Functional Series 500 - Management Services

Chapter 545 - Information Systems Security

Table of Contents

[**\*545.1** **OVERVIEW 2**](#__RefHeading___Toc522609342)

[\*545.2 PRIMARY RESPONSIBILITIES 2](#__RefHeading___Toc522609343)

[\*545.3 POLICY AND PROCEDURES 4](#__RefHeading___Toc522609344)

[545.3.1 Information Systems (IS) Protection
6](#__RefHeading___Toc522609345)

[545.3.1.1 Information Systems Security Program
6](#__RefHeading___Toc522609346)

[545.3.1.2 Access to Unclassified IS Networks
6](#__RefHeading___Toc522609347)

[545.3.1.3 Security Responsibilities for Unclassified IS Networks
7](#__RefHeading___Toc522609348)

[545.3.2 Unclassified Information Processing
7](#__RefHeading___Toc522609349)

[545.3.2.1 Personnel Requirements for Access to IS
8](#__RefHeading___Toc522609350)

[545.3.2.2 Personnel Management 9](#__RefHeading___Toc522609351)

[\*545.3.2.3 Technical Security 11](#__RefHeading___Toc522609352)

[\*545.3.2.4 Administrative Security 17](#__RefHeading___Toc522609353)

[545.3.2.5 System Operation Requirements \-- Logs, Certification,
Backup, Emergency Actions, and Contingency Operation Planning
28](#__RefHeading___Toc522609354)

[545.3.2.6 Physical Security 30](#__RefHeading___Toc522609355)

[545.3.2.7 Host Facility System Security Standards
31](#__RefHeading___Toc522609356)

[545.3.2.8 Special Considerations for Missions Operating in Critical
Technical and Critical Human Intelligence Threat Environments
32](#__RefHeading___Toc522609357)

[545.3.3 Facsimile Equipment and Transmissions
33](#__RefHeading___Toc522609358)

[545.3.3.1 Procurement of Facsimile Equipment
33](#__RefHeading___Toc522609359)

[545.3.3.2 Installation and Repair of Facsimile Equipment
33](#__RefHeading___Toc522609360)

[545.3.3.3 Facsimile Transmissions 33](#__RefHeading___Toc522609361)

[545.3.3.4 Administrative Management for Facsimile Equipment
34](#__RefHeading___Toc522609362)

[545.3.3.5 Facsimile Gateways Connected to Workstations or Servers
36](#__RefHeading___Toc522609363)

[545.3.4 Networking and Connectivity Security
36](#__RefHeading___Toc522609364)

[\*545.4 MANDATORY REFERENCES 38](#__RefHeading___Toc522609365)

[\*545.4.1 External Mandatory References
38](#__RefHeading___Toc522609366)

\*a. Relevant Federal Statutes

> 1\. The Computer Fraud and Abuse Act of 1986, Public Law 99-474, as
> amended by the National Information Infrastructure Protection Act of
> 1996, Public Law 104-294
>
> \*2. The Computer Security Act of 1987, Public Law 100-235, as amended
> by Public Law 104-106, National Defense Authorization Act (Fiscal Year
> 1996) Division E, Information Technology Management Reform
> (Clinger-Cohen Act), and see also 44 United States Code (U.S.C.)
> Chapter 35 {Coordination of Federal Information Policy} - amended
> October 30, 2000, by Government Information Security Reform \[GISR\]
> Subtitle G of the FY 2001 DoD Authorization Act, Public Law 106-398.
> GISR has been implemented by OMB M-01-08, Guidance On Implementing the
> Government Information Security Reform Act (January 16, 2001).
>
> 3\. The Electronic Communications Privacy Act of 1986, Public Law
> 99-508, as amended
>
> 4\. The Freedom of Information Act of 1966, Public Law 89-554, as
> amended
>
> 5\. The Government Paperwork Elimination Act (GPEA), Public Law
> 105-277; as implemented by Office of Management and Budget (OMB)
> Procedures and Guidance published May 2, 2000
>
> 6\. The Identity Theft and Assumption Deterrence Act of 1998, Public
> Law 105-318
>
> 7\. (Section 587 of the Fiscal Year 1999) The Omnibus Appropriations
> Act, Public Law 105-277, as amended
>
> 8\. The Omnibus Diplomatic Security and Anti-terrorism Act of 1986, as
> amended

9\. The Privacy Act of 1974, Public Law 93-579, as amended

> 10\. The Trade Secrets Act of 1948 & 1980, Public Law 96-349, as
> amended

b\. Executive Orders (EOs)

1\. EO 12968, \"Access to Classified Information\"

> 2\. EO 12656, \"Assignment of Emergency Preparedness
> Responsibilities\"

3\. EO 12958, \"Classified National Security Information\" (as amended)

4\. EO 13103, \"Computer Software Piracy\" as amended

5\. EO 13011, \"Federal Information Technology\"

6\. EO 12829, \"National Industrial Security Program\" (as amended)

7\. EO 10450, \"Security requirements for Government employment\"

\*c. Circulars, Handbooks, Instructions, Manuals, Regulations

> 1\. DOD 5200.28-STD, \"Department of Defense Trusted Computer System
> Evaluation Criteria\"
>
> 2\. Foreign Affairs Handbook, 12 FAH-6 (OSPB Security Standards and
> Policy Handbook)
>
> 3\. 12 Foreign Affairs Manual 090, Definitions of Diplomatic Security
> Terms

4\. 12 Foreign Affairs Manual 500, Information Security

> 5\. National Information Assurance Certification and Accreditation
> Process (NIACAP, National Security Telecommunications and Information
> Systems Security Instruction {NSTISSI} No. 1000)
>
> \*6. The Office of Management and Budget (OMB) Circular A-130
> Management of Federal Information Resources and its Appendix III,
> Security of Federal Automated Information Resources.
>
> 7\. The Office of Management and Budget (OMB) Circular A-123,
> Management Accountability and Control (as revised.)
>
> 8\. 32 Code of Federal Regulations (CFR) Part 2004, \"Safeguarding
> Classified National Security Information\" and associated implementing
> guidance

[\*545.4.2 Internal Mandatory References
40](#__RefHeading___Toc522609367)

> \*a. AID Form 545-1, USAID Unclassified Information Systems Access
> Request Acknowledgement

b\. AID Form 545-2, Authorized Access List

\*c. AID Form 545-3, Unclassified Information Compliance Review

> \*d. AID Form 545-4, USAID Computer System Access & Termination
> Request

e\. AID Form 545-5, USAID Sensitive Data Nondisclosure Agreement

f\. AID Form 545-6, Visitors Log

g\. ADS 502, The USAID Records Management Program

h\. ADS 507, Freedom of Information Act (FOIA)

i\. ADS 508, Privacy Act - 1974

> j\. ADS 509, Creating, Altering, or Terminating a System of Records
> (Records Pertaining to Individuals)

k\. ADS 530, Emergency Planning Overseas

l\. ADS 531, Continuity of Operations Program

m\. ADS 541, Information Management

\*n. ADS 543, Corporate Information Systems

o\. ADS 549, Telecommunications Management

p\. ADS 550, End-User Applications

q\. ADS 552, Classified Information Systems Security

r\. ADS 561, Security Responsibilities

s\. ADS 562, Physical Security Programs (Overseas)

t\. ADS 565, Physical Security Programs (Domestic)

u\. ADS 566, U.S. Direct-Hire and PASA/RSSA Personnel Security Program

> v\. ADS 567, Classified Contract Security and Contractor Personnel
> Security Program
>
> w\. ADS 568, National Security Information and Counterintelligence
> Security Program

\*x. Incident Response Guidance for Unclassified Information Systems
(NEW)

> \*y. Information Systems Certification and Accreditation Process,
> Approval to Operate (previously an Additional Help document)

\*z. Information Technology Security Roles and Responsibilities

[\*545.5 ADDITIONAL HELP 41](#__RefHeading___Toc522609368)

\*a. Contingency Planning for Information Resources

\*b. Sample Facsimile Cover Sheet

\*c. Suggested Warning Screen Messages

\*d. Synopsis of Security Rules of Behavior for Users

[\*545.6 DEFINITIONS 41](#__RefHeading___Toc522609369)

Chapter 545 - Information Systems Security

[]{#__RefHeading___Toc522609342 .anchor}\*545.1 OVERVIEW

This chapter outlines the basic policies that underlie the Agency\'s
Information Systems Security (ISS) Program. Because most of USAID\'s
systems are used to process unclassified data, ADS 545 documents the
Agency\'s primary ISS policy. Some forms, formats, and guidance in ADS
545 also apply to classified USAID information systems (IS). Other
guidance for classified data processing is contained in ADS 552,
Classified Information Systems Security.

**\*Note: The former term, \"Automated Information Systems\" has been
replaced by \"Information Systems\" throughout this chapter, and in all
associated documents. When referring to security for IS, information
systems security is still abbreviated ISS throughout this chapter.**

This chapter contains the following:

-   USAID\'S overall policies and procedures to protect unclassified IS;

-   General IS access procedures (personnel, technical, and
    administrative security requirements for unclassified USAID
    networks);

-   Selected procedures for access to and processing Sensitive But
    Unclassified (SBU) data, and computer operations overseas and in
    special threat areas (to include guidance on contingency response
    requirements); and

-   Details on USAID facsimile and networking security requirements.

[]{#__RefHeading___Toc522609343 .anchor}\*545.2 PRIMARY RESPONSIBILITIES

**\*Law and Federal guidance require agencies to incorporate security
into their information technology architectures and the life cycles of
their information systems. More detailed security responsibilities apply
to Mission Critical Systems and National Security Systems (see 545.6,
Definitions, for statutory and regulatory terms that apply to
information systems). Within USAID, primary information systems security
(ISS) responsibilities are as follows:**

**a.** The Administrator is responsible for developing and implementing
a comprehensive, Agency-wide information systems security (ISS) program
that is technically current, cost-effective, and in full compliance with
established national security directives. This responsibility has been
delegated to the Bureau for Management, Office of Information Resources
Management (M/IRM). The Administrator is also responsible for
designating the ISSO for USAID. More details on Agency ISS
responsibilities are contained in the Internal Mandatory Reference,
\"Information Technology Security Roles and Responsibilities.\" **(See
Mandatory Reference,** [Information Technology Security Roles and
Responsibilities](http://www.usaid.gov/pubs/ads/500/refindx5.htm/545mac)
**)**

\***b.** The **Deputy** Assistant Administrator, Bureau for Management
(AA/M) serves as the Chief Information Officer (CIO); the CIO is
responsible for directing, managing, and providing policy guidance and
oversight with respect to all Agency information resource management
activities. These responsibilities may be delegated to senior level
office managers. IS security management activities are performed by
USAID\'s Information Systems Security Officer (USAID ISSO), by program
managers, by designated ISSOs, and by information technology (IT)
systems managers. **The CIO serves as the Designated Security
Accreditation Authority (DSAA) for most of USAID\'s IS, including IS at
USAID Missions, and will oversee both annual IT program reviews and any
Agency-wide reports to OMB on IT security issues. The CIO will be
assisted in assessing and implementing Agency information security
functions by the Information Security Advisory Group (ISAG), the Privacy
Working Group (PWG), and the Information Systems Security Working Group
(ISSWG).**

**\*NOTE: Details on the Certification and Accreditation process are
included in the Internal Mandatory Reference, \"Information Systems
Certification and Accreditation, Approval to Operate.\" (See Mandatory
Reference,** [Information Systems Certification and Accreditation,
Approval to
Operate](http://www.usaid.gov/pubs/ads/500/refindx5.htm/545mae)**)**

**\*c. The Director, Office of Financial Management (M/FM), USAID\'s
Chief Financial Officer (CFO), serves as the DSAA for financial IS in
USAID/Washington (USAID/W).**

**d.** The Bureau for Management, Office of Information Resources
Management (M/IRM) is responsible for providing \"signatory approval to
operate\" for all information systems used to process, store, or print
Sensitive But Unclassified information. The Director of M/IRM has the
authority to approve, subsequent to coordination with the Director of
the Office of Security (D/SEC), the use of all information systems used
to process, store, or print classified national security information.
Many other USAID IS-related functions are assigned to M/IRM.

\***e**. The ISSO for USAID is designated by the Administrator and is
directly responsible for overseeing and executing the bulk of the
Agency\'s operational information systems security activities. **In
addition, USAID's ISSO, after consultation with the Office of the
Inspector General (OIG) and the Office of Security (SEC), will develop
and implement methodologies for**

-   **Detecting, reporting, and responding to IS security incidents;**

-   **Notifying and consulting with law enforcement officials about IS
    security incidents; and**

-   **Notifying and consulting with other offices and authorities, to
    include the General Services Administration\'s Federal Computer
    Incident Response Capability (FedCIRC), in the event that a
    significant IS security incident occurs.**

    **\*f.** The Director, Office of Security (D/SEC) **is responsible
    for providing technical guidance and security policy determinations
    on issues within SEC\'s assigned responsibilities.**

    **\*g. The Office of the Inspector General (IG), consistent with
    legal and regulatory guidance, will conduct evaluations of USAID
    IS.**

\***h**. Other USAID **organizations** and individuals have
responsibilities for IS security functions, such as \--

-   The Bureau for Management, Office of Information Resources
    Management, Telecommunications and Computer Operations Division
    (M/IRM/TCO);

-   The Bureau for Management, Office of Information Resources
    Management, Systems Development and Maintenance Division
    (M/IRM/SDM);

-   **Certification Authorities, which include Mission Directors at
    USAID Missions, certify IS that support operations conducted in
    their organizations;**

-   Designated ISSOs within USAID organizations, Information Technology
    (IT) Specialists (USAID/W), System Managers (USAID Missions), IT
    system staff, and users.

