#### ![](media/image1.png)

#### 

#### ![](media/image2.jpeg){width="6.6in" height="4.5777777777777775in"}

######### September 20, 2001

**Sensitive But Unclassified**

**or**

**Above Once Completed**

#### Table of Contents

Introduction [iii](#introduction)

1\. ISSO Specific Questions [2](#isso-specific-questions)

2\. Training and Awareness [4](#training-and-awareness)

3\. Waivers [6](#waivers)

4\. Logs [7](#logs)

5\. Monitoring System Users [10](#monitoring-system-users)

6\. Incident Handling Procedures [11](#incident-handling-procedures)

7\. Background Investigations [12](#background-investigations)

8\. Disposition [13](#disposition)

9\. Domain Servers [14](#domain-servers)

10\. Classified & TEMPEST System Specific Questions
[15](#classified-tempest-system-specific-questions)

11\. System Access and Employee Check-Out
[19](#system-access-and-employee-check-out)

12\. Transfer of Files or Equipment
[24](#transfer-of-files-or-equipment)

13\. Backups, Recovery Plans, and Security Plans
[25](#backups-recovery-plans-and-security-plans)

14\. Laptop Policy [29](#laptop-policy)

15\. Expansion Plan [31](#expansion-plan)

16\. Procurement [32](#procurement)

17\. C2 Functionality [33](#c2-functionality)

18\. Software [34](#software)

19\. Security Configuration Documents
[36](#security-configuration-documents)

20\. Built-In Local Groups [38](#built-in-local-groups)

21\. After-Hours Use [38](#after-hours-use)

22\. Visual Checks [39](#visual-checks)

23\. Internet System Checks [44](#internet-system-checks)

24\. Digital Copiers [48](#digital-copiers)

25\. Critical Technical or Critical HUMINT Threat Posts
[49](#critical-technical-or-critical-humint-threat-posts)

26\. Telecommuting [52](#telecommuting)

27\. Additional Questions [53](#additional-questions)

# Introduction 

DS/ACD/CS developed this document in an effort to assist posts with
performing a self-assessment of their computer security posture as well
as meet several FAM requirements. According to 12 FAM 600 (Sections
622.1-13, 629.2-6, and 638.1-8), the ISSO, in conjunction with the
administrative officer, RSO or PSO and other appropriate post personnel,
will conduct an annual review of user and system operation practices to
evaluate compliance against existing policies and practices. This
document will not only assist in fulfilling this FAM requirement, but
once completed, will also be useful for regionally-based personnel
(e.g., RIMC, ESC, ESO) when visiting post.

The following points will aid you in completing this report:

-   Change the classification of the report, as applicable. The
    classification of the completed form may be different from this
    blank questionnaire. If a response to questions indicates a
    vulnerability, classify the report at the appropriate level.

-   Similar topics for both the unclassified and classified systems are
    grouped together.

-   In some cases, you may need to seek answers from others at your
    location.

-   For ease of reference, where applicable, 12 FAM 600 (dated June
    22, 2000) and other references are added. Note that some FAM
    references may have been omitted.

-   If needed, use additional pages when completing this report.

Please note that this self assessment does not cover every regulation in
the FAM pertaining to computer security, but it was written to ensure
post is meeting the minimum requirements for an adequate computer
security program. Computer security is a dynamic field, and it is
impossible to develop standards that would apply to every configuration
or scenario that a post may need. The FAM provides good general
guidance, and if post is planning to deviate from that standard, then
advice should be sought from headquarter elements.

Other security and systems personnel may also find this document helpful
when performing a "real world" review of their computer security
posture. Questions or comments concerning this document should be
addressed to DS/ACD/CS Branch Chief, Brian Jablon or to Senior Computer
Security Specialist Wendy Cohen.

#### Overseas Computer Security Review

  ------------------------- ---------------------------------------------
  Date of Report:           

  Reporting Officer:        

  Title of Reporting        
  Officer:                  

  Location:                 

  Street Address:           

                            

  Annex Locations:          

                            

                            
  ------------------------- ---------------------------------------------

# 1. ISSO Specific Questions

  ------ ----------------------------------------------------------------
  1.1    Were the ISSO and alternate ISSO formally appointed? (12 FAM
         613.3, 622.1, 632.1-2)

  ------ ----------------------------------------------------------------

+--------------------------+---------------------+---------------------+
| Title:                   | Unclassified        | Classified          |
+--------------------------+---------------------+---------------------+
| Primary ISSO             | Yes                 | Yes                 |
|                          |                     |                     |
|                          | No                  | No                  |
+--------------------------+---------------------+---------------------+
| Alternate ISSO           | Yes                 | Yes                 |
|                          |                     |                     |
|                          | No                  | No                  |
+--------------------------+---------------------+---------------------+

  ------ ----------------------------------------------------------------
  1.2    ISSO Contact Information:

  ------ ----------------------------------------------------------------

  ------------------------ ----------------------------------------------
  Name of Primary ISSO     

  Telephone:               

  Name of Alternate ISSO   

  Telephone:               
  ------------------------ ----------------------------------------------

  ------ ----------------------------------------------------------------
  1.3    Does the ISSO and alternate Department of State employee have a
         Top Secret clearance? (12 FAM 632.1-2)

  ------ ----------------------------------------------------------------

+--------------------------+---------------------+---------------------+
| Title:                   | Unclassified        | Classified          |
+--------------------------+---------------------+---------------------+
| Primary ISSO             | Yes                 | Yes                 |
|                          |                     |                     |
|                          | No                  | No                  |
+--------------------------+---------------------+---------------------+
| Alternate ISSO           | Yes                 | Yes                 |
|                          |                     |                     |
|                          | No                  | No                  |
+--------------------------+---------------------+---------------------+

  ------ ----------------------------------------------------------------
  1.4    Does the primary and alternate ISSOs work requirements statement
         include the ISSO duties? (12 FAM 621.3-1, 622.1-1)

  ------ ----------------------------------------------------------------

+--------------------------+---------------------+---------------------+
| Title:                   | Unclassified        | Classified          |
+--------------------------+---------------------+---------------------+
| Primary ISSO             | Yes                 | Yes                 |
|                          |                     |                     |
|                          | No                  | No                  |
+--------------------------+---------------------+---------------------+
| Alternate ISSO           | Yes                 | Yes                 |
|                          |                     |                     |
|                          | No                  | No                  |
+--------------------------+---------------------+---------------------+

  ------ ----------------------------------------------------------------
  1.5    Have the ISSOs attended the one-week ISSO class offered by the
         Diplomatic Security Training Center (DS/PLD/TC), or the ISSO
         class on CD-ROM? (12 FAM 622.2, 632.2)

  ------ ----------------------------------------------------------------

+--------------------------+---------------------+---------------------+
| Title:                   | Unclassified        | Classified          |
+--------------------------+---------------------+---------------------+
| Primary ISSO             | Yes                 | Yes                 |
|                          |                     |                     |
|                          | No                  | No                  |
+--------------------------+---------------------+---------------------+
| Alternate ISSO           | Yes                 | Yes                 |
|                          |                     |                     |
|                          | No                  | No                  |
+--------------------------+---------------------+---------------------+

  ------ ----------------------------------------------------------------
  1.6    Do the ISSOs have administrator access to the systems? (12 FAM
         622.1-1)

  ------ ----------------------------------------------------------------

+--------------------------+---------------------+---------------------+
| Title:                   | Unclassified        | Classified          |
+--------------------------+---------------------+---------------------+
| Primary ISSO             | Yes                 | Yes                 |
|                          |                     |                     |
|                          | No                  | No                  |
+--------------------------+---------------------+---------------------+
| Alternate ISSO           | Yes                 | Yes                 |
|                          |                     |                     |
|                          | No                  | No                  |
+--------------------------+---------------------+---------------------+

# 2. Training and Awareness

  ------ ----------------------------------------------------------------
  2.1    Mark the following briefings provided to users. (12 FAM 622.2,
         632.2)

  ------ ----------------------------------------------------------------

  ----- ----- -----------------------------------------------------------
  Yes   No    Topic:

              General Automated Information Systems (AIS) Computer
              Security Awareness

              Internet Awareness

              Laptop Security

              Windows NT Security

              C-LAN Security

              Job specific information

              None

              Other:
  ----- ----- -----------------------------------------------------------

  ------ ----------------------------------------------------------------
  2.2    Training is provided either prior to granting new users access
         to the system or as soon as possible after access has been
         granted. (12 FAM 629.2-8, 632.2)

  ------ ----------------------------------------------------------------

+----------------------------+-------------------+---------------------+
| SBU/Unclassified Systems:  | Internet Systems: | Classified Systems: |
+----------------------------+-------------------+---------------------+
| Yes                        | Yes               | Yes                 |
|                            |                   |                     |
| No                         | No                | No                  |
+----------------------------+-------------------+---------------------+

  ------ ----------------------------------------------------------------
  2.3    Indicate which topics users receive in their training that
         explains their security responsibilities: (12 FAM 622.1-4,
         622.2, 625.2-1, 625.2-2, 632.1-5, 632.2)

  ------ ----------------------------------------------------------------

  ------------------------------------------------------------------------
  Yes   No    Topic:
  ----- ----- ------------------------------------------------------------
              No expectation of privacy

              Password policy

              Password protection

              Logging off or locking the system before leaving it
              unattended

              Labeling media and equipment

              Magnetic media and hard copy output destruction

              Protection of equipment/tampering with equipment

              Appropriate system use

              Data back up

              Portable computing

              Internet computing

              Strictly unclassified processing on the Internet

              No adult or child pornography sites

              Downloading of games and software is not allowed

              E-mail policy

              Chain letters and electronic greeting cards

              Malicious code

              Being audited

              Not processing classified information on unclassified
              systems

              Personal use of government equipment

              Access controls

              Removal of U.S. Government microcomputers or media

              Reporting incidents of fraud, misuse, disclosure of
              information, destruction or modification of data, or
              unauthorized access attempts

              Processing on privately owned microcomputers.

              Not applicable, as briefings are not given
  ------------------------------------------------------------------------

  ------ ----------------------------------------------------------------
  2.4    Signed Student Acknowledgement Forms are kept on file. (98 State
         179922)

  ------ ----------------------------------------------------------------

+-----------------------------------------------------------------------+
| Yes                                                                   |
|                                                                       |
| No                                                                    |
+-----------------------------------------------------------------------+

  ------ ----------------------------------------------------------------
  2.5    Specify the Student Acknowledgement Forms for the various
         briefings and their location:

  ------ ----------------------------------------------------------------

  ---------------------------------------- ------------------------------
  Briefing Topic:                          Location:

                                           

                                           

                                           

                                           
  ---------------------------------------- ------------------------------

# 3. Waivers

  ------ ----------------------------------------------------------------
  3.1    Copies of computer systems software waivers granted by DS are on
         file. (12 FAM 626.2-3)

  ------ ----------------------------------------------------------------

+-----------------------------------------------------------------------+
| Yes                                                                   |
|                                                                       |
| No                                                                    |
+-----------------------------------------------------------------------+

  ------ ----------------------------------------------------------------
  3.2    Specify these waivers and provide the purpose and a description.

  ------ ----------------------------------------------------------------

  ------------------------ ----------------------------------------------
  Date, Title, and Cable   Description of Waiver:
  Number of Waiver:        

                           

                           

                           

                           

                           
  ------------------------ ----------------------------------------------

# 4. Logs

  ------ ----------------------------------------------------------------
  4.1    The ISSO performs regular monthly audit log reviews. (12 FAM
         622.5, 629.2-7, 629.2-8, 632.1-11, 638.1-9, 00 State 106317)

  ------ ----------------------------------------------------------------

+----------------------------+-----------------------------------------+
| Internet Systems:          | Yes                                     |
|                            |                                         |
|                            | No                                      |
|                            |                                         |
|                            | Frequency:                              |
+----------------------------+-----------------------------------------+
| SBU/Unclassified Systems:  | Yes                                     |
|                            |                                         |
|                            | No                                      |
|                            |                                         |
|                            | Frequency:                              |
+----------------------------+-----------------------------------------+
| Classified Systems:        | Yes                                     |
|                            |                                         |
|                            | No                                      |
|                            |                                         |
|                            | Frequency:                              |
+----------------------------+-----------------------------------------+

  ------ ----------------------------------------------------------------
  4.2    Indicate where the audit logs are stored. Include the logical
         path (i.e., c:\\temp\\security.logs), as well as location (room
         number, and if they are in a safe, on top of a bookcase, etc):

  ------ ----------------------------------------------------------------

  ----------------------- -----------------------------------------------
  Internet logs:          

  SBU/Unclassified:       

  Classified logs:        
  ----------------------- -----------------------------------------------

  ------ ----------------------------------------------------------------
  4.3    Are the event viewer and the audit logs properly protected, with
         only the ISSO and System Security Administrator having access to
         the directory?

