
|                   | > \(8\) Perform periodic access reviews for      |
|                   | > users within his/her specific division or      |
|                   | > office as required by FDIC Circular 1370.1,    |
|                   | > Periodic Review of Mainframe Resources Access; |
|                   | >                                                |
|                   | > \(9\) Participate in DIRM ISS security         |
|                   | > conferences and periodic meetings to ensure    |
|                   | > effective communication of access control      |
|                   | > issues;                                        |
|                   | >                                                |
|                   | > \(10\) Ensure that form FDIC 1370/03 is        |
|                   | > completed and submitted to DIRM ISS; and       |
|                   | >                                                |
|                   | > \(11\) Work with CWGs to ensure that           |
|                   | > implementation of access control procedures    |
|                   | > are consistent with sensitivity restrictions   |
|                   | > determined by the CWGs.                        |
|                   |                                                  |
|                   | c\. The **Information Security Technician        |
|                   | (IST)** shall:                                   |
|                   |                                                  |
|                   | \(1\) Initiate all AIS access requests,          |
|                   | regardless of platform;                          |
|                   |                                                  |
|                   | \(2\) Ensure that form FDIC 1370/02 is completed |
|                   | accurately by users requesting access to FDIC    |
|                   | AIS as well as authorized by appropriate         |
|                   | personnel;                                       |
|                   |                                                  |
|                   | \(3\) Ensure that a signed copy of form FDIC     |
|                   | 1370/02 is retained for audit purposes;          |
|                   |                                                  |
|                   | \(4\) Ensure that form FDIC 1370/02 is used for  |
|                   | all additions, changes, or deletions to user     |
|                   | access privileges;                               |
|                   |                                                  |
|                   | \(5\) Ensure user receipt of IDs and temporary   |
|                   | passwords;                                       |
|                   |                                                  |
|                   | \(6\) Monitor the automated access request       |
|                   | system to ensure timely completion of access     |
|                   | requests; and                                    |
|                   |                                                  |
|                   | \(7\) Assist in periodic verification of users'  |
|                   | access require-ments when lists are provided by  |
|                   | DIRM ISS or the program manager/system manager   |
|                   | of an application.                               |
|                   |                                                  |
|                   | d\. The **Application Access Approver (AAA)**    |
|                   | shall:                                           |
|                   |                                                  |
|                   | > \(1\) Serve as the point-of-contact for        |
|                   | > application-specific access control issues;    |
+-------------------+--------------------------------------------------+

+-------------------+--------------------------------------------------+
| > **Roles and     | > \(2\) Develop application-specific access      |
| > R               | > rules, referencing the data business rules and |
| esponsibilities** | > data sensitivity levels specified by the CWGs  |
| >                 | > of Data Stewards with authority over the data  |
| > **(cont'd)**    | > manipulated within the application; and        |
|                   | >                                                |
|                   | > \(3\) Include the ISM and DIRM ISS in project  |
|                   | > team meetings that address establishment and   |
|                   | > maintenance of access control processes.       |
|                   |                                                  |
|                   | e\. The **CWGs of Data Stewards** shall:         |
|                   |                                                  |
|                   | > \(1\) Serve as the point-of-contact for        |
|                   | > data-specific access control issues;           |
|                   | >                                                |
|                   | > \(2\) Assign appropriate sensitivity levels to |
|                   | > corporate data;                                |
|                   | >                                                |
|                   | > \(3\) Identify categories of users who are     |
|                   | > authorized to access corporate data;           |
|                   | >                                                |
|                   | > \(4\) Develop access rules for controlling     |
|                   | > access to corporate data; and                  |
|                   | >                                                |
|                   | > \(5\) Periodically review access control lists |
|                   | > to evaluate compliance with established data   |
|                   | > access business rules through coordination     |
|                   | > with division or office ISM\'s.                |
|                   |                                                  |
|                   | f\. The **Client-Server Database Unit** shall:   |
|                   |                                                  |
|                   | > \(1\) Review day-to-day client-server access   |
|                   | > control operations, including application      |
|                   | > level changes and the update of appropriate    |
|                   | > server information;                            |
|                   | >                                                |
|                   | > \(2\) Assist in periodic access authorization  |
|                   | > reviews to facilitate validation and user      |
|                   | > access clean-up activities;                    |
|                   | >                                                |
|                   | > \(3\) Manage client-server database inventory  |
|                   | > and generate user ID listings for validation   |
|                   | > and deletion efforts;                          |
|                   | >                                                |
|                   | > \(4\) Assist in the correction of              |
|                   | > application-specific access tables as directed |
|                   | > and authorized by appropriate application      |
|                   | > security personnel;                            |
|                   | >                                                |
|                   | > \(5\) Assist in the formulation and            |
|                   | > translation of documented application access   |
|                   | > control requirements into database specific    |
|                   | > control mechanisms to support proper           |
|                   | > implementation on the respective client-server |
|                   | > database platform;                             |
+-------------------+--------------------------------------------------+