**\*i. Each USAID organization must appoint U.S. citizens with SECRET
security clearances as designated ISSO and alternate ISSO, to implement
the Agency\'s information systems security program. The designated ISSO
at USAID Missions usually is the Executive Officer (EXO); however, a
Mission Director may appoint another U.S. citizen with a SECRET
clearance as designated ISSO instead.**

[]{#__RefHeading___Toc522609344 .anchor}\*545.3 POLICY AND PROCEDURES

**The Office of Management and Budget (OMB) revised its Circular A-130,
effective November 28, 2000. (See Mandatory Reference,** [OMB
A-130](http://www.usaid.gov/cgi-bin/goodbye?http://www.whitehouse.gov/OMB/circulars/index.html)**)
In accordance with OMB guidance, agencies must**

-   **Prioritize key systems (including those that are most critical to
    agency operations); and**

-   **Apply OMB policies and, for non-national security applications,
    NIST \[National Institute of Standards and Technology\] guidance to
    achieve adequate security commensurate with the level of risk and
    magnitude of harm.**

Agencies must make security\'s role explicit in information technology
investments and capital programming. Investments in the development of
new or the continued operation of existing information systems, both
general support systems and major applications, must

-   **Demonstrate that the security controls for components,
    applications, and systems are consistent with, and an integral part
    of, the EA \[Enterprise Architecture\] of the agency;**

-   **Demonstrate that the costs of security controls are understood and
    are explicitly incorporated into the life-cycle planning of the
    overall system in a manner consistent with OMB guidance for capital
    programming;**

-   **Incorporate a security plan that complies with Appendix III of OMB
    A-130 and in a manner that is consistent with NIST guidance on
    security planning;**

-   **Demonstrate specific methods used to ensure that risks and the
    potential for loss are understood and continually assessed, that
    steps are taken to maintain risk at an acceptable level, and that
    procedures are in place to ensure that controls are implemented
    effectively and remain effective over time;**

-   **Demonstrate specific methods used to ensure that the security
    controls are commensurate with the risk and magnitude of harm that
    may result from the loss, misuse, or unauthorized access to or
    modification of the system itself or the information it manages;**

-   **Identify additional security controls that are necessary to
    minimize risk to and potential loss from those systems that promote
    or permit public access, other externally accessible systems, and
    those systems that are interconnected with systems over which
    program officials have little or no control;**

-   **Deploy effective security controls and authentication tools
    consistent with the protection of privacy, such as public-key based
    digital signatures, for those systems that promote or permit public
    access;**

-   **Ensure that the handling of personal information is consistent
    with relevant government-wide and agency policies; and**

-   **Describe each occasion the agency decides to employ standards and
    guidance that are more stringent than those promulgated by NIST to
    ensure the use of risk-based cost-effective security controls for
    non-national security applications.**

**OMB will consider for new or continued funding only those system
investments that satisfy these criteria. New information technology
investments must demonstrate that existing agency systems also meet
these criteria in order to qualify for funding.**

[]{#__RefHeading___Toc522609345 .anchor}545.3.1 Information Systems (IS)
Protection

It is the policy of the United States Agency for International
Development (USAID) to protect the Agency\'s electronic information
commensurate with the risk and magnitude of harm that would result from
the loss, misuse, or unauthorized access to or modification of such
information. All data of value to the Agency requires some minimum level
of protection. Certain data, because of the sensitivity or criticality
of the information to the mission of USAID, requires additional
safeguards.

The Agency\'s policy is to implement and maintain an Information Systems
Security (ISS) Program to ensure that adequate computer security is
provided to all Agency information collected, processed, transmitted,
stored, or disseminated in general support systems and major
applications. All USAID networked computer systems must provide
controlled access protection safeguards to protect the integrity,
availability, and, where required, the confidentiality of Agency
information.

[]{#__RefHeading___Toc522609346 .anchor}545.3.1.1 Information Systems
Security Program

USAID's ISS Program implements policies, standards, and procedures that
are consistent with Government-wide policies, standards, and procedures
issued by the Office of Management and Budget, the Department of
Commerce, the General Services Administration, and the Office of
Personnel Management. Different or more stringent requirements for
securing national security information will be incorporated into USAID
classified programs as required by appropriate national security
directives. Classified processing requirements do not apply to
unclassified systems. However, at a minimum, USAID's ISS Program
requires that the controls outlined in OMB A-130, and its Appendix III,
must be implemented in all Agency general support and major applications
systems. **(See Mandatory Reference,** [OMB Circular A-130, and its
Appendix
III](http://www.usaid.gov/cgi-bin/goodbye?http://www.whitehouse.gov/OMB/circulars/index.html)**)**

[]{#__RefHeading___Toc522609347 .anchor}545.3.1.2 Access to Unclassified
IS Networks

USAID\'s security policy, for access to unclassified USAID computer
networks, is designed to protect sensitive Agency information against
unauthorized access or disclosure. USAID implements this policy by using
formal authorized access permission procedures based on a clearly
demonstrated need-to-know or need-to-use determination for every person
granted access to a USAID IS. USAID\'s security policy is supported by
an approved personnel screening process and formal authorization
approval. When all these factors are used together, they implement the
USAID security policy for USAID System access.

[]{#__RefHeading___Toc522609348 .anchor}545.3.1.3 Security
Responsibilities for Unclassified IS Networks

For each general support system and major application system, USAID
management is required to \--

-   Assign responsibility for security;

-   Develop, document, and implement system security plans;

-   Review security controls; and

-   Authorize processing.

[]{#__RefHeading___Toc522609349 .anchor}545.3.2 Unclassified Information
Processing

All personnel with information systems security responsibilities must
adhere to personnel, technical, administrative, and physical security
policies and procedures when USAID equipment is used to support Agency
objectives.

-   Personnel security aspects of ISS require determinations as to an
    individual\'s personal reliability and trustworthiness, as well as
    identification of his or her need to know and access particular
    types of data in order to perform his or her assigned functions.

-   Technical security aspects of ISS require implementation of
    technological methodologies in order to ensure data is accessible,
    is verifiable, and is secure from unauthorized access or damage.

-   Administrative security aspects of ISS require documentation of
    critical security actions as they are completed to demonstrate
    compliance.

-   Physical security aspects of ISS protect hardware, software, and
    other IS components from damage or loss (to include loss due to
    negligence or intentional misconduct).

{Note: To assist individuals working outside the information technology
(IT) arena in understanding their responsibilities, a brief synopsis of
security practices for users of unclassified information systems (IS) is
provided as an Additional Help item, titled Synopsis of Security **Rules
of Behavior** for Users. While this document is not all-inclusive, it
does provide some fundamentals, which will help users implement improved
IS security practices. **(See Additional Help document,** [Synopsis of
Security Rules of Behavior for
Users](http://www.usaid.gov/pubs/ads/500/refindx5.htm/545saf)**)**}

[]{#__RefHeading___Toc522609350 .anchor}545.3.2.1 Personnel Requirements
for Access to IS

Users must implement the following personnel security policies and
associated procedures when processing unclassified data on information
systems in Washington and at the Missions. **(See** [ADS 566, U.S.
Direct-Hire and PASA/RSSA Personnel Security
Program](http://www.usaid.gov/pubs/ads/500/) and [ADS 567, Classified
Contract Security and Contractor Personnel Security
Program](http://www.usaid.gov/pubs/ads/500/) for more information on
personnel security)

a\. Only individuals who meet the requirements for moderate risk
automated data processing positions must be members of the systems group
or users with special access privileges. **(See** [ADS
566](http://www.usaid.gov/pubs/ads/500/) and [ADS
567](http://www.usaid.gov/pubs/ads/500/)**)**

b\. Program Managers and designated ISSOs, in coordination with **the**
Office of Security, must ultimately ensure all personnel accessing
USAID/W computer systems and networks have, at a minimum, an employment
authorization prior to being granted access to any system or network
owned or operated by USAID. **(See** [ADS
566](http://www.usaid.gov/pubs/ads/500/) and [ADS
567](http://www.usaid.gov/pubs/ads/500/)**)**

1\. As an interim measure, no individual USAID employee or
contractor-user will be provided direct access to any USAID IS until the
following procedures have been completed \--

-   Execution of the USAID Computer System Access & Termination Request,
    endorsed by a USAID direct-hire employee **(See Mandatory
    Reference,** [USAID Computer System Access and Termination Request,
    AID Form
    545-4](http://www.usaid.gov/pubs/ads/500/refindx5.htm/a545-4)**)**;

```{=html}
<!-- -->
```
-   Execution of USAID Unclassified Information Systems Access Request
    Acknowledgement **(See Mandatory Reference,** [USAID Unclassified
    Information Systems Access Request Acknowledgement, AID
    545-1](http://www.usaid.gov/pubs/ads/500/refindx5.htm/a545-1)**)**
    {Note: If the user will be given unsupervised access to any USAID IS
    containing Sensitive But Unclassified data, the user and his or her
    supervisor must also execute the USAID Sensitive Data Nondisclosure
    Agreement. **(See Mandatory Reference,** [USAID Sensitive Data
    Nondisclosure Agreement, AID Form
    545-5](http://www.usaid.gov/pubs/ads/500/refindx5.htm/a545-5)**)**};
    and

```{=html}
<!-- -->
```
-   Completion of USAID-approved Information Security
    orientation/training.

2\. At a time to be determined by USAID, Program Managers and ISSOs will
ensure no individual is awarded a contract, permitted to provide goods
and/or services under a contract, or retained under a contract unless
such an action is clearly consistent with the interests of USAID. No
individual is permitted access to **any USAID IS** until -

-   A personnel security investigation or background check is completed
    at the level appropriate for the information to be accessed;

```{=html}
<!-- -->
```
-   It is determined that the individual's employment is clearly
    consistent with the interests of USAID goals and objectives;

```{=html}
<!-- -->
```
-   A favorable access eligibility determination is issued by the
    responsible Agency organization;

```{=html}
<!-- -->
```
-   The user executes all necessary documentation (identified in
    545.3.2.1.b.1.); and

```{=html}
<!-- -->
```
-   The individual completes USAID-approved Information Security
    orientation/training.

3\. All personnel accessing USAID Mission computer systems must
ultimately have, at a minimum, a certificate of Acceptability for
Employment prior to being granted access to any information system owned
or operated by USAID. **(See** [ADS 566, Personnel Security
Programs](http://www.usaid.gov/pubs/ads/500/) and [ADS 567, Classified
Contract Security and Contractor Personnel Security
Program](http://www.usaid.gov/pubs/ads/500/)**)** The Executive Officer
(EXO) must ultimately request, in writing, the Regional Security Officer
(RSO) to perform the highest level background investigation available
within the host country on local vendor contract maintenance personnel.
As a minimum, the interim procedures listed in subsection 545.3.2.1
paragraph b.1. must be followed prior to permitting an individual
initial access to any USAID IS.

[]{#__RefHeading___Toc522609351 .anchor}545.3.2.2 Personnel Management

A statement specifying responsibilities for information systems security
must be included in position descriptions and work requirements
statements for IT Specialists/ System Managers and members of the system
staff having responsibility for programming, operating, or managing
applications or systems. The Bureau for Management, Office of Human
Resources (M/HR) is available to assist USAID supervisors in developing
position descriptions.

**a. Separation of Duties**

The Program Manager, designated ISSO, IT Specialist, or System Manager
must structure user access privileges to reflect the separation of key
duties implemented for functions supported by the application. All user
access privileges must be consistent with the separation of duties
established for manual processes and be reviewed on an annual basis.

**b. Management of Personnel \-- Computer Room/System Access**

1\. The Program Manager, designated ISSO, IT Specialist, or System
Manager must revoke the user access privileges of people who no longer
require system access or who have severed their relationship with the
Agency. Such revocation must take place immediately upon the person\'s
status change or departure.

2\. The IT Specialist/System Manager must designate the room or office
space that houses the central processing unit or server for a
distributed system or local area network, and associated data storage
devices, as a limited access area restricted to authorized personnel
only.

3\. The IT Specialist/System Manager must ensure that custodial and
building maintenance personnel entering the computer room are under
continual observation by personnel with authorized unescorted access.