  ------ ----------------------------------------------------------------

+----------------------------+-----------------------------------------+
| Internet Systems:          | Yes                                     |
|                            |                                         |
|                            | No                                      |
+----------------------------+-----------------------------------------+
| SBU/Unclassified Systems:  | Yes                                     |
|                            |                                         |
|                            | No                                      |
+----------------------------+-----------------------------------------+
| Classified Systems:        | Yes                                     |
|                            |                                         |
|                            | No                                      |
+----------------------------+-----------------------------------------+

  ------ ----------------------------------------------------------------
  4.4    The ISSO keeps the logs for six months. (12 FAM 622.5, 629.2-7,
         632.5, 638.1-9, 642.4-5)

  ------ ----------------------------------------------------------------

+----------------------------+-------------------+---------------------+
| SBU/Unclassified Systems:  | Internet Systems: | Classified Systems: |
+----------------------------+-------------------+---------------------+
| Yes                        | Yes               | Yes                 |
|                            |                   |                     |
| No                         | No                | No                  |
+----------------------------+-------------------+---------------------+

  ------ ----------------------------------------------------------------
  4.5    At a minimum, the ISSO ensures that audit logs are scanned for
         the following: (12 FAM 629.2-7.b at a minimum, 638.1-9)

  ------ ----------------------------------------------------------------

+-----------------+-----------------+----------------+----------------+
|                 | S               | Internet       | Classified     |
|                 | BU/Unclassified | Systems:       | Systems:       |
|                 | Systems:        |                |                |
+-----------------+-----------------+----------------+----------------+
| Multiple logon  | Yes             | Yes            | Yes            |
| failures        |                 |                |                |
|                 | No              | No             | No             |
+-----------------+-----------------+----------------+----------------+
| Logons after    | Yes             | Yes            | Yes            |
| hours or at     |                 |                |                |
| unusual times   | No              | No             | No             |
+-----------------+-----------------+----------------+----------------+
| Failed attempts | Yes             | Yes            | Yes            |
| to execute      |                 |                |                |
| programs or     | No              | No             | No             |
| access files    |                 |                |                |
+-----------------+-----------------+----------------+----------------+
| Addition,       | Yes             | Yes            | Yes            |
| deletion, or    |                 |                |                |
| modification of | No              | No             | No             |
| user or program |                 |                |                |
| access          |                 |                |                |
| privileges      |                 |                |                |
+-----------------+-----------------+----------------+----------------+
| Changes in file | Yes             | Yes            | Yes            |
| access          |                 |                |                |
| restrictions    | No              | No             | No             |
+-----------------+-----------------+----------------+----------------+

  ------ ----------------------------------------------------------------
  4.6    The ISSO assures that the following logs are maintained for all
         facilities: (12 FAM 622.5, 629.3-4, 632.5)

  ------ ----------------------------------------------------------------

+-----------------------------------+-----------------------------------+
| SBU/Unclassified/Internet         | Classified Systems:               |
| Systems:                          |                                   |
+-----------------------------------+-----------------------------------+
| Authorized access lists for       | Authorized access lists for       |
| computer facilities               | computer facilities               |
|                                   |                                   |
| Visitors logs for the main        | Visitors logs for the main        |
| computer room                     | computer room                     |
|                                   |                                   |
| System access requests            | System access requests            |
|                                   |                                   |
| Password receipts/security        | Password receipts/security        |
| acknowledgements                  | acknowledgements                  |
|                                   |                                   |
| System maintenance logs           | System maintenance logs           |
|                                   |                                   |
| Audit logs                        | Audit trail logs                  |
|                                   |                                   |
| System operation logs             | System operation logs             |
|                                   |                                   |
| Extended operation logs           |                                   |
+-----------------------------------+-----------------------------------+

  ------ ----------------------------------------------------------------
  4.7    The ISSO informs the RSO/PSO of security-related anomalies
         discovered during the review of audit logs. (12 FAM 622.1-14,
         632.1-11)

  ------ ----------------------------------------------------------------

+-----------------------------------------------------------------------+
| Yes                                                                   |
|                                                                       |
| No                                                                    |
+-----------------------------------------------------------------------+

  ------ ----------------------------------------------------------------
  4.8    List additional tools used in the monitoring of the various
         systems.

  ------ ----------------------------------------------------------------

  -----------------------------------------------------------------------

  -----------------------------------------------------------------------

# 5. Monitoring System Users

  ------ ----------------------------------------------------------------
  5.1    On a monthly basis, the ISSO scans for materials on both the SBU
         and Internet: (12 FAM 622.1-8, 632.1-8)

  ------ ----------------------------------------------------------------

+--------------------------------+-----------+-----------+-----------+
| Scanned Information:           | SBU       | Internet  | C         |
|                                | Systems:  | Systems:  | lassified |
|                                |           |           | Systems:  |
+--------------------------------+-----------+-----------+-----------+
| Adequately protecting          | Yes       | Yes       | Yes       |
| sensitive information          |           |           |           |
|                                | No        | No        | No        |
+--------------------------------+-----------+-----------+-----------+
| Archiving sensitive            | Yes       | Yes       | Yes       |
| information                    |           |           |           |
|                                | No        | No        | No        |
+--------------------------------+-----------+-----------+-----------+
| Maintaining sensitive          | Yes       | Yes       | Yes       |
| information on the AIS for the |           |           |           |
| minimum amount of time         | No        | No        | No        |
| necessary                      |           |           |           |
+--------------------------------+-----------+-----------+-----------+
| Not processing classified      | Yes       | Yes       |           |
| information on the AIS         |           |           |           |
|                                | No        | No        |           |
+--------------------------------+-----------+-----------+-----------+
| Scans e-mail for information   | Yes       | Yes       |           |
| being processed over the level |           |           |           |
| for the system (12 FAM 645.5)  | No        | No        |           |
+--------------------------------+-----------+-----------+-----------+
| Inappropriate materials        | Yes       | Yes       | Yes       |
|                                |           |           |           |
|                                | No        | No        | No        |
+--------------------------------+-----------+-----------+-----------+

# 6. Incident Handling Procedures

  ------ ----------------------------------------------------------------
  6.1    Does the ISSO investigate suspected security incidents involving
         information systems with the security officer (12 FAM 613.4)?
         This is done by either providing the RSO/PSO with technical
         assistance and advice (622.1-9) or by investigating all known or
         suspected incidents of noncompliance with the RSO/PSO (632.1-8).

  ------ ----------------------------------------------------------------

+-----------------------------------------------------------------------+
| Yes                                                                   |
|                                                                       |
| No                                                                    |
+-----------------------------------------------------------------------+

  ------------ ----------------------------------------------------------
  Comments:    

               
  ------------ ----------------------------------------------------------

+-----+----------------------------------------------------------------+
| 6.2 | Describe the incident handling and reporting procedures for    |
|     | the various systems.                                           |
|     |                                                                |
|     | (12 FAM 622.1-9, 622.1-10, 632.1-7, 632.1-8, 644.3)            |
+-----+----------------------------------------------------------------+

  ---------------------- ------------------------------------------------
  SBU/Unclassified       
  Systems:               

                         

                         

  Internet Systems:      

                         

                         

  Classified Systems:    

                         

                         
  ---------------------- ------------------------------------------------

  ------ ----------------------------------------------------------------
  6.3    Describe the last known or suspected computer security related
         incidents for the last 12 months. Note: a "security incident" is
         a failure to safeguard classified materials in accordance with
         12 FAM 500, 12 FAM 600, 12 FAH-6, 5 FAH-6, and other applicable
         requirements for the safeguarding of classified material.
         Security incidents may be judged as either security infractions
         or security violations. (12 FAM 622.1-10, 632.1-8, 550)

  ------ ----------------------------------------------------------------

  ------------ ----------------------------------------------------------
  Date:        Description of Known or Suspected Incident:

               

               

               

               

               

               

               
  ------------ ----------------------------------------------------------

# 7. Background Investigations

  ------ ----------------------------------------------------------------
  7.1    Abroad, the RSO/PSO performs the highest level background
         investigation checks on FSN administrators, TCNs, and local
         contractors. (12 FAM 621.2-2)

  ------ ----------------------------------------------------------------

+-----------------------------------------------------------------------+
| Yes                                                                   |
|                                                                       |
| No                                                                    |
+-----------------------------------------------------------------------+

  ------- ----------------------------------------------------------------
  7.1.1   If the RSO/PSO does not perform the background investigations on
          FSN administrators, note who does:

  ------- ----------------------------------------------------------------

  --------- -------------------------------------------------------------
            

  --------- -------------------------------------------------------------

  ------ ----------------------------------------------------------------
  7.2    The RSO performs background investigation checks on vendors who
         perform service calls. (12 FAM 621.2-2)

  ------ ----------------------------------------------------------------

+-----------------------------------------------------------------------+
| Yes                                                                   |
|                                                                       |
| No                                                                    |
+-----------------------------------------------------------------------+

  ------- ----------------------------------------------------------------
  7.2.1   If the RSO/PSO does not perform the background investigation
          checks on vendors, note who does:

  ------- ----------------------------------------------------------------

  --------- -------------------------------------------------------------
            

  --------- -------------------------------------------------------------

# 8. Disposition

  ------ ----------------------------------------------------------------
  8.1    Describe what is done with damaged or no longer needed floppy
         diskettes and hard drives: (12 FAM 622.1-11, 626.1-1, 626.2-1,
         629.2-4, 629.6, 632.1-9. 636)

  ------ ----------------------------------------------------------------

  ---------------------- ------------------------------------------------
  SBU/Unclassified       
  Systems:               

                         

                         

  Classified Systems:    

                         

                         
  ---------------------- ------------------------------------------------

  ------ ----------------------------------------------------------------
  8.2    Describe the method used to destroy diskettes and hard drives:
         (12 FAM 622.1-11, 626.1-1, 632.1-9)

  ------ ----------------------------------------------------------------

  ---------------------- ------------------------------------------------
  SBU/Unclassified       
  Systems:               

                         

                         

  Classified Systems:    

                         

                         
  ---------------------- ------------------------------------------------

# 9. Domain Servers

  ------ ----------------------------------------------------------------
  9.1    Catalog all servers on the Domain. Note: the system manager
         should have this in place.

  ------ ----------------------------------------------------------------

  ------------------------ ----------------------------------------------
  Server Name              Server Type (PDC, BDC, Exch, File Srvr, Fax
                           Srvr, other)

                           

                           

                           

                           

                           

                           

                           

                           

                           
  ------------------------ ----------------------------------------------

+-----+----------------------------------------------------------------+
| 9.2 | Request LAN floor drawings or previous reports (e.g. ALMA      |
|     | report/drawings).                                              |
|     |                                                                |
|     | Attach LAN floor diagrams and/or network topology diagrams to  |
|     | this document.                                                 |
+-----+----------------------------------------------------------------+

# 10. Classified & TEMPEST System Specific Questions

Where possible, check answers against system realities.

  ------ ----------------------------------------------------------------
  10.1   Catalog all servers on the Domain:

  ------ ----------------------------------------------------------------

  --------------------- -------------------------------------------------
  Server Name           Server Type (PDC, BDC, Exch, File Srvr, Fax Srvr,
                        other)

                        

                        

                        

                        

                        

                        

                        

                        

                        
  --------------------- -------------------------------------------------

  ------ ----------------------------------------------------------------
  10.2   Request LAN floor drawings or previous reports. Attach LAN floor
         diagrams and/or network diagrams to this document.