+-------------------+--------------------------------------------------+
| > **Roles and     | > \(6\) Ensure separation of development,        |
| > R               | > production, and other environments, and        |
| esponsibilities** | > execute approved access control procedures     |
| >                 | > related to the respective environments;        |
| > **(cont'd)**    | >                                                |
|                   | > \(7\) Execute authorized access control user   |
|                   | > requests in accordance with established FDIC   |
|                   | > security policies and procedures; and          |
|                   | >                                                |
|                   | > \(8\) Perform database user password reset     |
|                   | > activities when appropriate.                   |
|                   |                                                  |
|                   | g\. **Supervisors and Contract Oversight         |
|                   | Managers** shall:                                |
|                   |                                                  |
|                   | > \(1\) Ensure that all users providing AIS      |
|                   | > support or maintaining FDIC data are aware of  |
|                   | > FDIC access control policies and procedures;   |
|                   | >                                                |
|                   | > \(2\) Ensure that employee and contractor      |
|                   | > access levels are necessary and appropriate to |
|                   | > perform their job functions;                   |
|                   | >                                                |
|                   | > \(3\) Ensure users they supervise utilize form |
|                   | > FDIC 1370/02, for all additions, changes, or   |
|                   | > deletions to user access privileges and        |
|                   | > forward the form to DIRM ISS;                  |
|                   | >                                                |
|                   | > \(4\) Ensure those requesting access to        |
|                   | > applications or network resources use the      |
|                   | > Access Authorization Security Application      |
|                   | > (AASA);                                        |
|                   | >                                                |
|                   | > \(5\) Notify administrative officers of        |
|                   | > long-term employee absences to ensure that the |
|                   | > accounts are disabled for the period of user   |
|                   | > absence;                                       |
|                   | >                                                |
|                   | > \(6\) Initiate corrective action in the event  |
|                   | > of policy violations by subordinates; and      |
|                   | >                                                |
|                   | > \(7\) Maintain up-to-date records of access    |
|                   | > privileges for employees and contractors under |
|                   | > their supervision.                             |
|                   | >                                                |
|                   | > **Note**: Technical Monitors may also approve  |
|                   | > access privileges of employees and contractors |
|                   | > transferring in and out of their division or   |
|                   | > office.                                        |
|                   |                                                  |
|                   | h\. Administrative Officers shall:               |
|                   |                                                  |
|                   | > \(1\) Notify Access Control by sending a       |
|                   | > digitally signed and encrypted E-mail          |
|                   | > containing form FDIC 1370/07, that lists all   |
|                   | > new employee and contractor hires, as soon as  |
|                   | > possible;                                      |
+-------------------+--------------------------------------------------+

+-------------------+--------------------------------------------------+
| > **Roles and     | > \(2\) Send new users' NT ID and temporary      |
| > R               | > password to their supervisor/OM;               |
| esponsibilities** | >                                                |
| >                 | > \(3\) Notify Access Control by digitally       |
| > **(cont'd)**    | > signed E-mail of all employee transfers,       |
|                   | > details, and employee/contractor employment    |
|                   | > separations;                                   |
|                   | >                                                |
|                   | > \(4\) Sign form FDIC 2150/01, Pre-Exit         |
|                   | > Clearance Record for Employees;                |
|                   | >                                                |
|                   | > \(5\) Notify Access Control of long-term       |
|                   | > absences by employees to ensure that accounts  |
|                   | > are disabled for the period of time the        |
|                   | > employee is absent;                            |
|                   | >                                                |
|                   | > \(6\) Notify Access Control of name changes;   |
|                   | > and                                            |
|                   | >                                                |
|                   | > \(7\) Notify Access Control of users' needing  |
|                   | > ETV supervisory access.                        |
|                   |                                                  |
|                   | i\. **System Developers** shall:                 |
|                   |                                                  |
|                   | > \(1\) Assist program managers and ISMs in      |
|                   | > establishing access authorization processes,   |
|                   | > forms, and user profiles in application        |
|                   | > software, to include access controls that are  |
|                   | > consistent with user requirements;             |
|                   | >                                                |
|                   | > \(2\) Assist program managers and ISMs in      |
|                   | > protecting production data and support the     |
|                   | > establishment or modification of procedures to |
|                   | > protect production data used in other          |
|                   | > environments;                                  |
|                   | >                                                |
|                   | > \(3\) Ensure systems under                     |
|                   | > development/modification are compliant with    |
|                   | > FDIC Circular 1320.3 and other security        |
|                   | > related directives;                            |
|                   | >                                                |
|                   | > \(4\) Define and include audit trails and      |
|                   | > appropriate accountability measures in the     |
|                   | > development of new and existing applications   |
|                   | > consistent with user requirements;             |
|                   | >                                                |
|                   | > \(5\) Provide technical support for access     |
|                   | > control and data clean-up activities;          |
|                   | >                                                |
|                   | > \(6\) Support separation of development,       |
|                   | > production, and other environments and manage  |
|                   | > access control procedures relating to the      |
|                   | > development environment; and                   |
|                   | >                                                |
|                   | > \(7\) Implement password standards as          |
|                   | > established by DIRM ISS.                       |
+-------------------+--------------------------------------------------+