4\. The IT Specialist/System Manager must limit physical access to the
operating system and application software designated for use on the
Agency\'s computer systems and networks to personnel identified on the
Authorized Access List. **(See Mandatory Reference,** [Authorized Access
List, AID Form
545-2](http://www.usaid.gov/pubs/ads/500/refindx5.htm/a545-2)**)**

**c. Management of Personnel \-- Computer Room/System Access at
Missions**

EXOs**/**ISSOs must request the RSO to perform the highest level
background investigation available at Missions on all foreign nationals
and local contractors with special access privileges (e.g., backup
operator privileges). EXOs/ISSOs must approve, in writing, all users of
systems processing Sensitive But Unclassified (SBU) data. EXOs/ISSOs
must request the Office of Security to perform background investigations
on U.S. citizen system staff and application users with special access
privileges (e.g., operator privileges, or access to the computer room).
EXOs/ISSOs must approve, in writing, all users of systems processing SBU
data.

**d. Documentation of Authorized Computer Room/System Access**

1\. The designated ISSO must develop and maintain a list of personnel
authorized unescorted access into the computer room. The IT
Specialist/System Manager must sign and post the \"Authorized Access
List\" at all entrances to the computer room. The \"Authorized Access
List\" must also prominently indicate personnel to be contacted in the
event of an emergency. **(See Mandatory Reference,** [Authorized Access
List, AID Form
545-2](http://www.usaid.gov/pubs/ads/500/refindx5.htm/a545-2)**)**

2\. The IT Specialist/System Manager must maintain a visitors log for
all persons entering the computer room who do not have unescorted access
privileges. Only personnel listed on the \"Authorized Access List\" are
authorized to escort visitors. Individuals not on the \"Authorized
Access List\" must sign the visitors log prior to being allowed access
into the computer room. While in the computer room, visitors must be
under continuous visual observation by a person with authorized
unescorted access. **(See Mandatory References,** [Authorized Access
List, AID Form
545-2](http://www.usaid.gov/pubs/ads/500/refindx5.htm/a545-2)**,** and
[Visitors Log, AID Form
545-6](http://www.usaid.gov/pubs/ads/500/refindx5.htm/a545-6)**)**

[]{#__RefHeading___Toc522609352 .anchor}\*545.3.2.3 Technical Security

USAID Offices, Bureaus, and Missions must implement software and
hardware controls to provide adequate protection for Agency information
and system resources. Due to differences in hardware and software
capabilities, Agency personnel must implement the following policies
that are applicable to their specific system.

a\. Operating system guidance \-- The IT Specialist/System Manager must
control access to specialized system software, utilities, and
functionality that could be used to gain unauthorized access to
application data and program code. The IT Specialist /System Manager
must keep access to these resources to the minimum number of authorized
users required to accomplish program objectives.

b\. Users must not physically connect personally owned computer systems
or communication devices to U.S. Government-owned systems or
communication devices within USAID facilities.

c\. The IT Specialist/System Manager must equip stand-alone computer
systems with security enhancement controls, **(**e.g., software
products, or host dependent firmware products**)** as approved,
identified, or recommended by M/IRM.

d\. Application software \-- The IT Specialist/System Manager must
ensure that only M/IRM/SDM-approved or -distributed versions of
customized corporate application software (microcomputer software
excluded) are used on computer systems and networks owned or operated by
USAID.

e\. Agency employees, other than authorized application developers, must
not modify Agency standard application software.

f\. Employees developing application software for Agency systems must
develop and document their application software in accordance with M/IRM
standards. **(See Mandatory References,** [ADS 543, Corporate
Information Systems](http://www.usaid.gov/pubs/ads/500/) and [ADS 550,
End-User Applications](http://www.usaid.gov/pubs/ads/500/)**)**

g\. Software applications transported between USAID offices and
facilities must remain under Agency control during transport, or be sent
by a contract courier service via diplomatic pouch or commercial
contract courier service.

h\. The IT Specialist/System Manager must implement all application
controls to ensure that users are assigned access rights and privileges
consistent with their functional responsibilities and authorities.
Access rights and privileges must be based on need-to-know, separation
of duties, and management authorization.

i The IT Specialist/System Manager and designated ISSO must ensure that
personally owned application software, shareware, and freeware are not
installed on computer systems owned or operated by the Agency.

j\. All software must be scanned for viruses and other malicious
programming code prior to installation on any computer system or network
owned or operated by the Agency. Data files created or used on system(s)
or network equipment not owned and operated by the Agency and locally
purchased off-the-shelf software must be scanned for viruses and other
malicious programming code prior to installation on any system or
network owned or operated by the Agency.

k\. Security Controls \-- The IT Specialist/System Manager must ensure
that necessary security controls are implemented to prevent unauthorized
access to USAID systems.

**1. Workstation Restrictions**

-   Within USAID-operated workspaces, IT Specialists/System Managers
    must restrict users to USAID workstations and printers within the
    users\' immediate work area.

```{=html}
<!-- -->
```
-   IT Specialists/System Managers must ensure that USAID systems
    automatically disconnect a logged-on workstation from the system
    after a predetermined period of inactivity.

```{=html}
<!-- -->
```
-   IT Specialists/System Managers must limit unsuccessful logon
    attempts from any USAID workstation to three. After three
    unsuccessful logon attempts, the system must automatically lock out
    the workstation. Only the system staff must be given the capability
    to reset a workstation after lockout.

**2. Accountability/Password Controls**

-   IT Specialists/System Managers must assign individual users a
    minimum three character user-ID. The user-ID must be unique to each
    user and must identify the user to the system. The assignment of
    more than one user-ID or a phantom user-ID is prohibited.

```{=html}
<!-- -->
```
-   Whenever possible, passwords must be user generated under the
    supervision of access control software. In facilities where access
    control software is not available, the IT Specialist/System Manager
    must create and distribute user passwords in a controlled manner,
    and in such a way that an audit record of password date and time of
    issuance, receipt, use, change, expiration, and termination is
    maintained.

```{=html}
<!-- -->
```
-   System users must gain access to USAID networks or distributed
    systems only after entering their unique user-ID and password.

```{=html}
<!-- -->
```
-   USAID passwords must be valid for a period of not more than 90 days
    or not more than 30 days if used for dial-in access.

```{=html}
<!-- -->
```
-   System users must not share their system passwords with anyone, not
    even another cleared user. **(See Mandatory Reference,** [USAID
    Unclassified Information Systems Access Acknowledgement, AID Form
    545-1](http://www.usaid.gov/pubs/ads/500/refindx5.htm/a545-1)**)**

-   IT Specialists/System Managers must activate the audit trail
    capabilities provided by the operating system and security software
    installed on Agency systems.

-   The IT Specialist/System Manager must manage the creation, use, and
    deletion of user-IDs and passwords to prevent unauthorized access to
    the system.

-   The designated ISSO must ensure that all system users are aware of
    the private nature of their passwords. Users must inform the
    designated ISSO, Program Manager, Division Chief, or IT
    Specialist/System Manager if they suspect their password has been
    compromised. The designated ISSO must, in turn, work with the IT
    Specialist/System Manager to conduct an investigation and to make
    recommendations for action.

-   Program Managers, Division Chiefs, or Supervisory Personnel at
    Missions must annually review the access privileges of each
    application user under their supervision to verify that system
    access privileges originally granted are still appropriate.

**l. Technical Security Requirements and Responsibilities**

**1. Software** \-- The IT Specialist/System Manager must ensure that
all new releases, upgrades, or patches to Agency operating system
software and customized corporate application software installed on
Agency systems have been approved and distributed by M/IRM/SDM. Software
developed by or for Agency facilities or Missions must address
application-specific security measures in all user guides, installation
specifications, and backup and recovery operations.

**2. Security Controls** \-- The IT Specialist/System Manager must
ensure the following \--

-   All security software provided as part of the original system
    configuration (e.g., audit trail) is installed and operational.

-   Each system user is assigned a valid and appropriate logon procedure
    to control the processing options available to the system user.

-   Controls are implemented that limit access to files, programs, and
    data to users or groups of users with the same need-to-know.
    Need-to-know must be based on functional responsibilities,
    operational requirements, supervisory responsibilities, or a
    combination of these factors.

-   Password file maintenance is restricted to the IT Specialist/System
    Manager; passwords must be screen-suppressed during logon and
    re-authentication.

-   Stand-alone computer systems must be equipped with security
    enhancement controls approved and/or identified by the ISSO for
    USAID. Such enhancements must include software products or host
    dependent firmware products.

**3. Accountability/Password Controls**

-   Passwords must be randomly selected. Passwords for those people with
    special access privileges (e.g., system administrators or
    individuals with backup operator privileges) must consist of at
    least eight (8) alphanumeric characters that are not easily
    guessable or found in a standard dictionary. Passwords for users
    must consist of at least six (6) alphanumeric characters that are
    not easily guessable or found in a standard dictionary. As soon as
    systems upgrades permit, user passwords will be required to be at
    least eight (8) alphanumeric characters as well.

```{=html}
<!-- -->
```
-   Upon reaching the maximum lifetime, the operating system or security
    software must prompt the user or IT Specialist/System Manager to
    change passwords.

```{=html}
<!-- -->
```
-   The audit trail must record at least the following events and any
    other events deemed appropriate by the Program Manager,
    EXO**/ISSO**, or M/IRM \--

```{=html}
<!-- -->
```
-   Multiple logon failures;

-   Logons during non-business hours;

-   Program or file access denial;

-   Addition, deletion, or modification of users or program access
    privileges; and

-   Changes in file access restrictions.

**4.** IT Specialists/System Managers must archive the audit trail to a
file with the most stringent access restrictions available. Audit trails
containing financial information and transactions must be retained for a
period of two years. Audit trails containing information not related to
financial information and transactions must be retained for a period of
six months.

**5.** The IT Specialist/System Manager must not maintain permanent
computer system user-IDs and passwords for visitors, vendor service, or
training people. Also \--

-   The IT Specialist/System Manager must delete all default user-IDs
    and passwords supplied by the vendor during system manufacture and
    installation once installation is complete.

-   The IT Specialist/System Manager must cause all system users to
    change their passwords under the following conditions:

```{=html}
<!-- -->
```
-   At least every 90 days (30 days for dial-in access);

-   Immediately following any suspected compromise; and

-   Whenever there are changes in personnel with system security
    authority.

**6.** The IT Specialist/System Manager must immediately delete user-IDs
and passwords whenever the Program Manager, Division Chief, or
designated ISSO determine that the user no longer requires system
access; the user terminates employment with the Agency or transfers to
another office; or the user is the subject of a criminal or national
security investigation.

**7.** The IT Specialist/System Manager must provide any outside
auditors/reviewers with any application-specific information necessary
to assist in any audit/review, and must retain written documentation of
all directed changes.

**\* m. Guidance on the use of USAID-issued personal digital
assistants**

> **(PDAs) in conjunction with USAID systems and networks follows:**

**1. Although a PDA often is used as an independent \"information
system,\" these devices also can be set up to synchronize data with
standard computer terminals. Users must not physically connect
personally owned PDAs to USAID-owned systems or communication devices
within USAID facilities. If USAID issues you a PDA and you need to
connect the USAID PDA to other USAID equipment, make sure all
configuration management requirements and essential security procedures
are followed.**

> **2. Commercial Internet service providers (ISPs) of e-mail services
> may not follow all essential IS security practices. Using a
> USAID-issued PDA in conjunction with commercial ISPs can pose a high
> operational risk, and may allow unauthorized collection of sensitive
> information.**
>
> **3. Individuals may use USAID-issued PDAs (and appropriate**
>
> **related software applications) to**

-   **Process unclassified information from desktop workstations. This
    would include updating typical PDA features such as schedules,
    contact information, notes, e-mail, and other PDA data items.**

-   **Take notes, save information, or write e-mails when away from
    desktop workstations, whether down the hall or out of the country.**

-   **Synchronize information with desktop workstations.**

> **4. DO NOT USE USAID-issued PDAs for any of the following**
>
> **actions:**

-   **Do not process or maintain classified information on PDAs. There
    are currently no approved methods for clearing (sanitizing)
    classified information from these devices. If a PDA becomes
    \"contaminated\" with classified data, the user must turn the
    USAID-issued PDA over to the Office of Security.**

-   **Do not synchronize information across a network using a wireless
    connection. The configuration required to permit this functionality
    introduces unacceptable risks into a network \-- opening firewall
    ports and sending passwords in the clear. Exceptions to this
    restriction will be evaluated on a case-by-case basis and require
    written approval from the ISSO for USAID.**

> **5. USAID software security restrictions apply to these devices.**
>
> **Also, the only authorized connection through a PDA modem is to an**
>
> **official USAID remote access server (RAS) account protected by an**
>
> **authorized network control center firewall. Do not synchronize a**
>
> **PDA remotely by direct dial-in access to USAID desktops.**

**6. Users will not be issued a USAID PDA until they agree to follow all
the policy guidance outlined above.**

[]{#__RefHeading___Toc522609353 .anchor}\*545.3.2.4 Administrative
Security

Access to information systems must be restricted to individuals who
require access to perform their official duties. The level of access
granted must limit users to only the information needed to complete
assigned responsibilities. The following policies must be followed to
administer and document system access controls.