  ------ ----------------------------------------------------------------

  ------ ----------------------------------------------------------------
  10.3   Post has had a TEMPEST review by the Department's Certified
         TEMPEST Technical Authority (CTTA) (DS/IST/CMP). If so, indicate
         the date of the latest review, and the telegram number. (12 FAM
         634.2)

  ------ ----------------------------------------------------------------

+-----------------------------------------------------------------------+
| Yes                                                                   |
|                                                                       |
| No                                                                    |
+-----------------------------------------------------------------------+

  ------------------------------- ---------------------------------------
  Date of Review and Telegram     
  Number:                         

  ------------------------------- ---------------------------------------

  ------ ----------------------------------------------------------------
  10.4   Document the location and type of standalone TEMPEST PCs:

  ------ ----------------------------------------------------------------

  -----------------------------------------------------------------------

  -----------------------------------------------------------------------

  ------ ----------------------------------------------------------------
  10.5   Do the C-LAN terminals meet the TEMPEST separation and
         zone-of-control requirements? (12 FAM 634.2, 638.5, 6 FAH)

  ------ ----------------------------------------------------------------

+-----------------------------------------------------------------------+
| Yes                                                                   |
|                                                                       |
| No                                                                    |
+-----------------------------------------------------------------------+

  -------- ----------------------------------------------------------------
  10.5.1   Note which rooms if this is not the case:

  -------- ----------------------------------------------------------------

  -----------------------------------------------------------------------

  -----------------------------------------------------------------------

  ------ ----------------------------------------------------------------
  10.6   Are any of the C-LAN terminals viewable from exterior windows?
         (12 FAM 633.2-2, 638.3-2)

  ------ ----------------------------------------------------------------

+-----------------------------------------------------------------------+
| Yes                                                                   |
|                                                                       |
| No                                                                    |
+-----------------------------------------------------------------------+

  -------- ----------------------------------------------------------------
  10.6.1   Note which rooms if this is the case:

  -------- ----------------------------------------------------------------

  -----------------------------------------------------------------------

  -----------------------------------------------------------------------

  ------ ----------------------------------------------------------------
  10.7   Are any of the C-LAN terminals viewable from outside the CAA
         from within the Embassy/Consulate. (12 FAM 633.2-2, 638.3-2)

  ------ ----------------------------------------------------------------

+-----------------------------------------------------------------------+
| Yes                                                                   |
|                                                                       |
| No                                                                    |
+-----------------------------------------------------------------------+

  -------- ----------------------------------------------------------------
  10.7.1   Note which rooms if this is the case:

  -------- ----------------------------------------------------------------

  -----------------------------------------------------------------------

  -----------------------------------------------------------------------

  ------ ----------------------------------------------------------------
  10.8   Check LAN lines that connect the equipment. Do any of the LAN
         lines traverse areas not controlled by USG? (12 FAM 634)

  ------ ----------------------------------------------------------------

+-----------------------------------------------------------------------+
| Yes                                                                   |
|                                                                       |
| No                                                                    |
+-----------------------------------------------------------------------+

  -------- ----------------------------------------------------------------
  10.8.1   If so, describe the areas the lines traverse.

  -------- ----------------------------------------------------------------

  -----------------------------------------------------------------------

  -----------------------------------------------------------------------

  -------- ----------------------------------------------------------------
  10.8.2   If LAN lines connect systems in other buildings, are those
           signal lines under USG control? (12 FAM 634)

  -------- ----------------------------------------------------------------

+-----------------------------------------------------------------------+
| Yes                                                                   |
|                                                                       |
| No                                                                    |
+-----------------------------------------------------------------------+

  -------- ----------------------------------------------------------------
  10.8.3   Are the lines encrypted?

  -------- ----------------------------------------------------------------

+-----------------------------------------------------------------------+
| Yes                                                                   |
|                                                                       |
| No                                                                    |
+-----------------------------------------------------------------------+

  -------- ----------------------------------------------------------------
  10.8.4   Are cables traversing through non-CAA spaces encrypted?

  -------- ----------------------------------------------------------------

+-----------------------------------------------------------------------+
| Yes                                                                   |
|                                                                       |
| No                                                                    |
+-----------------------------------------------------------------------+

  ------ ----------------------------------------------------------------
  10.9   Has the system manager documented the location of the C-LAN
         hubs? If yes, where are they?

  ------ ----------------------------------------------------------------

+---------------------+------------------------------------------------+
| Yes                 |                                                |
|                     |                                                |
| No                  |                                                |
+---------------------+------------------------------------------------+
|                     |                                                |
+---------------------+------------------------------------------------+
|                     |                                                |
+---------------------+------------------------------------------------+
|                     |                                                |
+---------------------+------------------------------------------------+

  ------- ----------------------------------------------------------------
  10.10   Are all classified TEMPEST PCs using completely removable
          magnetic media (floppy diskettes and hard disk packs)? The
          magnetic media must be stored in an appropriate security
          container when left unprotected. (12 FAM 635.1)

  ------- ----------------------------------------------------------------

+------------------------------------------+---------------------------+
| Removable Media:                         | Yes                       |
|                                          |                           |
|                                          | No                        |
+------------------------------------------+---------------------------+
| Appropriately Stored:                    | Yes                       |
|                                          |                           |
|                                          | No                        |
+------------------------------------------+---------------------------+

  ------- ----------------------------------------------------------------
  10.11   Have you verified with the data center manager and system
          manager that classified AIS equipment is maintained only by
          TS-cleared personnel who are authorized to perform system
          maintenance? (12 FAM 632.1-10)

  ------- ----------------------------------------------------------------

+-----------------------------------------------------------------------+
| Yes                                                                   |
|                                                                       |
| No                                                                    |
+-----------------------------------------------------------------------+

# 11. System Access and Employee Check-Out

  ------ ----------------------------------------------------------------
  11.1   Do user's access rights reflect their assigned duties (i.e.,
         employees with Personnel only have access to Personnel folders:
         those outside of the Personnel do not have access)? (12 FAM
         621.3-2, 631.2-2)

  ------ ----------------------------------------------------------------

+---------------------------------------+------------------------------+
| SBU/Unclassified:                     | Classified Systems:          |
+---------------------------------------+------------------------------+
| Yes                                   | Yes                          |
|                                       |                              |
| No                                    | No                           |
+---------------------------------------+------------------------------+

  ----------- -----------------------------------------------------------
  Comments:   

              

              
  ----------- -----------------------------------------------------------

  ------ ----------------------------------------------------------------
  11.2   How often are user accounts reviewed to ensure old accounts are
         not left on the system? (12 FAM 622.1-8, 631-2-2)

  ------ ----------------------------------------------------------------

  ----------------------- -----------------------------------------------
  SBU/Unclassified:       

  Internet Systems:       

  Classified Systems:     
  ----------------------- -----------------------------------------------

  ----------- -----------------------------------------------------------
  Comments:   

              

              
  ----------- -----------------------------------------------------------

  ------ ----------------------------------------------------------------
  11.3   User IDs and passwords are assigned to a specific individual;
         there are no group, or shared, user accounts. If there are group
         or shared accounts, note what they are in the comment field. (12
         FAM 622.1-3, 623.3-1, 632.1-4)

  ------ ----------------------------------------------------------------

+--------------------------+---------------------+--------------------+
| SBU/Unclassified:        | Internet Systems:   | Classified         |
|                          |                     | Systems:           |
+--------------------------+---------------------+--------------------+
| Yes                      | Yes                 | Yes                |
|                          |                     |                    |
| No                       | No                  | No                 |
+--------------------------+---------------------+--------------------+

  ----------- -----------------------------------------------------------
  Comments:   

              

              
  ----------- -----------------------------------------------------------

  -------- ----------------------------------------------------------------
  11.3.1   Are passwords distributed in a manner that prevents their
           unauthorized disclosure? (12 FAM 622.1-3, 629.2-2, 632.1-4,
           642.4-2)

  -------- ----------------------------------------------------------------

+--------------------------+---------------------+--------------------+
| SBU/Unclassified:        | Internet Systems:   | Classified         |
|                          |                     | Systems:           |
+--------------------------+---------------------+--------------------+
| Yes                      | Yes                 | Yes                |
|                          |                     |                    |
| No                       | No                  | No                 |
+--------------------------+---------------------+--------------------+

  ----------- -----------------------------------------------------------
  Comments:   

              

              
  ----------- -----------------------------------------------------------

  -------- ----------------------------------------------------------------
  11.3.2   Has the system manager installed and properly configured the
           PASSFILT.DLL file? (12 FAM 623.3-1, 632.1-4, Windows NT Security
           Configuration Document dated March 2001)

  -------- ----------------------------------------------------------------

+----------------------------+------------------+----------------------+
| SBU/Unclassified Systems:  | Internet System: | Classified Systems:  |
+----------------------------+------------------+----------------------+
| Yes                        | Yes              | Yes                  |
|                            |                  |                      |
| No                         | No               | No                   |
+----------------------------+------------------+----------------------+

  ----------- -----------------------------------------------------------
  Comments:   

              

              
  ----------- -----------------------------------------------------------

  -------- ----------------------------------------------------------------
  11.3.3   Are general user passwords changed, at a minimum, once every six
           months? (12 FAM 623.3-1, 632.1-4)

  -------- ----------------------------------------------------------------

+----------------------------+------------------+----------------------+
| SBU/Unclassified Systems:  | Internet System: | Classified Systems:  |
+----------------------------+------------------+----------------------+
| Yes                        | Yes              | Yes                  |
|                            |                  |                      |
| No                         | No               | No                   |
+----------------------------+------------------+----------------------+

  ----------- -----------------------------------------------------------
  Comments:   

              

              
  ----------- -----------------------------------------------------------

  -------- ----------------------------------------------------------------
  11.3.4   Do users sign a password receipt form? (12 FAM 622.5, 629.2-2,
           632.1-4, 642.4-2)

  -------- ----------------------------------------------------------------

+----------------------------+------------------+----------------------+
| SBU/Unclassified Systems:  | Internet System: | Classified Systems:  |
+----------------------------+------------------+----------------------+
| Yes                        | Yes              | Yes                  |
|                            |                  |                      |
| No                         | No               | No                   |
+----------------------------+------------------+----------------------+

  ----------- -----------------------------------------------------------
  Comments:   

              

              
  ----------- -----------------------------------------------------------

  -------- ----------------------------------------------------------------
  11.3.5   Is the password receipt form is kept for at least the six months
           minimum requirement? (629.2-2, 638.1-2)

  -------- ----------------------------------------------------------------

+----------------------------+------------------+----------------------+
| SBU/Unclassified Systems:  | Internet System: | Classified Systems:  |
+----------------------------+------------------+----------------------+
| Yes                        | Yes              | Yes                  |
|                            |                  |                      |
| No                         | No               | No                   |
+----------------------------+------------------+----------------------+

  ----------- -----------------------------------------------------------
  Comments:   

              

              
  ----------- -----------------------------------------------------------

  -------- ----------------------------------------------------------------
  11.3.6   Does the Post store administrator emergency (firecall) passwords
           in sealed envelope, in a secure location? (12 FAM 622.3-1,
           632.3-1)

  -------- ----------------------------------------------------------------

+----------------------------+------------------+----------------------+
| SBU/Unclassified Systems:  | Internet System: | Classified Systems:  |
+----------------------------+------------------+----------------------+
| Yes                        | Yes              | Yes                  |
|                            |                  |                      |
| No                         | No               | No                   |
+----------------------------+------------------+----------------------+

  ----------- -----------------------------------------------------------
  Comments:   

              

              
  ----------- -----------------------------------------------------------

  ------ ----------------------------------------------------------------
  11.4   Do supervisors submit signed requests for new user accounts? (12
         FAM 622.1-2, 629, 632.1-3)

  ------ ----------------------------------------------------------------

+----------------------------+------------------+----------------------+
| SBU/Unclassified Systems:  | Internet         | Classified Systems:  |
|                            | Systems:         |                      |
+----------------------------+------------------+----------------------+
| Yes                        | Yes              | Yes                  |
|                            |                  |                      |
| No                         | No               | No                   |
+----------------------------+------------------+----------------------+

  ----------- -------------- ---------------------------------------------------------- --
  Comments:                                                                             

                                                                                        

                                                                                        

  11.5        Does the post                                                             
              check-out list                                                            
              includes the                                                              
              data center                                                               
              manager and                                                               
              the system                                                                
              manager to                                                                
              ensure                                                                    
              notification                                                              
              of all                                                                    
              employees and                                                             
              contractors                                                               
              who are                                                                   
              transferred or                                                            
              terminated?                                                               
              (12 FAM                                                                   
              621.3-3,                                                                  
              632.1-3)                                                                  
  ----------- -------------- ---------------------------------------------------------- --

+----------------------------+------------------+----------------------+
| SBU/Unclassified Systems:  | Internet System: | Classified Systems:  |
+----------------------------+------------------+----------------------+
| Yes                        | Yes              | Yes                  |
|                            |                  |                      |
| No                         | No               | No                   |
+----------------------------+------------------+----------------------+

  ----------- -----------------------------------------------------------
  Comments:   

              

              
  ----------- -----------------------------------------------------------

  ------ ----------------------------------------------------------------
  11.6   Describe how post handles dismissed or reassigned personnel in
         relation to having their account deactivated/removed. (12 FAM
         622.1-3, 632.1-4)

  ------ ----------------------------------------------------------------

  ------------------- ----------------------------------------------------
  Unclassified/SBU:   

                      

                      

  Classified:         

                      

                      
  ------------------- ----------------------------------------------------

  ------ ----------------------------------------------------------------
  11.7   Do system administrators have two separate accounts -- one for
         system administrator tasks and one for regular user duties?