+-------------------+--------------------------------------------------+
| > **Roles and     | j\. **LAN System Administrators** shall:         |
| > R               |                                                  |
| esponsibilities** | > \(1\) Implement access control procedures for  |
| >                 | > LANs as prescribed by DIRM ISS;                |
| > **(cont'd)**    | >                                                |
|                   | > \(2\) Add/delete/modify user IDs and security  |
|                   | > settings for LAN users' based on request from  |
|                   | > DIRM ISS;                                      |
|                   | >                                                |
|                   | > \(3\) Support the LAN Security Monitoring      |
|                   | > Program as established by DIRM ISS;            |
|                   | >                                                |
|                   | > \(4\) Work with DIRM ISS and ISMs on resolving |
|                   | > existing security issues as deemed             |
|                   | > appropriate;                                   |
|                   | >                                                |
|                   | > \(5\) Perform periodic reviews/audits to       |
|                   | > ensure compliance with FDIC Circular 1360.10,  |
|                   | > Corporate Password Standards*;*                |
|                   | >                                                |
|                   | > \(6\) Maintain server audit logs based on      |
|                   | > criteria developed and provided by DIRM; and   |
|                   | >                                                |
|                   | > \(7\) Safeguard the LAN and related            |
|                   | > systems/operations from any behavior not       |
|                   | > compliant with this circular.                  |
|                   |                                                  |
|                   | k\. **Users (Employees and Contractors) of FDIC  |
|                   | Systems** shall:                                 |
|                   |                                                  |
|                   | > \(1\) Complete all security awareness training |
|                   | > addressing Access Control;                     |
|                   | >                                                |
|                   | > \(2\) Complete form FDIC 1370/02 to request    |
|                   | > addition, modification, or removal of computer |
|                   | > access privileges, and acknowledge             |
|                   | > responsibility to protect the user ID, and     |
|                   | > submit form to supervisor for approval;        |
|                   | >                                                |
|                   | > \(3\) Abide by the password policies           |
|                   | > prescribed by FDIC Circular 1360.10;           |
|                   | >                                                |
|                   | > \(4\) Seek access to only those systems and    |
|                   | > data that are authorized by their supervisor   |
|                   | > or other appropriate officials as required to  |
|                   | > carry out their job responsibilities;          |
|                   | >                                                |
|                   | > **Note**: Users shall not seek access to       |
|                   | > systems or data that is unauthorized.          |
|                   | >                                                |
|                   | > \(5\) Follow established exit procedures that  |
|                   | > will ensure timely access removal from FDIC    |
|                   | > AISs;                                          |
+-------------------+--------------------------------------------------+

+-------------------+--------------------------------------------------+
| > **Roles and**   | > \(6\) Report any suspected computer system     |
| >                 | > violation to the FDIC CSIRT; and               |
| > **R             | >                                                |
| esponsibilities** | > \(7\) Protect FDIC systems and data through    |
| >                 | > compliance with this circular.                 |
| > **(cont'd)**    |                                                  |
|                   | l\. The **National Technical Call Center**       |
|                   | shall:                                           |
|                   |                                                  |
|                   | > \(1\) Perform password reset requests for      |
|                   | > network, SQL, and mainframe applications; and  |
|                   | >                                                |
|                   | > \(2\) Report any suspected computer system     |
|                   | > violations to the FDIC CSIRT.                  |
|                   |                                                  |
|                   | m\. The **OIG shall**, where necessary, audit or |
|                   | respond as appropriate to alleged or reported    |
|                   | non-compliant activities relating to this        |
|                   | circular.                                        |
+-------------------+--------------------------------------------------+
|                   |                                                  |
+-------------------+--------------------------------------------------+
| **8. Disciplinary | Users who willfully or knowingly violate or      |
| Action**          | otherwise abuse the provisions of this policy    |
|                   | may be subject to disciplinary action. Any       |
|                   | disciplinary action shall be administered in     |
|                   | accordance with applicable laws and regulations, |
|                   | including FDIC Circulars 2410.6, Standards of    |
|                   | Ethical Conduct for Employees of the Federal     |
|                   | Deposit Insurance Corporation (FDIC), and        |
|                   | 2750.1, Disciplinary and Adverse Action, and     |
|                   | applicable collective bargaining agreements.     |
+-------------------+--------------------------------------------------+
|                   |                                                  |
+-------------------+--------------------------------------------------+
| **9. Forms        | All forms referenced in this circular are        |
| Availability**    | available on the FDICnet under FDIC Business     |
|                   | Tools, Policy, FILs, Directives, Standardized    |
|                   | Forms.                                           |
+-------------------+--------------------------------------------------+
|                   |                                                  |
+-------------------+--------------------------------------------------+
| **10. Questions** | Questions regarding this circular should be      |
|                   | referred to DIRM Information Security Staff,     |
|                   | Chief, Security Operations Section.              |
+-------------------+--------------------------------------------------+
|                   |                                                  |
+-------------------+--------------------------------------------------+
| **11. Effective   | The provisions outlined in this circular are     |
| Date**            | effective immediately.                           |
+-------------------+--------------------------------------------------+