a\. Appointment of ISSOs and Alternate ISSOs \-- M/IRM must designate,
in writing, an Agency employee within IRM to serve as the ISSO for
USAID/W general support systems**.** The designee must have a TOP SECRET
security clearance and be a U.S. citizen direct-hire employee.

b\. Program Managers must designate, in writing, an ISSO and alternate
ISSO to manage the information systems security program for their
organizational entity in USAID/W. Alternates must fulfill the designated
ISSO\'s duties when the ISSO is absent. This requirement applies
regardless of the size or number of systems. Both designees must be U.S.
citizen direct-hire employees and have at least a SECRET security
clearance. Copies of the written appointments must be provided to
designee ISSOs and the ISSO for USAID, with the original retained in the
central system file. Program Managers and designated ISSOs must make
periodic checks of system hardware and/or software to ensure full
compliance with this provision and other Federal information security
laws and regulations. **The designated ISSO at USAID Missions is usually
the EXO; however, a Mission Director may appoint another U.S. citizen
with a SECRET clearance as designated ISSO instead.**

c\. Management and administration/controlling access to systems \-- The
IT Specialist/System Manager manages, administers, controls, and limits
computer system access to individuals requiring system access in the
performance of their official duties. The IT Specialist/System Manager
must limit the access of system users to the minimum level necessary to
perform their official duties.

d\. IT Specialists/System Managers, Program Managers/supervisory
management personnel, or EXOs/ISSOs must complete a USAID Computer
System Access & Termination Request form for each staff member requiring
interactive system access. **(See Mandatory Reference,** [USAID Computer
System Access & Termination Request, AID Form
545-4](http://www.usaid.gov/pubs/ads/500/refindx5.htm/a545-4)**)**

e\. The IT Specialist/System Manager must sign all USAID Computer System
Access and Termination Request forms after reviewing each form for
accuracy and technical anomalies, and retain completed forms in central
files for at least six months. For details on USAID\'s records
management program, see ADS 502, The USAID Records Management Program.
**(See Mandatory Reference,** [ADS
502](http://www.usaid.gov/pubs/ads/500/)**)**

1\. The Computer System Access & Termination Request form (AID 545-4)
must include the user\'s name, the applications the user is authorized
to access, and the type of access required within each application.
Whenever a user\'s functional responsibilities change, a new system
access request form must be completed by the Program Manager, Division
Chief, or EXO**/ISSO**.

2\. Program Managers, Division Chiefs, or EXOs/ISSOs are responsible for
authenticating and verifying the information systems access requirements
for each user under their supervision. The IT Specialist/ System Manager
must provide assistance, as necessary, in completing the USAID Computer
System Access & Termination Request form.

3\. Managers and Division Chiefs must provide the designated ISSO with
written notification of a user\'s system termination no later than one
working day after the user no longer requires system access. The
designated ISSO must forward the written notice to the IT Specialist for
action. The IT Specialist must retain user system termination
notifications in the central system file for at least six months after
the date of the user\'s removal from the system.

4\. The EXO**/ISSO** must provide the System Manager with written
notification of a user\'s system termination no later than one working
day after the user no longer requires system access. The System Manager
must retain user system termination notifications in the system\'s
central file for at least six months after the date of the user\'s
removal from the system.

f\. Prior to gaining access to any of the Agency\'s computer systems or
networks, each user must agree to abide by all Agency computer security
policies, procedures, and guidelines by signing the USAID Information
System Access Acknowledgement. **(See Mandatory Reference,** [USAID
Unclassified Information System Access Request Acknowledgement, AID Form
545-1](http://www.usaid.gov/pubs/ads/500/refindx5.htm/a545-1)**)**

g\. Program Managers (USAID/W) or EXOs/ISSOs must determine who within
their organization requires access to computer systems approved to
process SBU information. This determination must be indicated on the
USAID Computer System Access & Termination Request form. **(See
Mandatory Reference,** [AID Form
545-4](http://www.usaid.gov/pubs/ads/500/refindx5.htm/a545-4)**)**

h\. At USAID/W, the IT Specialists must terminate user system access
upon written notification by the user\'s Program Manager or Division
Chief.

i\. At Mission locations, the System Manager must terminate user system
access upon written notification by the EXO**/ISSO**.

j\. Use of Systems \-- People with access to computer systems owned or
operated by USAID must ensure the protection of information, equipment,
and facilities. **Compliance with guidance in this Chapter, and its
Mandatory References, is required of all managers and employees. In
addition, non-compliance (to include information systems security
incidents, abuse, or misuse) must be reported to the appropriate
supervisor. Supervisors must take appropriate administrative or punitive
action, after consultation with Agency Office of Human Resources and/or
General Counsel \-- if the offending user is a contractor, coordination
with the Office of Procurement usually will also be necessary. Based on
the nature of the security lapse, it may be appropriate to terminate an
individual\'s access to USAID networked IT systems until remedial ISS
training has been completed. Details on authorized use(s) of USAID IS
can be found in ADS 541, Information Management. (See Mandatory
Reference,** [ADS 541](http://www.usaid.gov/pubs/ads/500/)**)**
Violations of this section must be enforced in accordance with ADS 568,
National Security Information and Counterintelligence Security Program.
**(See Mandatory Reference,** [ADS
568](http://www.usaid.gov/pubs/ads/500/)**)**

k\. Classified information must only be entered onto a system approved
for processing such information. The creation, processing, or storage of
classified information on systems not approved for such purposes is a
security violation as defined in ADS 568, National Security Information
and Counterintelligence Security Program. The limitations against
retroactively classifying data also applies to documents prepared on
**Agency** information system equipment. **(See Mandatory Reference,**
[ADS 568](http://www.usaid.gov/pubs/ads/500/)**)**

1\. The requirements for processing classified national security
information overseas are contained in 12 FAH-6 (12 Foreign Affairs
Handbook-6, OSPB Security Standards and Policy Handbook).

2\. No classified information processing will be authorized at an
overseas Mission without the approval of the Office of Security (SEC)
and M/IRM. **(See also** [ADS 552, Classified Information Systems
Security](http://www.usaid.gov/pubs/ads/500/) for details on security
requirements for processing classified data on USAID equipment within
the United States; [ADS 562, Physical Security
Programs](http://www.usaid.gov/pubs/ads/500/)**;** and [ADS 568,
National Security Information and Counterintelligence Security
Program](http://www.usaid.gov/pubs/ads/500/)**)**

l\. Sensitive But Unclassified (SBU) data \--The designated ISSO must
advise all system users to employ the most stringent access controls
available (e.g., using password protection, or processing files on a
floppy disk using a stand-alone microcomputer) when processing SBU
information or any information concerning an individual that is legally
protected, compromising, adverse, embarrassing, or derogatory.

1\. Storage of such information on distributed or networked systems must
be minimized.

2\. More details on sensitive data can be found in Appendix III, Office
of Management and Budget (OMB) Circular A-130, Security of Federal
Automated Information Systems; 12 FAM 090 Definitions of Diplomatic
Security Terms; ADS Chapter 507, Freedom of Information Act; ADS 508,
Privacy Act; and ADS 509, Creating, Altering, or Terminating a System of
Records (Records Pertaining to Individuals). **(See Mandatory
References,**

-   [Office of Management and Budget (OMB) Circular A-130, Management of
    Federal Information
    Resources](http://www.usaid.gov/cgi-bin/goodbye?http://www.whitehouse.gov/OMB/circulars/index.html)**;**

-   [Appendix III, OMB Circular A-130, Security of Federal Automated
    Information
    Systems](http://www.usaid.gov/cgi-bin/goodbye?http://www.whitehouse.gov/OMB/circulars/index.html)**;**

-   [12 FAM 090 Definitions of Diplomatic Security
    Terms](http://www.usaid.gov/cgi-bin/goodbye?http://www.foia.state.gov/fam/)**;**

-   [ADS Chapter 507, Freedom of Information
    Act](http://www.usaid.gov/pubs/ads/500/)**;**

-   [ADS 508, Privacy Act](http://www.usaid.gov/pubs/ads/500/)**; and**

-   [ADS 509, Creating, Altering, or Terminating a System of Records
    (Records Pertaining to
    Individuals)](http://www.usaid.gov/pubs/ads/500/)

Some examples of SBU data follow:

-   Testing and evaluation materials;

-   Records specifically exempted from disclosure by statute;

-   Proprietary commercial data;

-   Deliberative process (policy development) materials;

-   Legally privileged materials;

-   Law enforcement and/or investigation files.

3\. Users must not enter or store medical information protected under
the Privacy Act of 1974 on any distributed or networked system.
Gathering, processing, storing, distributing, and safeguarding medically
privileged information is a function reserved for the U.S. Department of
State, Medical Services.

4\. Sensitive But Unclassified (SBU) Processing \--

-   Users must process SBU information on unclassified non-TEMPEST
    computer systems under conditions approved by the designated ISSO,
    in coordination with the ISSO for USAID.

```{=html}
<!-- -->
```
-   E-mail messages or attachments containing SBU information must never
    be sent or forwarded to unauthorized recipients; consider using
    means other than e-mail to transmit SBU information. All those
    entrusted by the Agency with SBU information must safeguard it;
    reasonable security measures must be implemented to ensure access to
    SBU information is restricted to authorized users or groups on the
    basis of a clearly demonstrated need to know or use. Encryption
    methodologies approved by the Agency ISSO must be used when
    transmitting SBU information over the Internet.

```{=html}
<!-- -->
```
-   SBU access must be based on need-to-know and permitted only after
    individuals are granted a favorable background investigation. The
    background investigation is conducted by the Office of Security for
    U.S. citizens and legal resident aliens, and by the Regional
    Security Officer (RSO) for foreign nationals overseas.

```{=html}
<!-- -->
```
-   SBU information must never be processed or stored in public
    directories. Whenever possible, SBU information must be stored off
    line (e.g., on floppy disks and/or removable hard drives).

```{=html}
<!-- -->
```
-   During non-duty hours, SBU information must be secured within a
    locked room or secured in a locked container. **(See Mandatory
    Reference,** [ADS 562, Physical Security Program
    (Overseas)](http://www.usaid.gov/pubs/ads/500/)**)**

```{=html}
<!-- -->
```
-   Printed materials and removable media containing SBU information
    must be marked sensitive or carry a distribution restriction
    alerting data owners and recipients of the additional protective
    measures required.

```{=html}
<!-- -->
```
-   Information systems must be certified to process, store, and print
    SBU information. System users must not originate, process, print, or
    store SBU information on computer systems not formally approved for
    that purpose.

```{=html}
<!-- -->
```
-   Before users and uncleared vendor maintenance personnel are allowed
    unsupervised access to a computer system approved to process SBU
    information, a favorable background check or U.S. Government-granted
    security clearance must be validated by the designated ISSO.

m\. Use of information systems equipment owned or operated by the Agency
for purposes other than official U.S. Government business or authorized
purposes is prohibited. For details on \"limited personal use\" see [ADS
541](http://www.usaid.gov/pubs/ads/500/) and its related reference,
**Recommended Executive Branch Model Policy/Guidance on \"Limited
Personal Use\" of Government Office Equipment Including Information
Technology.**

n\. Unattended workstations must not be left unsecured while
applications and/or sensitive files are open and/or accessible. The
designated ISSO must instruct all system users that activities occurring
when a workstation is left logged-on are the responsibility of the user.

o\. Labels indicating the highest sensitivity level of information
approved for processing on the system must be affixed to computer
devices and removable media.

-   The designated ISSO must ensure that each device associated with a
    computer system approved to process, store, or print SBU information
    is prominently labeled to indicate the level of processing
    authorized.

-   In addition to displaying the highest level of information approved
    for processing on the system, the device label must also indicate
    the name and office phone number of the designated ISSO responsible
    for the security of that piece of equipment.

-   The IT Specialist/System Manager must label all removable magnetic
    media to indicate the highest level of information approved for
    processing on the system.

-   Users are responsible for affixing labels to removable media (i.e.,
    floppy disks) indicating whether sensitive information is stored on
    that media.

p\. After-hours system operation \-- The designated ISSO and IT
Specialist/System Manager must ensure that appropriate after-hours
restrictions are developed and implemented for each of their systems.
The System Manager must ensure that all system logs in effect during
normal operations are also activated during after-hours operations.

q\. Protection of media and output \-- The IT Specialist/System Manager
must store back-up copies of operating system and application software
in a locked area or approved security container (available through
M/AS/CPD). The designated ISSO must review and approve all
facility-specific procedures for transportation and control of
electronic media. System users must ensure that reports containing SBU
information are appropriately secured in a manner commensurate with the
magnitude of loss or harm that could result from unauthorized
disclosure. Non-sensitive media under the control of system users (i.e.,
floppy disks) do not have to be secured during working hours but must be
stored out of view after hours. Media containing SBU information must be
stored as directed in 12 FAM 540. **(See Mandatory Reference,** [12 FAM
540](http://www.usaid.gov/cgi-bin/goodbye?http://www.foia.state.gov/fam/)**)**
All media must remain under the control of cleared Agency or contractor
employees during transport or be shipped via registered U.S. Mail.

r\. Monitoring system users \-- The designated ISSO must conduct reviews
of randomly selected user word processing documents, files, and floppy
disks on a monthly basis to ensure that users are adequately protecting
SBU information; archiving SBU information; maintaining SBU information
on the system for the minimum amount of time; and not processing
classified information on the system.

s\. Security Incident Reporting \-- The IT Specialist/System Manager
must document, in a system operation log, all security-related abnormal
system operations such as unexplained changes in user or program access
privileges, improper system responses to access control processes, or
other hardware or software failures that result in unauthorized
disclosure, data loss, or modification of system programs or data.