  ------ ----------------------------------------------------------------

+----------------------------+------------------+----------------------+
| SBU/Unclassified Systems:  | Internet System: | Classified Systems:  |
+----------------------------+------------------+----------------------+
| Yes                        | Yes              | Yes                  |
|                            |                  |                      |
| No                         | No               | No                   |
+----------------------------+------------------+----------------------+

  ----------- -----------------------------------------------------------
  Comments:   

              

              
  ----------- -----------------------------------------------------------

  ------ ----------------------------------------------------------------
  11.8   Does the data center manager and the system manager delete all
         user IDs and passwords supplied by the vendor for use during
         software installations? (12 FAM 629.2-2, 638.1-2)

  ------ ----------------------------------------------------------------

+----------+----------+--------------+-----------------+--------------+
| SBU/Uncl |          | Internet     | Classified      |              |
| assified |          | System:      | Systems:        |              |
| Systems: |          |              |                 |              |
+----------+----------+--------------+-----------------+--------------+
| Yes      |          | Yes          | Yes             |              |
|          |          |              |                 |              |
| No       |          | No           | No              |              |
+----------+----------+--------------+-----------------+--------------+
| C        |          |              |                 |              |
| omments: |          |              |                 |              |
+----------+----------+--------------+-----------------+--------------+
|          |          |              |                 |              |
+----------+----------+--------------+-----------------+--------------+
|          |          |              |                 |              |
+----------+----------+--------------+-----------------+--------------+

  ------ ----------------------------------------------------------------
  11.9   Along with the system manager, does the ISSO review annually all
         AIS users with exceptional access privileges, to ensure that
         their privileges are still needed? (12 FAM 622.1-2)

  ------ ----------------------------------------------------------------

+-----------------------------------------------------------------------+
| Yes                                                                   |
|                                                                       |
| No                                                                    |
+-----------------------------------------------------------------------+

  ----------- -----------------------------------------------------------
  Comments:   

              

              
  ----------- -----------------------------------------------------------

# 12. Transfer of Files or Equipment 

  ------ ----------------------------------------------------------------
  12.1   Describe Posts' procedures for transporting and controlling
         media, to include the transferring of files by diskette or other
         media to other USG agencies. (12 FAM 622.1-7. 632.1-6)

  ------ ----------------------------------------------------------------

  -----------------------------------------------------------------------

  -----------------------------------------------------------------------

  -------- ----------------------------------------------------------------
  12.1.1   State any suggestions or problems with the process:

  -------- ----------------------------------------------------------------

  -----------------------------------------------------------------------

  -----------------------------------------------------------------------

# 13. Backups, Recovery Plans, and Security Plans

  ------ ----------------------------------------------------------------
  13.1   All servers are backed up: (12 FAM 622.3-1, 632.3-1)

  ------ ----------------------------------------------------------------

+----------------------------+-----------------+----------------------+
| SBU/Unclassified/Systems:  | Internet        | Classified Systems:  |
|                            | System:         |                      |
+----------------------------+-----------------+----------------------+
| Daily                      | Daily           | Daily                |
|                            |                 |                      |
| Weekly                     | Weekly          | Weekly               |
|                            |                 |                      |
| Monthly                    | Monthly         | Monthly              |
|                            |                 |                      |
| Never                      | Never           | Never                |
+----------------------------+-----------------+----------------------+

  ------ ----------------------------------------------------------------
  13.2   Does Post uses three or more backup tapes (any less can cause
         tapes to fail prematurely)? Indicate how often backups are
         performed.

  ------ ----------------------------------------------------------------

+-----------------------------------------------------------------------+
| Yes                                                                   |
|                                                                       |
| No                                                                    |
+-----------------------------------------------------------------------+

+------------------------------+------------------+--------------------+
| SBU/Unclassified/Systems:    | Internet System: | Classified         |
|                              |                  | Systems:           |
+------------------------------+------------------+--------------------+
| Daily                        | Daily            | Daily              |
|                              |                  |                    |
| Weekly                       | Weekly           | Weekly             |
|                              |                  |                    |
| Monthly                      | Monthly          | Monthly            |
|                              |                  |                    |
| Never                        | Never            | Never              |
+------------------------------+------------------+--------------------+

  ----------- -----------------------------------------------------------
  Comments:   

              

              
  ----------- -----------------------------------------------------------

  ------ ----------------------------------------------------------------
  13.3   Are tapes properly labeled? (12 FAM 622.1-7, 632.3-1)

  ------ ----------------------------------------------------------------

+-------------------------+-------------------+-----------------------+
| S                       | Internet Systems: | Classified Systems:   |
| BU/Unclassified/System: |                   |                       |
+-------------------------+-------------------+-----------------------+
| Yes                     | Yes               | Yes                   |
|                         |                   |                       |
| No                      | No                | No                    |
+-------------------------+-------------------+-----------------------+

  ------ ----------------------------------------------------------------
  13.4   Where does post store its backup tapes? (12 FAM 622.3-1,
         629.2-9, 632.3-1)

  ------ ----------------------------------------------------------------

+----------------------------+--------------------+-------------------+
| SBU/Unclassified Systems:  | Internet Systems:  | Classified        |
|                            |                    | Systems:          |
+----------------------------+--------------------+-------------------+
| Class 5 container          | Class 5 container  | Class 5 container |
|                            |                    |                   |
| File cabinet               | File cabinet       | File cabinet      |
|                            |                    |                   |
| In the open                | In the open        | In the open       |
|                            |                    |                   |
| By the server              | By the server      | By the server     |
|                            |                    |                   |
| Other:                     | Other:             | Other:            |
+----------------------------+--------------------+-------------------+

  ------ ----------------------------------------------------------------
  13.5   Identify the location if post stores backup tapes off-site. (12
         FAM622.3-1, 632.3-1)

  ------ ----------------------------------------------------------------

  -------------------- --------------------------------------------------
  SBU/Unclassified     
  tapes:               

  Internet tapes:      

  Classified tapes:    
  -------------------- --------------------------------------------------

  ------ ----------------------------------------------------------------
  13.6   Abroad, the administrative officer ensures that contingency
         plans, which involve other posts (such as the use of their AISs
         to provide backup processing capability), are fully coordinated
         with their administrative officer, RSO or PSO, ISSO, data center
         manager, and system manager. (12 FAM 622.3-2, 629.2-10)

  ------ ----------------------------------------------------------------

+-----------------------------------------------------------------------+
| Yes                                                                   |
|                                                                       |
| No                                                                    |
+-----------------------------------------------------------------------+

  ----------- -----------------------------------------------------------
  Comments:   

              

              
  ----------- -----------------------------------------------------------

  ------ ----------------------------------------------------------------
  13.7   Has Post tested its recovery plan (backup and contingency plan)
         by installing from a backup tape to spare system? If so, supply
         the date of the last test. (12 FAM 622.3, 632.3)

  ------ ----------------------------------------------------------------

+----------------------+---------------------+-------------------------+
|                      |                     | **Date**:               |
+----------------------+---------------------+-------------------------+
| SBU/Unclassified:    | Yes                 |                         |
|                      |                     |                         |
|                      | No                  |                         |
+----------------------+---------------------+-------------------------+
| Internet:            | Yes                 |                         |
|                      |                     |                         |
|                      | No                  |                         |
+----------------------+---------------------+-------------------------+
| Classified:          | Yes                 |                         |
|                      |                     |                         |
|                      | No                  |                         |
+----------------------+---------------------+-------------------------+

  ----------- -----------------------------------------------------------
  Comments:   

              

              
  ----------- -----------------------------------------------------------

  ------ ----------------------------------------------------------------
  13.8   How does post handle backing up NT workstation hard drives? (12
         FAM 622.3-1, 632.3-1, Windows NT Security Configuration
         Document, March 2001)

  ------ ----------------------------------------------------------------

+-----------------------------------+-----------------------------------+
| SBU/Unclassified/Internet         | Classified Systems:               |
| Systems:                          |                                   |
+-----------------------------------+-----------------------------------+
| -   Locally (tape, floppy, other) | -   Locally (tape, floppy, other) |
|                                   |                                   |
| ```{=html}                        | ```{=html}                        |
| <!-- -->                          | <!-- -->                          |
| ```                               | ```                               |
| -   Remote backup system          | -   Remote backup system          |
|                                   |                                   |
| ```{=html}                        | ```{=html}                        |
| <!-- -->                          | <!-- -->                          |
| ```                               | ```                               |
| -   All users are forced to save  | -   All users forced to save data |
|     data to network drives, NO    |     to network drive, NO C:\\     |
|     C:\\ drive available          |     drive available               |
|                                   |                                   |
| ```{=html}                        | ```{=html}                        |
| <!-- -->                          | <!-- -->                          |
| ```                               | ```                               |
| -   NO NT workstation backup      | -   NO NT workstation backup      |
|     performed: if drive fails all |     performed: if drive fails all |
|     data lost                     |     data lost                     |
+-----------------------------------+-----------------------------------+
| Other:                            | Other:                            |
+-----------------------------------+-----------------------------------+
| Comments:                         | Comments:                         |
+-----------------------------------+-----------------------------------+

  ------ ----------------------------------------------------------------
  13.9   Are users informed that all data on local drive can be lost if
         not backed up by user? (12 FAM 622.3, 632.3-1)

  ------ ----------------------------------------------------------------

+------------------------------------------+---------------------------+
| SBU/Unclassified/Internet Systems:       | Classified Systems:       |
+------------------------------------------+---------------------------+
| Yes                                      | Yes                       |
|                                          |                           |
| No                                       | No                        |
+------------------------------------------+---------------------------+

  ----------- -----------------------------------------------------------
  Comments:   

              

              
  ----------- -----------------------------------------------------------

  ------- ----------------------------------------------------------------
  13.10   If any server were to suffer a catastrophic failure, does post
          have the necessary backup material to completely restore the
          system to the functional state it was at before the failure? (12
          FAM 622.3, 632.3-1, Windows NT Security Configuration Document,
          March 2001)