NOTE: More details on Agency Incident Response responsibilities are
contained in the Mandatory Reference, \"Incident Response Guidance for
Unclassified Information Systems.\" (See Mandatory Reference, [Incident
Response Guidance for Unclassified Information
Systems](http://www.usaid.gov/pubs/ads/500/refindx5.htm/545mad))

1\. System users discovering or suspecting incidents of fraud, misuse,
disclosure of information, destruction or modification of data, or
unauthorized access attempts must immediately report such incidents to
the designated ISSO and Program Manager (USAID/W), or to the EXO, who is
usually the designated ISSO at USAID Missions. (Note: Details on the
security incident reporting process are in the **Mandatory Reference,
Incident Response Guidance for Unclassified Information Systems, and
the** **Additional Help document, Synopsis of Security Rules of Behavior
for Users**.) **(See Mandatory Reference,** [Incident Response Guidance
for Unclassified Information
Systems](http://www.usaid.gov/pubs/ads/500/refindx5.htm/545mad)**, and
Additional Help,** [Synopsis of Security Rules of Behavior for
Users](http://www.usaid.gov/pubs/ads/500/refindx5.htm/545saf)**)**

2\. The IT Specialist/System Manager must immediately notify the
designated ISSO and Program Manager (USAID/W) or the EXO**/ISSO** of any
significant security-related, abnormal system operations. The designated
ISSO, in turn, must notify the ISSO for USAID and the Office of
Security. The ISSO for USAID, in cooperation with the designated ISSO,
must ensure that corrective actions are taken, if warranted.

3\. In the event of a serious security incident indicating data
disclosure, modification, destruction, or misuse of system resources,
the IT Specialist/System Manager must immediately make a full backup
copy of the system. If necessary, the designated ISSO must order all
system operations halted.

t\. Disposal of sensitive media, output, and equipment \-- System users
must destroy sensitive reports by burning or shredding when they are no
longer needed.

-   The IT Specialist/System Manager and designated ISSO must ensure
    that sensitive magnetic storage media used on Agency systems are not
    removed from U.S. Government-controlled premises for maintenance,
    credit, or sale unless all information on the media has been
    sanitized.

-   If a fixed disk (e.g., fixed disk, disk cartridge, or disk pack)
    cannot be returned to the vendor for credit, the IT
    Specialist/System Manager must ensure that appropriate security
    procedures are followed when returning the damaged disk to M/IRM for
    destruction.

-   The IT Specialist/System Manager must destroy other types of
    damaged, sensitive magnetic media (i.e., floppy disks and tapes) by
    burning, shredding, or using other methods approved by M/IRM
    (USAID/W) or the RSO of the host embassy or consulate.

Sensitive magnetic storage media used on Agency systems must be
overwritten using overwrite procedures approved by the ISSO for USAID or
degaussed with a magnet approved by the ISSO for USAID.

In order to follow contractual procedures for returning damaged fixed
disks to the vendor for credit, the IT Specialist/System Manager must
contact M/IRM for appropriate vendor-specific procedures. The following
is required when returning damaged disks to M/IRM for destruction:

-   Disassemble, hand-carry, or send the disks to the ISSO for USAID via
    registered U.S. Mail (USAID/W) or unclassified diplomatic pouch
    (Missions). If disassembly tools are not available, sealed removable
    hard disks must be shipped intact. Packages must be marked \"For
    Destruction.\"

```{=html}
<!-- -->
```
-   For SBU disk packs only, the disk packs must be degaussed and the
    packages sent to the ISSO for USAID marked with the appropriate
    classification. Approved degaussers for sanitizing SBU media prior
    to shipment are obtainable by contacting the ISSO for USAID
    (USAID/W), or at the Missions, the RSO of the host embassy or
    consulate.

u\. The designated ISSO must randomly review selected files, documents,
and storage media associated with information systems under the
designated ISSO\'s purview to ensure that users are not processing
classified information on equipment not approved for this purpose. All
violations noted in these reviews must be reported and processed in
accordance with the guidance set forth in **ADS 568, National Security
Information and Counterintelligence Security Program**. **(See Mandatory
Reference,** [ADS 568](http://www.usaid.gov/pubs/ads/500/)**)**

v\. Violations - system users must not originate, process, print, or
store classified information on any computer system not approved for
that purpose. Individuals violating this provision must be subject to
the security violation procedures set forth in **ADS 568, National
Security Information and Counterintelligence Security Program**. System
users must not originate, process, print, or store SBU information on
computer systems not formally approved for that purpose. Passwords to
unclassified systems and sensitive data must be afforded a degree of
protection commensurate with the magnitude of harm or loss that could
result from inadvertent or deliberate disclosure. Employees disclosing
passwords to unclassified systems are subject to administrative
sanctions or disciplinary actions. Program Managers, designated ISSOs,
and EXO**/ISSO**s must take appropriate action to ensure that security
requirements for unclassified computer systems are met by all USAID
personnel, contractors, and vendors.

1\. Unauthorized disclosure of SBU information may result in criminal
and/or civil penalties. Supervisors may take disciplinary action, as
appropriate.

2\. The Program Manager or EXO**/ISSO** is authorized to impose
administrative sanctions or disciplinary actions for failure to comply
with these regulations (except those incidents related to classified
material). The designated ISSO must investigate all known or suspected
incidents of noncompliance and inform the Program Manager or **Mission
Director** of the results of those investigations.

w\. System Maintenance \-- The IT Specialist/System Manager or an
appropriate designee must monitor vendor maintenance personnel when they
are accessing system equipment. The IT Specialist/System Manager must
maintain a log of all maintenance or service performed on the system.
The IT Specialist/System Manager must ensure that maintenance personnel
do not remove any magnetic media from Agency facilities until it has
been sanitized via degaussing or overwriting. The IT Specialist/System
Manager must prohibit maintenance personnel from running remote
diagnostics on any USAID computer system from an off-site location not
approved by the ISSO for USAID and the Telecommunications and Computer
Operations (M/IRM/TCO) Division. The maintenance log must include the
date of service, service performed, hardware or software involved,
personnel performing service, equipment removed or replaced, and system
condition or status following the service. Records must be retained for
a period of six months after the date of entry in the central system
file.

x\. Record keeping \-- Within each USAID organization, the designated
ISSO and IT Specialist/System Manager must ensure that all original
documents, logs, and records are maintained, after processing, in a
central system file for each computer system their organization is
operating. For details on USAID\'s records management program, see [ADS
502](http://www.usaid.gov/pubs/ads/500/). The following documents, logs,
and records must be maintained:

-   USAID Computer System Access & Termination Requests **(**[AID Form
    545-4](http://www.usaid.gov/pubs/ads/500/refindx5.htm/a545-4)**)**;

-   USAID Sensitive Data Nondisclosure Agreement **(**[AID Form
    545-5](http://www.usaid.gov/pubs/ads/500/refindx5.htm/a545-5)**);**

-   USAID Unclassified Information Systems Access Request
    Acknowledgements **(**[AID Form
    545-1](http://www.usaid.gov/pubs/ads/500/refindx5.htm/a545-2)**);**

-   Contingency Operation, Disaster Recovery, and Emergency Action
    Plans;

-   Copies of Waivers or Exceptions;

-   Copy of the most current Authorized Access List **(**[AID Form
    545-2](http://www.usaid.gov/pubs/ads/500/refindx5.htm/a545-2)**)**;

-   System Certification;

-   Security Reviews;

-   Designated ISSO and Alternate ISSO Appointment Documentation;

-   Annual Compliance Review **(**[AID Form
    545-3](http://www.usaid.gov/pubs/ads/500/refindx5.htm/a545-3)**)**;

-   System Operation and Maintenance Logs;

-   Computer Room Visitor Log **(**[AID Form
    545-6](http://www.usaid.gov/pubs/ads/500/refindx5.htm/a545-6)**)**;
    and

-   System Inventory.

The IT Specialist/System Manager must retain all audit trail files and
records for a period of six months. USAID Sensitive Data Nondisclosure
Agreements and USAID Unclassified Information Systems Access Request
Acknowledgements will be destroyed when the user to whom the form(s)
relate(s) terminates his or her USAID employment, when no longer
applicable, or when superseded.

y\. Security reviews \-- Each security review must address personnel,
administrative, technical, and physical security practices. **(See
Mandatory Reference,** [Unclassified Information Compliance Review, AID
Form 545-3](http://www.usaid.gov/pubs/ads/500/refindx5.htm/a545-3)**)**
The results of the review must be retained in the central system file
with a copy forwarded to the ISSO for USAID.

1\. Security evaluations must address the Program Manager\'s Office or
Mission\'s compliance with applicable Federal and Agency information
systems security policies, standards, and requirements. Each evaluation
must result in a draft report delineating the findings and
recommendations of the ISSO for USAID. The Program Manager or
EXO**/ISSO** must provide written comment on the draft report within 30
calendar days.

2\. The final report must delineate the findings and recommendations of
the ISSO for USAID, incorporate the Program Manager\'s or EXO**/**
**ISSO**\'s comments, and be distributed to the Program Manager or
EXO**/ ISSO**, M/IRM, and the Office of Security. The results of an
information systems security evaluation, which may identify USAID
vulnerabilities, must be appropriately marked for those with a
need-to-know (e.g., banner the top of each page \"Release
Restricted-Verify Need-to-Know Before Permitting Access\") in addition
to other administrative markings (such as SBU, Not Releasable to Foreign
Nationals, etc.) appropriate to the content of the document.

3\. Audit reviews must assess potential security-related incidents such
as the following: multiple logon failures; logons for after-hours use;
addition, deletion, or modification of user or program access
privileges; and changes in file access restrictions. The designated ISSO
selects additional activities for review based on Office or Mission
location and type of information processed.

4\. The designated ISSO, in conjunction with the Program Manager or
other appropriate Agency personnel, must conduct an annual review of
user and system operation practices to evaluate compliance with this
chapter. If, after review, it is determined that a security compromise
occurred, then the reporting and investigation procedures delineated in
**ADS 568**, Information and Counterintelligence Security Program, must
be followed. **(See Mandatory Reference,** [ADS
568](http://www.usaid.gov/pubs/ads/500/)**)**

5\. The ISSO for USAID is authorized to conduct or direct the conduct of
periodic security evaluations of information systems supporting the
Agency.

6\. The IT Specialist/System Manager or designated ISSO must generate
and review the audit trail of all distributed systems at least monthly.
The designated ISSO must review with the Program Manager and IT
Specialist/System Manager all security-related anomalies discovered
during audit trail reviews.

z\. Training \-- The ISSO for USAID must provide initial and
periodic/recurring system security awareness training to designated
ISSOs, Program Managers, and users in USAID/W. Other Agency employees
having security responsibilities for Agency computer systems and
networks are encouraged to request special training. The designated ISSO
must ensure that all personnel with access to systems and networks
approved to process SBU information receive initial and
periodic/recurring system security awareness training.

[]{#__RefHeading___Toc522609354 .anchor}545.3.2.5 System Operation
Requirements \-- Logs, Certification, Backup, Emergency Actions, and
Contingency Operation Planning

a\. The IT Specialist/System Manager must ensure that a system operation
log is maintained for all information systems operating under his or her
authority. The system operation log must contain a record of all normal
daily operations, system power-ups and power-downs, media mounts and
dismounts, backup and recovery operations, and general environmental
conditions. Installation, removal, or modification of system or
application software must be noted in the log. Any unusual events or
operating conditions must also be noted in the log. Logs must be
maintained in the central system file for a minimum of six months from
the date of the last entry.

b\. System Certification \-- All information systems owned or operated
by USAID in support of the Agency must be certified to operate. USAID
computer systems that do not process classified or SBU information and
that operate only in a stand-alone mode are exempt from this
requirement. Voluntary certification of unclassified/non-SBU systems is
authorized.

1\. The ISSO for USAID must assist the requesting Bureau, Office, or
Mission in the completion, coordination, and dissemination of all
required analyses, documents, forms, and processes associated with the
certification of information systems. **(See Mandatory Reference,**
[Information System Certification and Accreditation Process, Approval to
Operate](http://www.usaid.gov/pubs/ads/500/refindx5.htm/545mae)**)**

2\. The Office of Security, in coordination with the RSO where
appropriate, must assist the requesting Bureau, Office, or Mission in
determining and installing appropriate physical security controls.
**(See** [ADS 562, Physical Security
Programs](http://www.usaid.gov/pubs/ads/500/), and [ADS 565, Physical
Security Programs (Domestic)](http://www.usaid.gov/pubs/ads/500/)**)**

3\. National-level guidance on the certification and accreditation
process is contained in the **Mandatory Reference** [\"National
Information Assurance Certification and Accreditation
Process](http://www.usaid.gov/pubs/ads/500/refindx5.htm/nstissi_1000)
**(NIACAP, National Security Telecommunications and Information Systems
Security Instruction {NSTISSI} No. 1000)\"**

c\. The IT Specialist/System Manager must implement and document backup
procedures for system programs and information to ensure continuity of
operations.

d\. M/IRM/TCO, in consultation with the appropriate Program Managers,
must identify and secure, through a contractual agreement, facilities to
store backup media to ensure continuity of operations for systems
operating in USAID/W. Such facilities must be off-site and employ
appropriate environmental controls and alarm systems.

> 1\. Wherever possible the storage location must be in a U.S.
> Government facility that is separate from the building housing the
> system. The System Manager is authorized to use a secure on-site
> alternate storage location if a suitable separate location is
> unavailable. Any on-site location must be as far away from the
> information processing facility as feasible. The System Manager must
> ensure that alternate storage locations are protected from extreme
> heat, humidity, and air pollution.
>
> 2\. Backups must be securely stored on-site but as far away from the
> central processing unit as feasible. For USAID/W, off-site storage
> must be used for all backup files that are older than seven working
> days.

e\. At Mission locations, the System Manager, in consultation with the
EXO**/ISSO**, must identify a secure location to store backup media to
ensure continuity of operations for all systems and network connections
under the System Manager\'s purview.

f\. The IT Specialist/System Manager must develop a system-specific
schedule and procedure for backing up magnetic media (floppy disks for
stand-alone computer systems excluded) used on central processors.

g\. The IT Specialist/System Manager must develop emergency system
power-down procedures to be instituted in the event of general building
emergencies. Emergency system power-down procedures must be specified
for all systems under the purview of the IT Specialist/System Manager.
Each member of the system staff and the designated ISSO must receive
training from the IT Specialist/System Manager in the implementation of
these procedures and then be afforded opportunities to periodically
practice the procedures.

h\. The IT Specialist/System Manager and designated ISSO must develop
emergency action plans for each facility accommodating computer systems
they operate in USAID/W. Such plans must be coordinated with the ISSO
for USAID and be consistent with applicable Agency and local government
emergency action plans. **(See Additional Help item,** [Contingency
Planning for Information
Resources](http://www.usaid.gov/pubs/ads/500/refindx5.htm/545sae)**)**

i\. The IT Specialist/System Manager and designated ISSO at a Mission
must develop site-specific emergency action plans. **(See Additional
Help item,** [Contingency Planning for Information
Resources](http://www.usaid.gov/pubs/ads/500/refindx5.htm/545sae)**)**
The designated ISSO must retain copies of the most recent contingency
operation, disaster recovery, and emergency action plans in the central
system file; in the off-site backup storage facility and with the
executive management staff representative (USAID/W); and in the backup
media storage location and with the RSO (Missions).

j\. The IT Specialist/System Manager and designated ISSO must review,
update (if necessary), and test all emergency action plans annually, or
when significant modifications are made to system hardware, software, or
system personnel.

k\. The ISSO for USAID must develop site-specific contingency operation
and disaster recovery plans based on threat identification information
and system asset accounting and valuation data provided to the ISSO for
USAID by the IT Specialist/System Manager and designated ISSO. **(See
Additional Help item,** [Contingency Planning for Information
Resources](http://www.usaid.gov/pubs/ads/500/refindx5.htm/545sae)**)**

l\. Users must protect data processed in the stand-alone mode by making
periodic backups of all program files and data.

[]{#__RefHeading___Toc522609355 .anchor}545.3.2.6 Physical Security

Responsible personnel must adhere to the following policies to ensure
that systems approved to process SBU information are afforded the
physical protection required for that level of data.

a\. A computer system must only be approved to process SBU information
if the facility housing the system is authorized to store SBU
information and meets the standards established in [ADS 562, Physical
Security Program (Overseas)](http://www.usaid.gov/pubs/ads/500/), and
[ADS 565, Physical Security Programs
(Domestic)](http://www.usaid.gov/pubs/ads/500/). **(See Mandatory
References,** [ADS 562](http://www.usaid.gov/pubs/ads/500/) and [ADS
565](http://www.usaid.gov/pubs/ads/500/)**)**

b**.** If a compromise of SBU information is suspected, the equipment,
media, or document is to be immediately secured, and the ISSO for USAID
and Program Manager or EXO**/ISSO** orally notified as soon as feasible.
Written notification of the SBU compromise must be forwarded to these
offices within two working days of discovery. The Program Manager or
EXO**/ISSO** must arrange to provide counseling and computer security
awareness training for the offending user. If the Program Manager and/or
designated ISSO determine an investigation is warranted, the Office of
Security must be notified by the designated ISSO through the ISSO for
USAID.

c\. The designated ISSO, under the direction of the RSO at the Mission,
must conduct or direct the conduct of an end-of-day security check of
all work areas housing information systems approved to process, store,
or print SBU information.

d\. The IT Specialist/System Manager and designated ISSO must maintain a
complete and up-to-date inventory of all system components and
peripherals and their location. The inventory must be updated each time
equipment is added to or removed from the system, and must be retained
in the central system file.

e\. People are prohibited from removing U.S. Government computer systems
or media from Agency premises without the prior written approval of the
designated ISSO and Executive Management staff representative.

f\. Computer systems with removable media need not be located in locked
offices; however, the designated ISSO must instruct users to
appropriately secure removable media when not in use.

g\. People must ensure that laptop computers either remain within view
at all times or are appropriately secured. Laptop computers are not to
be checked as luggage on public transportation and are not to be used to
process classified or SBU information while in transit.

[]{#__RefHeading___Toc522609356 .anchor}545.3.2.7 Host Facility System
Security Standards

The following policies apply when SBU processing is performed either at
Agency facilities by non-Agency personnel or when Agency personnel must
process SBU information at other U.S. Government facilities, or on
systems managed by organizations outside USAID.

a\. When Agency facilities, organizations, personnel, or contractors are
hosting U.S. cleared personnel not associated with USAID and SBU
processing is required, the computer security policies and procedures of
USAID must prevail.

b\. When cleared U.S. personnel representing the Agency are processing
SBU information in U.S. Government facilities not operating under the
auspices of USAID, or on systems managed by organizations outside USAID,
the computer security policies and procedures of the host department or
agency must prevail.

c\. If there is a conflict as to which computer security policies and
procedures apply, the computer security policies and procedures of USAID
must prevail.

[]{#__RefHeading___Toc522609357 .anchor}545.3.2.8 Special Considerations
for Missions Operating in Critical Technical and Critical Human
Intelligence Threat Environments

Missions located in geographic areas bearing a critical technical and
critical human intelligence threat designation (available from the
Office of Security and ISSO for USAID on a need-to-know basis) must
operate information systems approved to process SBU information
according to the following guidance:

a\. System Access

1\. Agency personnel requiring access to system supervisory functions
must be U.S. citizens with at least a SECRET clearance.

2\. Foreign nationals must be directly supervised by a U.S. citizen with
at least a SECRET clearance during after-hours system use.

b\. Technical Security

Certain policies and procedures for system connectivity are designated
as SBU and CONFIDENTIAL information. Therefore, they are not provided in
this chapter. Location-specific policies and procedures for system
connectivity are available from the EXO**/ISSO**, RSO, or ISSO for
USAID.

c\. System Software

1\. System and application software must not be locally procured.

2\. Maintenance contractors and vendors must not use software that has
been out of U.S. Government control unless it has been reviewed and
approved by the ISSO for USAID.

3\. Foreign nationals are not permitted to program or modify system or
application software used in conjunction with distributed or networked
systems.

4\. The EXO**/ISSO** must destroy all damaged or otherwise unusable
floppy disks and tapes in accordance with approved local media
destruction procedures determined by the RSO.

[]{#__RefHeading___Toc522609358 .anchor}545.3.3 Facsimile Equipment and
Transmissions

Facsimile equipment that processes and transmits unclassified data is
especially vulnerable to monitoring; therefore to minimize the impact of
potential exposure of U.S. Government information to unauthorized
persons, Agency organizations sending and receiving facsimile
transmissions must adhere to the guidance in this section.

[]{#__RefHeading___Toc522609359 .anchor}545.3.3.1 Procurement of
Facsimile Equipment

The following guidance must be adhered to when purchasing facsimile
equipment in USAID/W and at Missions:

a\. Procurement procedures specified by the Bureau for Management,
Office of Administrative Services (M/AS) and/or M/IRM must be used to
purchase nonsecure facsimile equipment and materials intended for use in
USAID/W facilities.

b\. Local procurement procedures must be used to purchase nonsecure
facsimile equipment and materials on an off-the-shelf basis (i.e., no
special orders) at USAID Missions.

c\. All newly purchased facsimile equipment must contain internal audit
capabilities.

[]{#__RefHeading___Toc522609360 .anchor}545.3.3.2 Installation and
Repair of Facsimile Equipment

The following policies must be adhered to when facsimile equipment is
installed or repaired in USAID/W and at Missions:

a\. The designated ISSO must approve the location and installation of
all facsimile equipment.

b\. The Program Manager, designated ISSO, and/or executive management
employees are authorized to permit supervised local service vendors to
install and repair nonsecure facsimile equipment.

c\. The designated ISSO must ensure that a log is maintained of all
maintenance or service performed on facsimile equipment. The log must be
maintained by the designated ISSO in a central file.

[]{#__RefHeading___Toc522609361 .anchor}545.3.3.3 Facsimile
Transmissions

The following policies must be adhered to when transmitting or receiving
information via facsimile equipment owned or operated by USAID:

a\. Authorized Transmissions

1\. The designated ISSO must notify all facsimile users that Agency
facsimile equipment is to be used only for official business or for
authorized uses. Designated ISSOs are authorized to make periodic audits
to ensure full compliance with this provision and other Federal
information security laws and regulations.

2\. Users must transmit only unclassified, nonsensitive, nonrecord data
via nonsecure facsimile equipment.

3\. SBU information must be transmitted in compliance with 12 FAM 540.
**(See Mandatory Reference,** [12 FAM
540](http://www.usaid.gov/cgi-bin/goodbye?http://www.foia.state.gov/fam/)**)**

b\. Unauthorized Transmissions

1\. The transmission of classified material over nonsecure facsimile
equipment is a security violation. Such violations must be handled in
accordance with ADS 568, National Security Information and
Counterintelligence Security Program at USAID/W or 12 FAM 550 at USAID
Missions. **(See Mandatory References,** [12 FAM
550](http://www.usaid.gov/cgi-bin/goodbye?http://www.foia.state.gov/fam/)
and [ADS 568](http://www.usaid.gov/pubs/ads/500/)**)**

2\. The transmission of SBU data over nonsecure facsimile equipment
using unencrypted communication lines must be in accordance with 12 FAM
544 and 545. Employees transmitting SBU data using unauthorized
facsimile equipment are potentially subject to sanctions, disciplinary
actions, and/or civil and criminal penalties. **(See Mandatory
References,** [12 FAM
544](http://www.usaid.gov/cgi-bin/goodbye?http://www.foia.state.gov/fam/)**,**
[12 FAM
545](http://www.usaid.gov/cgi-bin/goodbye?http://www.foia.state.gov/fam/)**,**
and [ADS 549, Telecommunications
Management](http://www.usaid.gov/pubs/ads/500/)**)**

3\. Any facsimile user or facsimile recipient discovering or suspecting
unauthorized disclosure of information, unauthorized transmission of
data, or unauthorized facsimile use must immediately report such
incidents to the designated ISSO. At USAID/W, the designated ISSO in
cooperation with the ISSO for USAID must initiate investigative actions.
The EXO**/ISSO** at overseas organizations, in coordination with the
Office of Security, must initiate and/or coordinate appropriate
investigative actions.

[]{#__RefHeading___Toc522609362 .anchor}545.3.3.4 Administrative
Management for Facsimile Equipment

The following administrative requirements must be implemented for
facsimile equipment owned or operated by USAID:

a\. Labeling

1\. The designated ISSO must ensure that all nonsecure facsimile
equipment is clearly labeled, \"EQUIPMENT IS AUTHORIZED FOR TRANSMISSION
OF NON-SENSITIVE UNCLASSIFIED INFORMATION ONLY.\"

2\. The designated ISSO must ensure that facsimile equipment authorized
to transmit sensitive data is clearly labeled, \"AUTHORIZED FOR THE
TRANSMISSION OF SENSITIVE BUT UNCLASSIFIED INFORMATION.\"

3\. The designated ISSO must ensure that the security requirements
associated with non-sensitive unclassified facsimile transmissions are
prominently posted near all functioning nonsecure facsimile equipment.