  ------- ----------------------------------------------------------------

+-----------------------+--------------+---------------+--------------+
|                       | SBU System:  | Internet      | Classified   |
|                       |              | System:       | System:      |
+-----------------------+--------------+---------------+--------------+
| Hardware backups (are | Yes          | Yes           | Yes          |
| they pre-configured?) |              |               |              |
|                       | No           | No            | No           |
+-----------------------+--------------+---------------+--------------+
| Is all the restore    | Yes          | Yes           | Yes          |
| software in one       |              |               |              |
| package or location?  | No           | No            | No           |
+-----------------------+--------------+---------------+--------------+
| Is there a written    | Yes          | Yes           | Yes          |
| restoration plan      |              |               |              |
| (should have step by  | No           | No            | No           |
| step restore          |              |               |              |
| procedures            |              |               |              |
| available)?           |              |               |              |
+-----------------------+--------------+---------------+--------------+
| Is the systems        | Yes          | Yes           | Yes          |
| recovery plan         |              |               |              |
| included in Post ERP? | No           | No            | No           |
+-----------------------+--------------+---------------+--------------+
| If using disk         | Yes          | Yes           | Yes          |
| ghosting to do        |              |               |              |
| recoveries, are the   | No           | No            | No           |
| ghost files kept off  |              |               |              |
| site?                 |              |               |              |
+-----------------------+--------------+---------------+--------------+

  ----------- -----------------------------------------------------------
  Comments:   

              

              
  ----------- -----------------------------------------------------------

  ------- ----------------------------------------------------------------
  13.11   For PCs, what is the planned recovery routine? (12 FAM 622.3,
          632.3, Windows NT Security Configuration Document, March 2001)

  ------- ----------------------------------------------------------------

  ------------------------ ----------------------------------------------
  SBU/Unclassified         
  Systems:                 

                           

                           

  Internet Systems:        

                           

                           

  Classified Systems:      

                           

                           
  ------------------------ ----------------------------------------------

# 14. Laptop Policy

  ------ ----------------------------------------------------------------
  14.1   Does Post have a Laptop Policy? (12 FAM 625.1, ALDACs 95 State
         243815, 99 State 143237, 95 State 244394)

  ------ ----------------------------------------------------------------

+-----------------------------------------------------------------------+
| Yes                                                                   |
|                                                                       |
| No                                                                    |
+-----------------------------------------------------------------------+

  ----------- -----------------------------------------------------------
  Comments:   

              

              
  ----------- -----------------------------------------------------------

  ------ ----------------------------------------------------------------
  14.2   Does post have laptops?

  ------ ----------------------------------------------------------------

+------------------------------------+---------------------------------+
| Unclassified Laptops:              | Classified Laptops:             |
+------------------------------------+---------------------------------+
| Yes                                | Yes                             |
|                                    |                                 |
| No                                 | No                              |
+------------------------------------+---------------------------------+

  -------- ----------------------------------------------------------------
  14.2.1   If post has laptops, list the type and serial numbers.

  -------- ----------------------------------------------------------------

  ----------------------------------------- -----------------------------
  Type:                                     Serial Number:

                                            

                                            

                                            

                                            
  ----------------------------------------- -----------------------------

  ------ ----------------------------------------------------------------
  14.3   Does the RSO and ISSO approve any equipment shipped and/or
         pouched to post before the traveler may begin processing
         classified information? (95 State 24381)

  ------ ----------------------------------------------------------------

+-----------------------------------------------------------------------+
| Yes                                                                   |
|                                                                       |
| No                                                                    |
+-----------------------------------------------------------------------+

  ----------- -----------------------------------------------------------
  Comments:   

              

              
  ----------- -----------------------------------------------------------

  ------ ----------------------------------------------------------------
  14.4   Are users briefed on the importance of protecting the equipment
         and information, as well as where they can and cannot process
         information? (625.1, 95 State 244394)

  ------ ----------------------------------------------------------------

+-----------------------------------------------------------------------+
| Yes                                                                   |
|                                                                       |
| No                                                                    |
+-----------------------------------------------------------------------+

  ----------- -----------------------------------------------------------
  Comments:   

              

              
  ----------- -----------------------------------------------------------

  ------ ----------------------------------------------------------------
  14.5   Are systems equipped with approved virus detection software? (95
         State 244394)

  ------ ----------------------------------------------------------------

+-----------------------------------------------------------------------+
| Yes                                                                   |
|                                                                       |
| No                                                                    |
+-----------------------------------------------------------------------+

  ----------- -----------------------------------------------------------
  Comments:   

              

              
  ----------- -----------------------------------------------------------

# 15. Expansion Plan

  ------ ----------------------------------------------------------------
  15.1   If post has any plans to add systems, enhance connectivity, or
         make other network changes in the next 12 months, please
         describe those plans below.

  ------ ----------------------------------------------------------------

  ---------------------- ------------------------------------------------
  SBU/Unclassified       
  Systems:               

                         

                         

  Internet Systems:      

                         

                         

  Classified Systems:    

                         

                         
  ---------------------- ------------------------------------------------

# 16. Procurement

  ------ ----------------------------------------------------------------
  16.1   Describe how your software procurement is handled: (12 FAM
         625.2-1, 633.1-2)

  ------ ----------------------------------------------------------------

  --------------------------- -------------------------------------------
  SBU/Unclassified System     

  Local random procurement:   

                              

                              

  Department blind            
  procurement:                

                              

                              

  Other:                      

                              

                              

  Internet Systems            

  Local random procurement:   

                              

                              

  Department blind            
  procurement:                

                              

                              

  Other:                      

                              

                              

  Describe Post's Procedure   
  for their Classified        
  Systems:                    

                              

                              

                              
  --------------------------- -------------------------------------------

# 17. C2 Functionality

The following link outlines the latest software versions and can be used
when completing this section. Once at this page, go to the CCB link,
click on Configuration Control Board, and then select the Board Action
Requests (SBU, Overseas, or Classified) for approved software and
versions. [http://enm.irm.state.gov/]{.underline}

  ------ ----------------------------------------------------------------
  17.1   Indicate if Post is using Department approved C-2 functional (NT
         4.0) OS software for servers. If post has any systems that use
         operating systems other than Windows NT, please list those
         systems in the comment area below, and provide a short
         description of their purpose. (12 FAM 623, 633, 635, 641.3-1,
         646.4, Windows NT Security Configuration Document, March 2001)

  ------ ----------------------------------------------------------------

+-----------------------+--------------+---------------+--------------+
|                       | SBU System:  | Internet      | Classified   |
|                       |              | System:       | System:      |
+-----------------------+--------------+---------------+--------------+
| NT 4.0 (C-2           | Yes          | Yes           | Yes          |
| functional OS)        |              |               |              |
|                       | No           | No            | No           |
+-----------------------+--------------+---------------+--------------+
| Banyan Version:       |              |               |              |
+-----------------------+--------------+---------------+--------------+

  ----------- -----------------------------------------------------------
  Comments:   

              

              
  ----------- -----------------------------------------------------------

  ------ ----------------------------------------------------------------
  17.2   Post is using Department approved C-2 functional (NT 4.0) OS
         software for workstations. (12 FAM 623, 633, 635, Windows NT
         Security Configuration Document, March 2001)

  ------ ----------------------------------------------------------------

+-----------------------+--------------+---------------+--------------+
|                       | SBU System:  | Internet      | Classified   |
|                       |              | System:       | System:      |
+-----------------------+--------------+---------------+--------------+
| NT 4.0 (C-2           | Yes          | Yes           | Yes          |
| functional OS)        |              |               |              |
|                       | No           | No            | No           |
+-----------------------+--------------+---------------+--------------+
| Novell Version:       |              |               |              |
+-----------------------+--------------+---------------+--------------+
| Banyan Version:       |              |               |              |
+-----------------------+--------------+---------------+--------------+
| Other:                |              |               |              |
+-----------------------+--------------+---------------+--------------+

  ----------- -----------------------------------------------------------
  Comments:   

              

              
  ----------- -----------------------------------------------------------

# 18. Software

The following link outlines the latest software versions and can be used
when completing this section. Once at this page, go to the CCB link,
click on Configuration Control Board, and then select the Board Action
Requests (SBU, Overseas, or Classified) for approved software and
versions. [http://enm.irm.state.gov/]{.underline}

  ------ ----------------------------------------------------------------
  18.1   Indicate when Norton Anti-Virus and ScanMail was last updated:

  ------ ----------------------------------------------------------------

  -------------------- ------------------------- -------------------------
                       Norton Anti-Virus:        ScanMail:

  SBU/Unclassified                               

  Internet Systems                               

  Classified Systems                             
  -------------------- ------------------------- -------------------------

  ------ ----------------------------------------------------------------
  18.2   Is SMS installed?

  ------ ----------------------------------------------------------------

+-----------------------------------------------------------------------+
| Yes                                                                   |
|                                                                       |
| No                                                                    |
+-----------------------------------------------------------------------+

  ----------- -----------------------------------------------------------
  Comments:   

              

              
  ----------- -----------------------------------------------------------

  -------- ----------------------------------------------------------------
  18.2.1   If so, what access functions are given to the local staff?

  -------- ----------------------------------------------------------------

  -----------------------------------------------------------------------

  -----------------------------------------------------------------------

  ------ ----------------------------------------------------------------
  18.3   Is Service Pack 6a installed? (Configuration Control Board,
         November 7, 2000)

  ------ ----------------------------------------------------------------

+-----------------------------------------------------------------------+
| Yes                                                                   |
|                                                                       |
| No                                                                    |
+-----------------------------------------------------------------------+

  ------ ----------------------------------------------------------------
  18.4   List any non-DoS approved software running on the systems. (12
         FAM 623, 633)

  ------ ----------------------------------------------------------------

  -------------------- --------------------------------------------------
  SBU/Unclassified     

  Internet Systems     

  Classified Systems   
  -------------------- --------------------------------------------------

  ------ ----------------------------------------------------------------
  18.5   If Post requested permission from DS/IST and IRM to run
         non-standard software, list the telegram numbers and titles. (12
         FAM 623, 633)

  ------ ----------------------------------------------------------------

  -------------------- --------------------------------------------------
  SBU/Unclassified     

  Internet Systems     

  Classified Systems   
  -------------------- --------------------------------------------------

# 19. Security Configuration Documents

The following refer to systems running Windows NT 4.0.

  ------ ----------------------------------------------------------------
  19.1   The system administrator has configured systems to meet the
         following configuration document standards:

  ------ ----------------------------------------------------------------

+---------------+---------------+---------------+--------------------+
|               | Windows NT    | MS Exchange   | MS Internet        |
|               | 4.0           | 5.5           | Information Server |
|               |               |               | 4.0                |
|               | (March 2001): | (March 1999): |                    |
|               |               |               | (November 2000):   |
+---------------+---------------+---------------+--------------------+
| SBU System    | Yes           | Yes           |                    |
|               |               |               |                    |
|               | No            | No            |                    |
+---------------+---------------+---------------+--------------------+
| Internet      | Yes           |               | Yes                |
| System        |               |               |                    |
|               | No            |               | No                 |
+---------------+---------------+---------------+--------------------+
| Classified    | Yes           | (If           |                    |
| System        |               | applicable)   |                    |
|               | No            |               |                    |
|               |               | Yes           |                    |
|               |               |               |                    |
|               |               | No            |                    |
+---------------+---------------+---------------+--------------------+

  ------ ----------------------------------------------------------------
  19.2   Run KSA on Internet and OpenNet systems. Document any
         abnormalities.

  ------ ----------------------------------------------------------------

  -----------------------------------------------------------------------

  -----------------------------------------------------------------------

  ------ ----------------------------------------------------------------
  19.3   Check the configuration settings of servers and workstations
         against the Windows NT Security Configuration Document, March
         2001.

  ------ ----------------------------------------------------------------

+-----------------------+--------------+---------------+--------------+
|                       | SBU System:  | Internet      | Classified   |
|                       |              | System:       | System:      |
+-----------------------+--------------+---------------+--------------+
| PDC                   | Yes          | Yes           | Yes          |
|                       |              |               |              |
|                       | No           | No            | No           |
+-----------------------+--------------+---------------+--------------+
| BDC                   | Yes          | Yes           | Yes          |
|                       |              |               |              |
|                       | No           | No            | No           |
+-----------------------+--------------+---------------+--------------+
| Exchange server       | Yes          | Yes           | Yes          |
|                       |              |               |              |
|                       | No           | No            | No           |
+-----------------------+--------------+---------------+--------------+
| At least two NT       | Yes          | Yes           | Yes          |
| workstations          |              |               |              |
|                       | No           | No            | No           |
+-----------------------+--------------+---------------+--------------+

  ----------- -----------------------------------------------------------
  Comments:   

              

              
  ----------- -----------------------------------------------------------

  ------ ----------------------------------------------------------------
  19.4   Has the DSPERMS.BAT batch file been installed on all servers and
         workstations running Windows NT 4.0? If not, list specific
         servers and workstations and state why.