\* 4. Users are responsible for ensuring that each outgoing facsimile
transmission clearly indicates the classification level, date and time
of transmission, subject of the document, number of pages, and the
sender\'s and addressee\'s name, organization, and facsimile and office
telephone numbers. AID Form 330-7, FACSIMILE TRANSMITTAL COVER SHEET,
may need additional modification for facsimile transmittals that contain
SBU or classified information. **(See Additional Help item,** [Sample
Facsimile Cover
Sheet](http://www.usaid.gov/pubs/ads/500/refindx5.htm/545saa)**)**

b\. Personnel Responsibility

The designated ISSO for unclassified information systems is responsible
for implementing applicable security policies for the protection of
nonsecure facsimile equipment.

c\. Internal Audit Functions

1\. Machine-generated transmission journals must indicate, at a minimum,
the date, time, number of pages forwarded, and facsimile number dialed.

2\. Machine-generated receipt journals must indicate, at a minimum, the
transmitting device\'s phone number or some other location identifier,
time, date, and number of pages sent.

3\. The designated ISSO must retain internal audit reports in a central
file for a minimum of six months, and make them available for security
reviews and audits. For details on USAID\'s records management program,
see **ADS 502**. **(See Mandatory Reference,** [ADS
502](http://www.usaid.gov/pubs/ads/500/)**)**

[]{#__RefHeading___Toc522609363 .anchor}545.3.3.5 Facsimile Gateways
Connected to Workstations or Servers

The following policies must be adhered to when facsimile gateways are
connected to client workstations or servers:

a\. IT Specialists/System Managers must ensure that the default setting
for facsimile gateways is \"access denied.\" Access to a facsimile
gateway menu, functions, and messages is to be granted only on an
individual user basis.

b\. IT Specialists/System Managers must activate and maintain operating
system-level audit trail capabilities to record facsimile gateway
activity that occurs between their system and other entities. The IT
Specialist/System Manager must also implement a facsimile transmission
log that indicates, at minimum, the time, date, point of origination and
destination, and number of pages transmitted.

1\. The designated ISSO must review the facsimile activity log at least
monthly to assess accesses, billing accuracy, and security anomalies.
The transmission log must be retained in a central file for at least six
months.

2\. The designated ISSO must inform the ISSO for USAID of all
security-related anomalies discovered during the review of facsimile
gateway logs.

c\. Facsimile gateway connections must be used only for the transmission
of non-sensitive unclassified, nonrecord data. The transmission of
classified material over facsimile gateway connections is a security
violation and must be handled in accordance with 12 FAM 550. **(See
Mandatory Reference,** [12 FAM
550](http://www.usaid.gov/cgi-bin/goodbye?http://www.foia.state.gov/fam/)**)**

[]{#__RefHeading___Toc522609364 .anchor}545.3.4 Networking and
Connectivity Security

USAID\'s policy is to protect Agency networks and systems against
unauthorized remote access. USAID permits only authorized, secure remote
connections to Agency networked systems by implementing firewall and
advanced remote user authentication technology. System Managers must
implement the controls described in this section, to the extent
permitted by contemporary technology, on all interconnected systems
within their area of responsibility.

a\. Simultaneous connections between USAID networked multi-user systems
and remote systems are not permitted, except when secured by an
appropriate firewall, advanced remote user authentication system, or a
combination of these security measures, as determined by M/IRM/TCO and
approved by the ISSO for USAID.

1\. As USAID organizations implement electronic systems that will permit
individuals or entities that deal with USAID the option to submit
information or conduct transactions with the Agency electronically, IS
security requirements must be included in all systems engineering
efforts.

2\. Specific details of the Government Paperwork Elimination Act and
guidance from the Office of Management and Budget (OMB) can be found in
the **Mandatory Reference \"The Government Paperwork Elimination Act\"
(GPEA),** [Public Law
105-277](http://www.usaid.gov/cgi-bin/goodbye?http://www.access.gpo.gov/nara/nara005.html)**;
as implemented by Office of Management and Budget (OMB) Procedures and
Guidance published May 2, 2000.**

b\. Stand-alone (single-user) systems may be connected to remote
systems. Appropriate controls, configured in accordance with
specifications determined by M/IRM/TCO and approved by the ISSO for
USAID, must be implemented to protect the availability, integrity, and
if necessary confidentiality of the information stored on the
stand-alone system.

c\. Connections, including direct, dial-in, or Internet connections,
between USAID networked multi-user systems and remote external systems
are not permitted without an appropriate firewall, advanced remote user
authentication system, or a combination of these security measures, as
determined by M/IRM/TCO and approved by the ISSO for USAID.

d\. Direct dial-in connections to the USAIDNET are not permitted except
through the use of advanced user authentication technology as determined
by M/IRM/TCO and approved by the ISSO for USAID.

e\. Direct dial-in connections to individually controlled workstations
or servers attached to the USAIDNET are not permitted. Dial-in
connections to nonnetworked (stand-alone, single-user) systems are
permitted when appropriate controls, configured in accordance with
specifications determined by M/IRM/TCO and approved by the ISSO for
USAID, are implemented to protect the availability, integrity, and if
necessary the confidentiality of the information stored on the
stand-alone system.

f\. Dial-out only connections are permitted from workstations or systems
connected to a USAID network when configured in accordance with
specifications determined by M/IRM/TCO and approved by the ISSO for
USAID.

g\. M/IRM/TCO is responsible for designating, in writing, a Network
Operations Manager, a network ISSO, and an alternate network ISSO to
manage network security concerns for the USAIDNET.

h\. The M/IRM/TCO Network Operations Manager and network ISSO are
responsible for coordinating their security-related concerns and
activities with the ISSO for USAID.

i\. All users requesting access to the USAIDNET are required to meet the
Agency\'s minimum personnel screening requirement for access to
sensitive unclassified USAID information, as defined by the Office of
Security, prior to being granted access to the USAIDNET.

[]{#__RefHeading___Toc522609365 .anchor}\*545.4 MANDATORY REFERENCES

[]{#__RefHeading___Toc522609366 .anchor}\*545.4.1 External Mandatory
References

**\*a. Relevant Federal Statutes**

1\. The Computer Fraud and Abuse Act of 1986, [Public Law
99-474](http://www.usaid.gov/cgi-bin/goodbye?http://www.access.gpo.gov/nara/nara005.html),
as amended by the National Information Infrastructure Protection Act of
1996, [Public Law
104-294](http://www.usaid.gov/cgi-bin/goodbye?http://www.access.gpo.gov/nara/nara005.html)

[\*
2](http://www.usaid.gov/cgi-bin/goodbye?http://www.access.gpo.gov/nara/nara005.html)**.**
The Computer Security Act of 1987, [Public Law
100-235](http://www.usaid.gov/cgi-bin/goodbye?http://www.access.gpo.gov/nara/nara005.html),
as amended by [Public Law
104-106](http://www.usaid.gov/cgi-bin/goodbye?http://www.access.gpo.gov/nara/nara005.html),
National Defense Authorization Act (Fiscal Year 1996) Division E,
Information Technology Management Reform (Clinger-Cohen Act), and **see
also** [44 United States Code (U.S.C.) Chapter
35](http://www.usaid.gov/cgi-bin/goodbye?http://uscode.house.gov/usc.htm)
**{Coordination of Federal Information Policy} - amended October 30,
2000, by Government Information Security Reform \[GISR\] Subtitle G of
the FY 2001 DoD Authorization Act,** [Public Law
106-398](http://www.usaid.gov/cgi-bin/goodbye?http://www.access.gpo.gov/nara/nara005.html)**.
GISR has been implemented by** [OMB M-01-08, Guidance On Implementing
the Government Information Security Reform
Act](http://www.usaid.gov/cgi-bin/goodbye?http://www.whitehouse.gov/OMB/circulars/index.html)
**(January 16, 2001).**

3\. The Electronic Communications Privacy Act of 1986, [Public Law
99-508](http://www.usaid.gov/cgi-bin/goodbye?http://www.access.gpo.gov/nara/nara005.html),
as amended

4\. The Freedom of Information Act of 1966, [Public Law
89-554](http://www.usaid.gov/cgi-bin/goodbye?http://www.access.gpo.gov/nara/nara005.html),
as amended

5\. The Government Paperwork Elimination Act (GPEA), [Public Law
105-277](http://www.usaid.gov/cgi-bin/goodbye?http://www.access.gpo.gov/nara/nara005.html);
as implemented by Office of Management and Budget (OMB) Procedures and
Guidance published May 2, 2000

6\. The Identity Theft and Assumption Deterrence Act of 1998, [Public
Law
105-318](http://www.usaid.gov/cgi-bin/goodbye?http://www.access.gpo.gov/nara/nara005.html)

7\. (Section 587 of the Fiscal Year 1999) The Omnibus Appropriations
Act, [Public Law
105-277](http://www.usaid.gov/cgi-bin/goodbye?http://www.access.gpo.gov/nara/nara005.html),
as amended

8\. The Omnibus Diplomatic Security and Anti-terrorism Act of 1986, as
amended

9\. The Privacy Act of 1974, [Public Law
93-579](http://www.usaid.gov/cgi-bin/goodbye?http://www.access.gpo.gov/nara/nara005.html),
as amended

10\. The Trade Secrets Act of 1948 & 1980, [Public Law
96-349](http://www.usaid.gov/cgi-bin/goodbye?http://www.access.gpo.gov/nara/nara005.html),
as amended

**b. Executive Orders (EOs)**

1\. [EO
12968](http://www.usaid.gov/cgi-bin/goodbye?http://www.nara.gov/fedreg/eo.html#top),
\"Access to Classified Information\"

2\. [EO
12656](http://www.usaid.gov/cgi-bin/goodbye?http://www.nara.gov/fedreg/eo.html),
\"Assignment of Emergency Preparedness Responsibilities\"

3\. [EO
12958](http://www.usaid.gov/cgi-bin/goodbye?http://www.nara.gov/fedreg/eo.html),
\"Classified National Security Information\" (as amended)

4\. [EO
13103](http://www.usaid.gov/cgi-bin/goodbye?http://www.nara.gov/fedreg/eo.html),
\"Computer Software Piracy\" as amended

5\. [EO
13011](http://www.usaid.gov/cgi-bin/goodbye?http://www.nara.gov/fedreg/eo.html),
\"Federal Information Technology\"

6\. [EO
12829](http://www.usaid.gov/cgi-bin/goodbye?http://www.nara.gov/fedreg/eo.html),
\"National Industrial Security Program\" (as amended)

7\. [EO
10450](http://www.usaid.gov/cgi-bin/goodbye?http://www.nara.gov/fedreg/eo.html),
\"Security requirements for Government employment\"

**\*c. Circulars, Handbooks, Instructions, Manuals, Regulations**

1\. DOD 5200.28-STD, \"Department of Defense Trusted Computer System
Evaluation Criteria\"

2\. Foreign Affairs Handbook, [12
FAH-6](http://www.usaid.gov/cgi-bin/goodbye?http://www.foia.state.gov/fam/)
(OSPB Security Standards and Policy Handbook)

3\. [12 Foreign Affairs Manual
090](http://www.usaid.gov/cgi-bin/goodbye?http://www.foia.state.gov/fam/),
Definitions of Diplomatic Security Terms

4\. [12 Foreign Affairs Manual
500](http://www.usaid.gov/cgi-bin/goodbye?http://www.foia.state.gov/fam/),
Information Security

5\. [National Information Assurance Certification and Accreditation
Process (NIACAP, National Security Telecommunications and Information
Systems Security Instruction {NSTISSI} No.
1000)](http://www.usaid.gov/pubs/ads/500/refindx5.htm/nstissi_1000)

\* 6. The Office of Management and Budget [(OMB) Circular
A-130](http://www.usaid.gov/cgi-bin/goodbye?http://www.whitehouse.gov/OMB/circulars/index.html)
**Management of Federal Information Resources and its** Appendix III,
Security of Federal Automated Information Resources.

7\. The Office of Management and Budget [(OMB) Circular
A-123](http://www.usaid.gov/cgi-bin/goodbye?http://www.whitehouse.gov/OMB/circulars/index.html),
Management Accountability and Control (as revised.)