  ------ ----------------------------------------------------------------

+-----------------------------------------------------------------------+
| Yes                                                                   |
|                                                                       |
| No                                                                    |
+-----------------------------------------------------------------------+

  ----------- -----------------------------------------------------------
  Comments:   

              

              
  ----------- -----------------------------------------------------------

# 20. Built-In Local Groups

  ------ ----------------------------------------------------------------
  20.1   Regarding backup operators, users, etc., are configurations
         followed with respect to built-in local groups? (Windows NT
         Security Configuration Document, March 2001)

  ------ ----------------------------------------------------------------

+-----------------------+----------------------+----------------------+
| SBU/Unclassified:     | Internet Systems:    | Classified Systems:  |
+-----------------------+----------------------+----------------------+
| Yes                   | Yes                  | Yes                  |
|                       |                      |                      |
| No                    | No                   | No                   |
+-----------------------+----------------------+----------------------+

  ----------- -----------------------------------------------------------
  Comments:   

              

              
  ----------- -----------------------------------------------------------

# 21. After-Hours Use

  ------ ----------------------------------------------------------------
  21.1   Are appropriate after-hours restrictions developed and
         implemented for all systems, which identifies the specific
         operational needs? (12 FAM 622.1-6)

  ------ ----------------------------------------------------------------

+-----------------------+----------------------+----------------------+
| SBU/Unclassified:     | Internet Systems:    | Classified Systems:  |
+-----------------------+----------------------+----------------------+
| Yes                   | Yes                  | Yes                  |
|                       |                      |                      |
| No                    | No                   | No                   |
+-----------------------+----------------------+----------------------+

  ----------- -----------------------------------------------------------
  Comments:   

              

              
  ----------- -----------------------------------------------------------

# 22. Visual Checks

  ------ ----------------------------------------------------------------
  22.1   Check for software licenses to ensure that installed software
         has been approved. (12 FAM 625.2-1, 633.1)

  ------ ----------------------------------------------------------------

+-----------------------+----------------------+----------------------+
| SBU/Unclassified:     | Internet Systems:    | Classified Systems:  |
+-----------------------+----------------------+----------------------+
| Yes                   | Yes                  | Yes                  |
|                       |                      |                      |
| No                    | No                   | No                   |
+-----------------------+----------------------+----------------------+

  ----------- -----------------------------------------------------------
  Comments:   

              

              
  ----------- -----------------------------------------------------------

  ------ ----------------------------------------------------------------
  22.2   Is the operating system CDs/software stored so that only systems
         staff may have access to it? (12 FAM 622.1-7, 632.1-6)

  ------ ----------------------------------------------------------------

+-----------------------+----------------------+----------------------+
| SBU/Unclassified:     | Internet Systems:    | Classified Systems:  |
+-----------------------+----------------------+----------------------+
| Yes                   | Yes                  | Yes                  |
|                       |                      |                      |
| No                    | No                   | No                   |
+-----------------------+----------------------+----------------------+

  ----------- -----------------------------------------------------------
  Comments:   

              

              
  ----------- -----------------------------------------------------------

  ------ ----------------------------------------------------------------
  22.3   All equipment is correctly labeled. (12 FAM 622.1-4, 628.2-1,
         632.1-5)

  ------ ----------------------------------------------------------------

+-----------------------+----------------------+----------------------+
| SBU/Unclassified:     | Internet Systems:    | Classified Systems:  |
+-----------------------+----------------------+----------------------+
| Yes                   | Yes                  | Yes                  |
|                       |                      |                      |
| No                    | No                   | No                   |
+-----------------------+----------------------+----------------------+

  ----------- -----------------------------------------------------------
  Comments:   

              

              
  ----------- -----------------------------------------------------------

  ------ ----------------------------------------------------------------
  22.4   Is all removable media correctly labeled? (12 FAM 622.1-7,
         632.1-6, 632.3-1, 643.2-1)

  ------ ----------------------------------------------------------------

+-----------------------+--------------+---------------+--------------+
|                       | SBU System   | Internet      | Classified   |
|                       |              | System        | System       |
+-----------------------+--------------+---------------+--------------+
| Floppies              | Yes          | Yes           | Yes          |
|                       |              |               |              |
|                       | No           | No            | No           |
+-----------------------+--------------+---------------+--------------+
| Hard drives           | Yes          | Yes           | Yes          |
|                       |              |               |              |
|                       | No           | No            | No           |
+-----------------------+--------------+---------------+--------------+
| Backup tapes          | Yes          | Yes           | Yes          |
|                       |              |               |              |
|                       | No           | No            | No           |
+-----------------------+--------------+---------------+--------------+
| CD ROMs               | Yes          | Yes           | Yes          |
|                       |              |               |              |
|                       | No           | No            | No           |
+-----------------------+--------------+---------------+--------------+
| Other:                |              |               |              |
+-----------------------+--------------+---------------+--------------+

  ----------- -----------------------------------------------------------
  Comments:   

              

              
  ----------- -----------------------------------------------------------

  ------ ----------------------------------------------------------------
  22.5   Do servers have UPS systems? (12 FAM 629.4-3)

  ------ ----------------------------------------------------------------

+-----------------------+----------------------+----------------------+
| SBU/Unclassified:     | Internet Systems:    | Classified Systems:  |
+-----------------------+----------------------+----------------------+
| Yes                   | Yes                  | Yes                  |
|                       |                      |                      |
| No                    | No                   | No                   |
+-----------------------+----------------------+----------------------+

  ----------- -----------------------------------------------------------
  Comments:   

              

              
  ----------- -----------------------------------------------------------

  ------ ----------------------------------------------------------------
  22.6   Do workstations have UPS systems or surge protectors?

  ------ ----------------------------------------------------------------

+-----------------------+----------------------+----------------------+
| SBU/Unclassified:     | Internet Systems:    | Classified Systems:  |
+-----------------------+----------------------+----------------------+
| Yes                   | Yes                  | Yes                  |
|                       |                      |                      |
| No                    | No                   | No                   |
+-----------------------+----------------------+----------------------+

  ----------- -----------------------------------------------------------
  Comments:   

              

              
  ----------- -----------------------------------------------------------

  ------ ----------------------------------------------------------------
  22.7   Do system administrators lock server workstation screens when
         they walk away? (Windows NT Security Configuration Document,
         March 2001)

  ------ ----------------------------------------------------------------

+-----------------------+----------------------+----------------------+
| SBU/Unclassified:     | Internet Systems:    | Classified Systems:  |
+-----------------------+----------------------+----------------------+
| Yes                   | Yes                  | Yes                  |
|                       |                      |                      |
| No                    | No                   | No                   |
+-----------------------+----------------------+----------------------+

  ------ ----------------------------------------------------------------
  22.8   Are screen savers enabled and password protected after 20
         minutes of non-use? (Windows NT Security Configuration Document,
         March 2001)

  ------ ----------------------------------------------------------------

+-----------------------+----------------------+----------------------+
| SBU/Unclassified:     | Internet Systems:    | Classified Systems:  |
+-----------------------+----------------------+----------------------+
| Yes                   | Yes                  | Yes                  |
|                       |                      |                      |
| No                    | No                   | No                   |
+-----------------------+----------------------+----------------------+

  ----------- -----------------------------------------------------------
  Comments:   

              

              
  ----------- -----------------------------------------------------------

  ------ ----------------------------------------------------------------
  22.9   Indicate which system availability issues exist for the server
         rooms (12 FAM 622.1-4, 629.4-4, 632.1-5, 638.4-2):

  ------ ----------------------------------------------------------------

+-----------------------------------+-----------------------------------+
| SBU/Unclassified/Internet         | Classified Systems:               |
| Systems:                          |                                   |
+-----------------------------------+-----------------------------------+
| Heat (over heating conditions)    | Heat (over heating conditions)    |
|                                   |                                   |
| Water pipes (overhead)            | Water pipes (overhead)            |
|                                   |                                   |
| Flooding                          | Flooding                          |
|                                   |                                   |
| Fire suppression in server room   | Fire suppression in server room   |
|                                   |                                   |
| Smoke detectors in server room    | Smoke detectors in server room    |
|                                   |                                   |
| Wiring in path of personnel       | Wiring in path of personnel       |
| (kicking hazard)                  | (kicking hazard)                  |
|                                   |                                   |
| Labeling of hub/router category 5 | Labeling of hub/router category 5 |
| wires                             | wires                             |
|                                   |                                   |
| Other:                            | Other:                            |
| \_\_\_\_\_\_\_\_\                 | \_\_\_\_\_\_\_\_\                 |
| _\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ | _\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ |
+-----------------------------------+-----------------------------------+

  ----------- -----------------------------------------------------------
  Comments:   

              

              
  ----------- -----------------------------------------------------------

  ------- ----------------------------------------------------------------
  22.10   Inspect the wiring closets: (12 FAM 629.4-3)

  ------- ----------------------------------------------------------------

+-----------------------------------+-----------------------------------+
| SBU/Unclassified/Internet         | Classified Systems:               |
| Systems:                          |                                   |
+-----------------------------------+-----------------------------------+
| Wires on floors                   | Wires on floors                   |
|                                   |                                   |
| Wires hanging down                | Wires hanging down                |
|                                   |                                   |
| Wires not label for end point     | Wires not label for end point     |
|                                   |                                   |
| Patch panels not labeled          | Patch panels not labeled          |
|                                   |                                   |
| Wire/fiber pulled to tight or     | Wire/fiber pulled to tight or     |
| being pinched (shorten wire/fiber | being pinched (shorten wire/fiber |
| life span)                        | life span)                        |
|                                   |                                   |
| Share power outlets with non-LAN  | Share power outlets with non-LAN  |
| equipment                         | equipment                         |
|                                   |                                   |
| Equipment not locked in room or   | Equipment not locked in room or   |
| cabinet                           | cabinet                           |
|                                   |                                   |
| UPS/surge protection              | UPS/surge protection              |
|                                   |                                   |
| Routers or switches not logically | Routers or switches not logically |
| labeled                           | labeled                           |
|                                   |                                   |
| Router, switches, hubs not        | Router, switches, hubs not        |
| securely mounted                  | securely mounted                  |
|                                   |                                   |
| Other:                            | Other:                            |
| \_\_\_\_\_\_\_\                   | \_\_\_\_\_\_\_\                   |
| _\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ | _\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ |
|                                   |                                   |
| #######                           |                                   |
+-----------------------------------+-----------------------------------+

  ----------- -----------------------------------------------------------
  Comments:   

              

              
  ----------- -----------------------------------------------------------

  ------- ----------------------------------------------------------------
  22.11   Check unclassified LAN lines that connect the equipment: (12 FAM
          626.1-4, 627.2)

  ------- ----------------------------------------------------------------

+---------------------------------------------------+------------------+
| SBU/Unclassified/Internet Systems:                |                  |
+---------------------------------------------------+------------------+
| Do any of the LAN lines traverse areas not        | Yes              |
| controlled by USG?                                |                  |
|                                                   | No               |
+---------------------------------------------------+------------------+
| If LAN lines connect systems in other buildings,  | Yes              |
| are those signal lines under USG control?         |                  |
|                                                   | No               |
+---------------------------------------------------+------------------+
| Are they encrypted?                               | Yes              |
|                                                   |                  |
|                                                   | No               |
+---------------------------------------------------+------------------+
| If LAN lines are part of the Public Telephone     | Yes              |
| System, are the lines encrypted?                  |                  |
|                                                   | No               |
+---------------------------------------------------+------------------+
| ####### Where are modems located?                 | Yes              |
|                                                   |                  |
|                                                   | No               |
+---------------------------------------------------+------------------+

  ----------- -----------------------------------------------------------
  Comments:   

              

              
  ----------- -----------------------------------------------------------

+--------------------------------------------------+-------------------+
| Classified Systems:                              |                   |
+--------------------------------------------------+-------------------+
| Do any of the LAN lines traverse areas not       | Yes               |
| controlled by USG?                               |                   |
|                                                  | No                |
+--------------------------------------------------+-------------------+
| If LAN lines connect systems in other buildings, | Yes               |
| are those signal lines under USG control?        |                   |
|                                                  | No                |
+--------------------------------------------------+-------------------+
| Are they encrypted?                              | Yes               |
|                                                  |                   |
|                                                  | No                |
+--------------------------------------------------+-------------------+

  ----------- -----------------------------------------------------------
  Comments:   

              

              
  ----------- -----------------------------------------------------------

  ------- ----------------------------------------------------------------
  22.12   If PCs have non-removable hard drives, is the room or suite
          housing the PCs locked when not in use? (12 FAM 625.1)

  ------- ----------------------------------------------------------------

+---------------------------+-------------------+---------------------+
| SBU/Unclassified Systems: | Internet Systems: | Classified Systems: |
+---------------------------+-------------------+---------------------+
| Yes                       | Yes               | Yes                 |
|                           |                   |                     |
| No                        | No                | No                  |
+---------------------------+-------------------+---------------------+

  ----------- -----------------------------------------------------------
  Comments:   

              

              
  ----------- -----------------------------------------------------------

  --------- ---------------------------------------------------------------
  22.12.1   Does the SBU computer room meet the following requirements? (12
            FAM 629.4-5)

  --------- ---------------------------------------------------------------

+--------------------------------------+-------------------------------+
| Spin dial or dead bolt lock:         | Yes                           |
|                                      |                               |
|                                      | No                            |
+--------------------------------------+-------------------------------+
| Simplex-day access:                  | Yes                           |
|                                      |                               |
|                                      | No                            |
+--------------------------------------+-------------------------------+
| Access list for the room:            | Yes                           |
|                                      |                               |
|                                      | No                            |
+--------------------------------------+-------------------------------+
| Solid core door:                     | Yes                           |
|                                      |                               |
|                                      | No                            |
+--------------------------------------+-------------------------------+

  ------------------------ ----------------------------------------------
  Type of alarm system, if 
  any:                     

  ------------------------ ----------------------------------------------

  ----------- -----------------------------------------------------------
  Comments:   

              
  ----------- -----------------------------------------------------------

# 23. Internet System Checks

(ALDACS 99 State 145967, 00 State 48743)

  ------ ----------------------------------------------------------------
  23.1   Does Post have Internet terminals?

  ------ ----------------------------------------------------------------

+-----------------------------------------------------------------------+
| Yes                                                                   |
|                                                                       |
| No                                                                    |
+-----------------------------------------------------------------------+

  ------ ----------------------------------------------------------------
  23.2   If Post has Internet terminals, please provide the following
         information:

  ------ ----------------------------------------------------------------

  -------- ----------------------------------------------------------------
  23.2.1   Supply the name of your Internet service provider:

  -------- ----------------------------------------------------------------

  -----------------------------------------------------------------------

  -----------------------------------------------------------------------

  -------- ----------------------------------------------------------------
  23.2.2   Does Post have an Internet policy?

  -------- ----------------------------------------------------------------

+-----------------------------------------------------------------------+
| Yes                                                                   |
|                                                                       |
| No                                                                    |
+-----------------------------------------------------------------------+

  ----------- -----------------------------------------------------------
  Comments:   

              

              
  ----------- -----------------------------------------------------------

  -------- ----------------------------------------------------------------
  23.2.3   Indicate the location of the Internet terminals:

  -------- ----------------------------------------------------------------

  -----------------------------------------------------------------------

  -----------------------------------------------------------------------

  -------- ----------------------------------------------------------------
  23.2.4   Are users assigned individual logon accounts (for
           accountability)?

  -------- ----------------------------------------------------------------

+-----------------------------------------------------------------------+
| Yes                                                                   |
|                                                                       |
| No                                                                    |
+-----------------------------------------------------------------------+

  ----------- -----------------------------------------------------------
  Comments:   

              

              
  ----------- -----------------------------------------------------------

  -------- ----------------------------------------------------------------
  23.2.5   Is the browser history file tracking activated?

  -------- ----------------------------------------------------------------

+-----------------------------------------------------------------------+
| Yes                                                                   |
|                                                                       |
| No                                                                    |
+-----------------------------------------------------------------------+

  ----------- -----------------------------------------------------------
  Comments:   

              

              
  ----------- -----------------------------------------------------------

  -------- ----------------------------------------------------------------
  23.2.6   Is post using some other software to help track users surfing
           and/or restrict access to unauthorized sites? (Cybersitter 97,
           NetNanny, etc.)

  -------- ----------------------------------------------------------------

+-----------------------------------------------------------------------+
| Yes                                                                   |
|                                                                       |
| No                                                                    |
+-----------------------------------------------------------------------+

  ----------- -----------------------------------------------------------
  Comments:   

              

              
  ----------- -----------------------------------------------------------

  -------- ----------------------------------------------------------------
  23.2.7   Are the Internet machines part of a LAN system?

  -------- ----------------------------------------------------------------

+-----------------------------------------------------------------------+
| Yes                                                                   |
|                                                                       |
| No                                                                    |
+-----------------------------------------------------------------------+

  ----------- -----------------------------------------------------------
  Comments:   

              

              
  ----------- -----------------------------------------------------------

  -------- ----------------------------------------------------------------
  23.2.8   Was permission granted from DS and IRM before establishing the
           Internet LAN? If so, state the cable number.

  -------- ----------------------------------------------------------------

+-----------------------------------------------------------------------+
| Yes                                                                   |
|                                                                       |
| No                                                                    |
+-----------------------------------------------------------------------+

  --------------------- -------------------------------------------------
  Cable Number          

  --------------------- -------------------------------------------------

  -------- ---------------------------------------------------------------
  23.2.9   Does the LAN system have a firewall?

  -------- ---------------------------------------------------------------

+-----------------------------------------------------------------------+
| Yes                                                                   |
|                                                                       |
| No                                                                    |
+-----------------------------------------------------------------------+

  ----------- -----------------------------------------------------------
  Comments:   

              

              
  ----------- -----------------------------------------------------------

  --------- --------------------------------------------------------------
  23.2.10   What filtering is activated?

  --------- --------------------------------------------------------------

  -----------------------------------------------------------------------

  -----------------------------------------------------------------------

  --------- --------------------------------------------------------------
  23.2.11   What firewall software is being used?

  --------- --------------------------------------------------------------

  -----------------------------------------------------------------------

  -----------------------------------------------------------------------

  --------- --------------------------------------------------------------
  23.2.12   What tracking is set on the firewall?

  --------- --------------------------------------------------------------

  -----------------------------------------------------------------------

  -----------------------------------------------------------------------

  --------- --------------------------------------------------------------
  23.2.13   What is the recovery plan for Internet terminals or the
            Internet LAN?

  --------- --------------------------------------------------------------

  -----------------------------------------------------------------------

  -----------------------------------------------------------------------

  --------- --------------------------------------------------------------
  23.2.14   If the Internet machine is located in the CAA, check which of
            the following apply:

  --------- --------------------------------------------------------------

+----------------------------------------------------+-----------------+
| External Modem:                                    | Yes             |
|                                                    |                 |
|                                                    | No              |
+----------------------------------------------------+-----------------+
| Positive disconnect switch:                        | Yes             |
|                                                    |                 |
|                                                    | No              |
+----------------------------------------------------+-----------------+
| Sound card or speakers:                            | Yes             |
|                                                    |                 |
|                                                    | No              |
+----------------------------------------------------+-----------------+
| Employees are told that classified conversations   | Yes             |
| are not allowed in the area surrounding the        |                 |
| Internet machine:                                  | No              |
+----------------------------------------------------+-----------------+

  ----------- -----------------------------------------------------------
  Comments:   

              

              
  ----------- -----------------------------------------------------------

  --------- --------------------------------------------------------------
  23.2.15   Is the machine connected to SBU systems by any means?

  --------- --------------------------------------------------------------

+-----------------------------------------------------------------------+
| Yes                                                                   |
|                                                                       |
| No                                                                    |
+-----------------------------------------------------------------------+

  ----------- -----------------------------------------------------------
  Comments:   

              

              
  ----------- -----------------------------------------------------------

  --------- --------------------------------------------------------------
  23.2.16   If using the Raritan switch (sharing of monitor, mouse &
            keyboard between Internet CPU and SBU CPU), does the SBU
            machine display the SBU screen icon on the desktop?

  --------- --------------------------------------------------------------

+-----------------------------------------------------------------------+
| Yes                                                                   |
|                                                                       |
| No                                                                    |
+-----------------------------------------------------------------------+

  ----------- -----------------------------------------------------------
  Comments:   

              

              
  ----------- -----------------------------------------------------------

  --------- --------------------------------------------------------------
  23.2.17   Are post personnel downloading executables from the Internet?

  --------- --------------------------------------------------------------

+-----------------------------------------------------------------------+
| Yes                                                                   |
|                                                                       |
| No                                                                    |
+-----------------------------------------------------------------------+

  ----------- -----------------------------------------------------------
  Comments:   

              
  ----------- -----------------------------------------------------------

  --------- --------------------------------------------------------------
  23.2.18   In spot checking the history files, is there any inappropriate
            usage occurring?

  --------- --------------------------------------------------------------

+-----------------------------------------------------------------------+
| Yes                                                                   |
|                                                                       |
| No                                                                    |
+-----------------------------------------------------------------------+

  ----------- -----------------------------------------------------------
  Comments:   

              
  ----------- -----------------------------------------------------------

  --------- --------------------------------------------------------------
  23.2.19   Is Office MS suite (Word, Power Point, Excel, etc.) on the
            Internet machine?

  --------- --------------------------------------------------------------

+-----------------------------------------------------------------------+
| Yes                                                                   |
|                                                                       |
| No                                                                    |
+-----------------------------------------------------------------------+

  ----------- --------------------------------------------------------------
  23.2.19.1   If so, are the users using floppies to do Office work on
              Internet machine (i.e., if Yes, check machine for SBU or
              classified processing documents, etc.)

  ----------- --------------------------------------------------------------

+-----------------------------------------------------------------------+
| Yes                                                                   |
|                                                                       |
| No                                                                    |
+-----------------------------------------------------------------------+

  ----------- -----------------------------------------------------------
  Comments:   

              

              
  ----------- -----------------------------------------------------------

# 24. Digital Copiers

  ------ ----------------------------------------------------------------
  24.1   Are digital copiers used?

  ------ ----------------------------------------------------------------

+-----------------------------------------------------------------------+
| Yes                                                                   |
|                                                                       |
| No                                                                    |
+-----------------------------------------------------------------------+

  -------- ----------------------------------------------------------------
  24.1.1   If digital copiers are used, supply the location, model, and
           serial numbers:

  -------- ----------------------------------------------------------------

  -----------------------------------------------------------------------

  -----------------------------------------------------------------------

  ------ ----------------------------------------------------------------
  24.2   Do the copiers have removable drives?

  ------ ----------------------------------------------------------------

+-----------------------------------------------------------------------+
| Yes                                                                   |
|                                                                       |
| No                                                                    |
+-----------------------------------------------------------------------+

  ------ ----------------------------------------------------------------
  24.3   Who services the equipment?

  ------ ----------------------------------------------------------------

  -----------------------------------------------------------------------

  -----------------------------------------------------------------------

# 25. Critical Technical or Critical HUMINT Threat Posts

  ------ ----------------------------------------------------------------
  25.1   Does the ISSO, along with the data center manager and the system
         manager, ensure that the equipment used to process classified
         information was certified by IRM/OPS, shipped to post via
         classified pouch, and stored at post according to DS
         requirements? (12 FAM 636)

  ------ ----------------------------------------------------------------

+-----------------------------------------------------------------------+
| Yes                                                                   |
|                                                                       |
| No                                                                    |
+-----------------------------------------------------------------------+

  ----------- -----------------------------------------------------------
  Comments:   

              
  ----------- -----------------------------------------------------------

  ------ ----------------------------------------------------------------
  25.2   Does the ISSO, along with the data center manager and the system
         manager at Critical Technical Threat Posts, restrict unescorted
         access to rooms housing distributed AIS CPUs, disk drives and
         AIS media to Secret-cleared U.S. citizens with a valid
         need-to-know? (12 FAM 626.2-2)

  ------ ----------------------------------------------------------------

+-----------------------------------------------------------------------+
| Yes                                                                   |
|                                                                       |
| No                                                                    |
+-----------------------------------------------------------------------+

  ----------- -----------------------------------------------------------
  Comments:   

              
  ----------- -----------------------------------------------------------

  ------ ----------------------------------------------------------------
  25.3   Does the ISSO, along with the IMO or IPO, authorize the use of
         TEMPEST-certified laser printers inside controlled access areas
         for the production of hard copy output? (12 FAM 626.1-1)

  ------ ----------------------------------------------------------------

+-----------------------------------------------------------------------+
| Yes                                                                   |
|                                                                       |
| No                                                                    |
+-----------------------------------------------------------------------+

  ----------- -----------------------------------------------------------
  Comments:   

              
  ----------- -----------------------------------------------------------

  ------ ----------------------------------------------------------------
  25.4   Does the ISSO, along with the IPO, data center manager, and
         system manager, ensure that system circuits, cable housings, and
         power installations for classified distributed AISs are
         installed in accordance with the National COMSEC Information
         Memorandum (NACSIM 5203), \"Guidelines for Facility Design and
         Red/Black Installation?\" (12 FAM 626.2-3)

  ------ ----------------------------------------------------------------

+-----------------------------------------------------------------------+
| Yes                                                                   |
|                                                                       |
| No                                                                    |
+-----------------------------------------------------------------------+

  ----------- ------------------- ---------------------------------------------------------- --
  Comments:                                                                                  

                                                                                             

  25.5        Does the ISSO,                                                                 
              along with the IPO,                                                            
              the data center                                                                
              manager, and the                                                               
              system manager,                                                                
              ensure that AISs                                                               
              and peripherals                                                                
              located outside a                                                              
              controlled access                                                              
              area (CAA) are not                                                             
              connected to AISs                                                              
              or peripherals                                                                 
              located inside a                                                               
              CAA? Exceptions for                                                            
              Department                                                                     
              Telecommunication                                                              
              System (DTS)                                                                   
              connectivity and                                                               
              connectivity to                                                                
              out-of-country or                                                              
              non-embassy systems                                                            
              may be granted on a                                                            
              case-by-case basis                                                             
              with the approval                                                              
              of the Diplomatic                                                              
              Security Service                                                               
              (DSS). (12 FAM                                                                 
              626.1-4)                                                                       
  ----------- ------------------- ---------------------------------------------------------- --

+-----------------------------------------------------------------------+
| Yes                                                                   |
|                                                                       |
| No                                                                    |
+-----------------------------------------------------------------------+

  ----------- -----------------------------------------------------------
  Comments:   

              
  ----------- -----------------------------------------------------------

  ------ ----------------------------------------------------------------
  25.6   Does the ISSO, along with the data center manager and the system
         manager, use only hardware and software received by classified
         pouch shipments inside the CAA? (12 FAM 626.3-1)

  ------ ----------------------------------------------------------------

+-----------------------------------------------------------------------+
| Yes                                                                   |
|                                                                       |
| No                                                                    |
+-----------------------------------------------------------------------+

  ----------- -----------------------------------------------------------
  Comments:   

              
  ----------- -----------------------------------------------------------

  ------ ----------------------------------------------------------------
  25.7   Does the ISSO, along with the data center manager and the system
         manager, ensure that only software received by controlled air
         pouch shipments on AISs outside controlled access areas? (12 FAM
         626.3-1)

  ------ ----------------------------------------------------------------

+-----------------------------------------------------------------------+
| Yes                                                                   |
|                                                                       |
| No                                                                    |
+-----------------------------------------------------------------------+

  ----------- -----------------------------------------------------------
  Comments:   

              
  ----------- -----------------------------------------------------------

  ------ ----------------------------------------------------------------
  25.8   Does the ISSO, along with the RSO or PSO, securely store all
         operating system and application software media designated for
         use on the CPU and ensure that only U.S. citizens with at least
         a Secret clearance have access? (12 FAM 626.2-1)

  ------ ----------------------------------------------------------------

+-----------------------------------------------------------------------+
| Yes                                                                   |
|                                                                       |
| No                                                                    |
+-----------------------------------------------------------------------+

  ----------- -----------------------------------------------------------
  Comments:   

              
  ----------- -----------------------------------------------------------

  ------ ----------------------------------------------------------------
  25.9   Describe how removable SBU media is stored. (12 FAM 626.1-1)

  ------ ----------------------------------------------------------------

  -----------------------------------------------------------------------

  -----------------------------------------------------------------------

  ------- ----------------------------------------------------------------
  25.10   Describe the after-hours setup for FSNs. (12 FAM 626.2-2)

  ------- ----------------------------------------------------------------

  -----------------------------------------------------------------------

  -----------------------------------------------------------------------

  ------- ----------------------------------------------------------------
  25.11   Does the data center manager, the system manager, and the IPO or
          IMO, ensure that there is no connectivity from an unclassified
          system to a classified system? (12 FAM 626.1-4)

  ------- ----------------------------------------------------------------

+-----------------------------------------------------------------------+
| Yes                                                                   |
|                                                                       |
| No                                                                    |
+-----------------------------------------------------------------------+

  ------- ----------------------------------------------------------------
  25.12   With the exception of DTS connections, does the ISSO, along with
          the IPO, and RSO or PSO, ensure that cable runs for unclassified
          AISs do not pass through controlled access areas? (12 FAM
          626.2-3)

  ------- ----------------------------------------------------------------

+-----------------------------------------------------------------------+
| Yes                                                                   |
|                                                                       |
| No                                                                    |
+-----------------------------------------------------------------------+

  ----------- -----------------------------------------------------------
  Comments:   

              
  ----------- -----------------------------------------------------------

  ------- ----------------------------------------------------------------
  25.13   Does the ISSO, along with the RSO/PSO, ensure that personnel
          accessing equipment housed in a CAA have at least a Secret
          clearance? (12 FAM 626.1-3)

  ------- ----------------------------------------------------------------

+-----------------------------------------------------------------------+
| Yes                                                                   |
|                                                                       |
| No                                                                    |
+-----------------------------------------------------------------------+

# 26. Telecommuting

  ------ ----------------------------------------------------------------
  26.1   Does Post have employees participating in a telecommuting
         program? If the answer is 'no', skip this section.

  ------ ----------------------------------------------------------------

+-----------------------------------------------------------------------+
| Yes                                                                   |
|                                                                       |
| No                                                                    |
+-----------------------------------------------------------------------+

  ------ ----------------------------------------------------------------
  26.2   Do the computers that are used for telecommuting purposes have
         password lockout feature screen savers in place? (12 FAM
         625.2-3-Telecommuting)

  ------ ----------------------------------------------------------------

+-----------------------------------------------------------------------+
| Yes                                                                   |
|                                                                       |
| No                                                                    |
+-----------------------------------------------------------------------+

  ------ ----------------------------------------------------------------
  26.3   Are the Telecommuters briefed regarding their security
         responsibilities related to the use of a U.S. Government-owned
         computer? (12 FAM 625.2-3)

  ------ ----------------------------------------------------------------

+-----------------------------------------------------------------------+
| Yes                                                                   |
|                                                                       |
| No                                                                    |
+-----------------------------------------------------------------------+

  ----------- -----------------------------------------------------------
  Comments:   

              

              
  ----------- -----------------------------------------------------------

  ------ ----------------------------------------------------------------
  26.4   Is a Department-approved encryption device installed between the
         off-site system and the host processor in order to prevent clear
         text transmittal of information, especially of user IDs and
         passwords? (12 FAM 645.2)

  ------ ----------------------------------------------------------------

+-----------------------------------------------------------------------+
| Yes                                                                   |
|                                                                       |
| No                                                                    |
+-----------------------------------------------------------------------+

  ----------- -----------------------------------------------------------
  Comments:   

              

              
  ----------- -----------------------------------------------------------

  ------ ----------------------------------------------------------------
  26.5   Is virus protection installed on the computer?

  ------ ----------------------------------------------------------------

+-----------------------------------------------------------------------+
| Yes                                                                   |
|                                                                       |
| No                                                                    |
+-----------------------------------------------------------------------+

  ----------- -----------------------------------------------------------
  Comments:   

              

              
  ----------- -----------------------------------------------------------

# 27. Additional Questions

  ------ ----------------------------------------------------------------
  27.1   Has a Network Intrusion Detection System (NIDS) box been
         installed?

  ------ ----------------------------------------------------------------

+-----------------------------------------------------------------------+
| Yes                                                                   |
|                                                                       |
| No                                                                    |
+-----------------------------------------------------------------------+

  ----------- ------------ ---------------------------------------------------------- --
  Comments:                                                                           

                                                                                      

                                                                                      

  27.2        Are Personal                                                            
              Digital                                                                 
              Assistants                                                              
              (PDAs) used                                                             
              at post?                                                                
  ----------- ------------ ---------------------------------------------------------- --

+-----------------------------------------------------------------------+
| Yes                                                                   |
|                                                                       |
| No                                                                    |
+-----------------------------------------------------------------------+

  ----------- -----------------------------------------------------------
  Comments:   

              

              
  ----------- -----------------------------------------------------------

  -------- ----------------------------------------------------------------
  27.2.1   Describe post's policy if PDAs are used:

  -------- ----------------------------------------------------------------

  -----------------------------------------------------------------------

  -----------------------------------------------------------------------

  ------ ----------------------------------------------------------------
  27.3   Is there any external access to embassy servers?

  ------ ----------------------------------------------------------------

+-----------------------------------------------------------------------+
| Yes                                                                   |
|                                                                       |
| No                                                                    |
+-----------------------------------------------------------------------+

  ------------ ----------------------------------------------------------
  If so,       
  describe:    

               
  ------------ ----------------------------------------------------------

  ------ ----------------------------------------------------------------
  27.4   Does post have any wireless LANs?

  ------ ----------------------------------------------------------------

+-----------------------------------------------------------------------+
| Yes                                                                   |
|                                                                       |
| No                                                                    |
+-----------------------------------------------------------------------+

  ------------ ----------------------------------------------------------
  If so,       
  describe:    

               
  ------------ ----------------------------------------------------------

  ------ ----------------------------------------------------------------
  27.5   Indicate location of modems:

  ------ ----------------------------------------------------------------

  -----------------------------------------------------------------------

  -----------------------------------------------------------------------

  ------ ----------------------------------------------------------------
  27.6   Describe how post communicates between Annexes and the main
         building?

  ------ ----------------------------------------------------------------

  -----------------------------------------------------------------------

  -----------------------------------------------------------------------

  ------ ----------------------------------------------------------------
  27.7   With the data center manager and the system manager, develops
         and maintains a current list of personnel who are authorized
         unescorted access to the computer room. (12 FAM 629.1-3)

  ------ ----------------------------------------------------------------

+-----------------------------------------------------------------------+
| Yes                                                                   |
|                                                                       |
| No                                                                    |
+-----------------------------------------------------------------------+

  ----------- -----------------------------------------------------------
  Comments:   

              

              
  ----------- -----------------------------------------------------------

  ------ ----------------------------------------------------------------
  27.8   Was management formally advised of any deficiencies noted in the
         preparation of this questionnaire?

  ------ ----------------------------------------------------------------

+-----------------------------------------------------------------------+
| Yes                                                                   |
|                                                                       |
| No                                                                    |
+-----------------------------------------------------------------------+

  ----------- -----------------------------------------------------------
  Comments:   

              

              
  ----------- -----------------------------------------------------------

  -------- ---------------------------------------------------------------
  27.8.1   If the answer to the above question is "Yes," did management
           direct compliance or seek a formal waiver/exception to the
           particular regulation?

  -------- ---------------------------------------------------------------

+-----------+----------------------------------------------------------+
| Yes       |                                                          |
|           |                                                          |
| No        |                                                          |
+-----------+----------------------------------------------------------+
| Comments: |                                                          |
+-----------+----------------------------------------------------------+
|           |                                                          |
+-----------+----------------------------------------------------------+