8\. [32 Code of Federal Regulations (CFR) Part
2004](http://www.usaid.gov/cgi-bin/goodbye?http://www.access.gpo.gov/nara/cfr/index.html),
\"Safeguarding Classified National Security Information\" and associated
implementing guidance

[]{#__RefHeading___Toc522609367 .anchor}\*545.4.2 Internal Mandatory
References

\***a**. [AID Form
545-1](http://www.usaid.gov/pubs/ads/500/refindx5.htm/a545-1), USAID
Unclassified Information Systems Access Request Acknowledgement

**b**. [AID Form
545-2](http://www.usaid.gov/pubs/ads/500/refindx5.htm/a545-2)**,**
Authorized Access List

\***c**. [AID Form
545-3](http://www.usaid.gov/pubs/ads/500/refindx5.htm/a545-3)**,**
Unclassified Information Compliance Review

\***d**. [AID Form
545-4](http://www.usaid.gov/pubs/ads/500/refindx5.htm/a545-4)**,** USAID
Computer System Access & Termination Request

**e.** [AID Form
545-5](http://www.usaid.gov/pubs/ads/500/refindx5.htm/a545-5)**,** USAID
Sensitive Data Nondisclosure Agreement

**f.** [AID Form
545-6](http://www.usaid.gov/pubs/ads/500/refindx5.htm/a545-6)**,**
Visitors Log

**g**. [ADS 502](http://www.usaid.gov/pubs/ads/500/)**,** The USAID
Records Management Program

**h**. [ADS 507](http://www.usaid.gov/pubs/ads/500/)**,** Freedom of
Information Act (FOIA)

**i**. [ADS 508](http://www.usaid.gov/pubs/ads/500/)**,** Privacy Act -
1974

**j**. [ADS 509](http://www.usaid.gov/pubs/ads/500/), Creating,
Altering, or Terminating a System of Records (Records Pertaining to
Individuals)

**k**. [ADS 530](http://www.usaid.gov/pubs/ads/500/)**,** Emergency
Planning Overseas

**l**. [ADS 531](http://www.usaid.gov/pubs/ads/500/), Continuity of
Operations Program

**m**. [ADS 541](http://www.usaid.gov/pubs/ads/500/)**,** Information
Management

**\*n.** [ADS 543](http://www.usaid.gov/pubs/ads/500/), Corporate
Information Systems

**o.** [ADS 549](http://www.usaid.gov/pubs/ads/500/)**,**
Telecommunications Management

**p**. [ADS 550](http://www.usaid.gov/pubs/ads/500/)**, End-User
Applications**

**q**. [ADS 552](http://www.usaid.gov/pubs/ads/500/)**, Classified
Information Systems Security**

**r**. [ADS 561](http://www.usaid.gov/pubs/ads/500/)**, Security
Responsibilities**

**s.** [ADS 562](http://www.usaid.gov/pubs/ads/500/), Physical Security
Programs (Overseas)

**t.** [ADS 565](http://www.usaid.gov/pubs/ads/500/), Physical Security
Programs (Domestic)

**u.** [ADS 566](http://www.usaid.gov/pubs/ads/500/), U.S. Direct-Hire
and PASA/RSSA Personnel Security Program

**v.** [ADS 567](http://www.usaid.gov/pubs/ads/500/), Classified
Contract Security and Contractor Personnel Security Program

**w.** [ADS 568](http://www.usaid.gov/pubs/ads/500/), National Security
Information and Counterintelligence Security Program

**\*x.** [Incident Response Guidance for Unclassified Information
Systems (NEW)](http://www.usaid.gov/pubs/ads/500/refindx5.htm/545mad)

**\*y.** [Information Systems Certification and Accreditation Process,
Approval to
Operate](http://www.usaid.gov/pubs/ads/500/refindx5.htm/545mae)
(previously an Additional Help document)

**\*z**. [Information Technology Security Roles and
Responsibilities](http://www.usaid.gov/pubs/ads/500/refindx5.htm/545mac)

[]{#__RefHeading___Toc522609368 .anchor}\*545.5 ADDITIONAL HELP

\***a.** [Contingency Planning for Information
Resources](http://www.usaid.gov/pubs/ads/500/refindx5.htm/545sae)

**\*b**. [Sample Facsimile Cover
Sheet](http://www.usaid.gov/pubs/ads/500/refindx5.htm/545saa)

**\*c.** [Suggested Warning Screen
Messages](http://www.usaid.gov/pubs/ads/500/refindx5.htm/545sag)

**\*d**. [Synopsis of Security Rules of Behavior for
Users](http://www.usaid.gov/pubs/ads/500/refindx5.htm/545saf)

[]{#__RefHeading___Toc522609369 .anchor}\*545.6 DEFINITIONS

**The terms and definitions below have been included into the ADS
Glossary. See the ADS Glossary for all ADS terms and definitions. (See
ADS Glossary** [Word](http://www.usaid.gov/pubs/ads/glossary.doc) **\|**
[PDF](http://www.usaid.gov/pubs/ads/glossary.pdf) **\|**
[HTML](http://www.usaid.gov/pubs/ads/glossary.htm)**)**

# \*Accreditation

**The formal declaration by a Designated Security Approving Authority
(DSAA) that an information system (IS) is approved to operate in a
particular security mode using a prescribed set of safeguards to an
acceptable level of risk. {Source: a USAID variation of the Federal term
used in NSTISSI No. 1000} (Chapter 545)**

**audit**

To conduct the independent review and examination of system records and
activities. (Chapter 545)

**authentication**

\(1\) the verification of an individual\'s identity, a device, or other
entity in a computer system as a prerequisite to allowing access to
resources in a system;

\(2\) the verification of the integrity of data being stored,
transmitted, or otherwise exposed to possible unauthorized modification.
(Chapter 545)

**availability**

That state when information, programs and interfaces are obtainable
within an acceptable period of time. (Chapter 545)

**\*Certification**

# The comprehensive evaluation of the technical and nontechnical security features of an IS and other safeguards, made in support of the accreditation process, to establish the extent to which a particular design and implementation meets a set of specified security requirements. {Source: NSTISSI No. 1000} Note: IS is the acronym for information system; in addition, when the two terms "certification" and "accreditation" are used together, they are usually abbreviated as "C&A"; all these terms are listed in this glossary (Chapter 545)

**\*Certification Authority (CA)**

**The USAID official who certifies that a particular information system
(IS) has completed the Certification and Accreditation (C&A) process,
and is ready for "Accreditation" by the Designated Security
Accreditation Authority (DSAA). (Chapter 545)**

**Classified National Security Information (Classified Information)**

Information that has been determined pursuant to EO 12958 or any
predecessor order to require protection against unauthorized disclosure
and is marked (confidential, secret, or top secret) to indicate its
classified status when in documentary form. It is also referred to as
classified information.

a\. confidential: Information, the unauthorized disclosure of which
reasonably could be expected to cause damage to the national security
that the original classification authority is able to identify or
describe.

b\. secret: Information of which the unauthorized disclosure could
reasonably be expected to cause serious damage to the national security.

c\. top secret: Information of which the unauthorized disclosure could
reasonably be expected to cause exceptionally grave damage to the
national security. (Chapters 545, 552, 562, 566, 567)

**confidentiality**

That state when information, programs and interfaces are held in
confidence and protected from unauthorized disclosure. (Chapter 545)

**connection**

Any arrangement (intentional or otherwise) of hardware, software,
firmware, peripherals, cabling, transceivers, etc. that supports or
could enable system interoperability. (Chapter 545)

**dedicated mode**

The mode of operation in which the system is specifically and
exclusively dedicated to and controlled for the processing of one
particular type or classification of information, either for full-time
operation or for a specified period of time. (Chapters 545, 552)

**\*Designated Security Accreditation Authority (DSAA)**

A USAID official with the authority to formally assume responsibility
for operating a system at an acceptable level of risk. This term is
synonymous with "Designated Accreditation Authority - DAA" (used by most
Federal agencies); DAA also may refer to a designated accrediting
authority or a designated approving authority. {Source: This is a
USAID-specific variation on a Federal Government term included in
NSTISSI No. 9001} (Chapter 545)

**encryption**

Protecting information by encoding it through use of logarithmic coding
keys. (Chapters 545, 552)

**firewall**

A system available in many configurations providing the necessary
isolation between trusted and untrusted environments. (Chapter 545)

# \*General Support System

**An interconnected set of information resources under the same direct
management control which share common functionality. A system normally
includes hardware, software, information, data, applications,
communications, and people. A system can be, for example, a LAN
including smart terminals that supports a branch office, an agency-wide
backbone, a communications network, a departmental data processing
center including its operating system and utilities, a tactical radio
network, or a shared information processing service organization.
{Source: NSTISSI No. 1000; cites also OMB A-130} (Chapter 545)**

**identification**

The process that enables recognition of an entity by a system, generally
by the use of unique machine-readable user names. (Chapter 545)

**Information System (IS)**

The entire infrastructure, organization, personnel, and components for
the collection, processing, storage, transmission, display,
dissemination, and disposition of information. **This term includes both
automated and manual information systems; its acronym is \"IS.\"**
(Source: a variation of a term from NSTISSI 4009) (Chapters 545, 552)

**Information Technology Architecture**

The term \'\'information technology architecture\'\' means an integrated
framework for evolving or maintaining existing information technology
and acquiring new information technology to achieve the agency\'s
strategic goals and information resources management goals. (Source: 40
U.S.C. Section 1425) (Chapters 545, 552)

**Information Technology**

The term \'\'information technology\'\' means any equipment or
interconnected system or subsystem of equipment that is used in the
automatic acquisition, storage, manipulation, management, movement,
control, display, switching, interchange, transmission, or reception of
data or information. (Source: 40 U.S.C. Section 1401) (Chapters 545,
552)

**integrity**

That state when information, programs and interfaces remain free from
accidental or malicious alteration or destruction. (Chapter 545)

\*Interim Approval To Operate (IATO)

**Determination applied when a system does not meet the requirements
stated in the SSAA \[System Security Authorization Agreement\], but
mission criticality mandates the system become operational. The IATO is
a temporary approval that may be issued for no more than a one-year
period. {Source: NSTISSI No. 1000} (Chapter 545)**

**\*Major Application**

A major application means an application that requires special attention
to security due to the risk and magnitude of the harm resulting from the
loss, misuse, or unauthorized access to or modification of the
information in the application. Note: All Federal applications require
some level of protection. Certain applications, because of the
information in them, however, require special management oversight and
should be treated as major. Adequate security for other applications
should be provided by security of the system in which they operate.
{Source: NSTISSI No. 1000; cites also OMB A-130} (Chapter 545)

**Mission Critical System**

The term \"mission critical system\" means any telecommunications or
information system used or operated by an agency or by a contractor of
an agency, or other organization on behalf of an agency, that

a\. Is defined as a national security system under section 5142 of the
Clinger-Cohen Act of 1996 (40 U.S.C. 1452);

b\. Is protected at all times by procedures established for information
which has been specifically authorized under criteria established by an
Executive Order or an Act of Congress to be classified in the interest
of national defense or foreign policy; or

c\. Processes any information, the loss, misuse, disclosure, or
unauthorized access to or modification of would have a debilitating
impact on the mission of an agency. (Source: Public Law 106-398)
(Chapters 545, 552)

**National Security System**

The term \"national security system\'\' means any telecommunications or
information system operated by the United States Government, the
function, operation, or use of which

a\. Involves intelligence activities;

b\. Involves cryptologic activities related to national security;

c\. Involves command and control of military forces;

d\. Involves equipment that is an integral part of a weapon or weapons
system; or

e\. Is critical to the direct fulfillment of military or intelligence
missions. This final subcategory does not include does not include a
system that is to be used for routine administrative and business
applications (including payroll, finance, logistics, and personnel
management applications). (Source: 40 U.S.C.1452) (Chapters 545, 552)

**network**

Any collection of systems and the connections between them. (Chapter
545)

**non-Agency system**

A system that does not meet the entire definition for an Agency system,
e.g. privately owned systems and systems operated by other USG agencies,
foreign governments and private industry. (Chapter 545)

**non-sensitive information**

Any information that need not be safeguarded against disclosure, but
must be safeguarded against tampering, destruction, or loss due to
record value, utility, replacement cost or susceptibility to fraud,
waste, or abuse (Source: DOD 5200.28 / NISTIR 4659). Examples of
non-sensitive information are: Travel of the Administrator or Deputy
Administrator and all other employees to or through a medium or low
terrorist threat environment; and information, the disclosure of which,
does not adversely affect the conduct of Federal programs or the privacy
to which individuals are entitled (i.e., the information is so public it
might appear in the newspaper). (Chapter 545)

**Program Manager**

Government official responsible and accountable for the conduct of a
Government program. A Government program may be large (e.g., may provide
U.S. assistance to other nations); it may also be a support activity
such as the Agency\'s personnel or payroll program. (Chapters 545, 552)

**\*Risk**

**A combination of the likelihood that a threat will occur, the
likelihood that a threat occurrence will result in an adverse impact,
and the severity of the resulting impact. {Source: NSTISSI No. 1000}
(Chapter 545)**

**\*Risk Assessment**

**The process of analyzing threats to and vulnerabilities of an IS
\[information system\] and the potential impact the loss of information
or capabilities of a system would have on national security. The
resulting analysis is used as a basis for identifying appropriate and
cost-effective countermeasures. {Source: NSTISSI No. 1000} (Chapter
545)**

**\*Risk Management**

**The process concerned with the identification, measurement, control,
and minimization of security risks in information systems to a level
commensurate with the value of the assets protected. {Source: NSTISSI
No. 1000} (Chapter 545)**

**\*Security Test and Evaluation (ST&E)**

**The examination and analysis of the safeguards required to protect an
IS \[information system\], as they have been applied in an operational
environment, to determine the security posture of that system. {Source:
NSTISSI No. 1000} (Chapter 545)**

**Sensitive Information (also referred to as Sensitive But Unclassified
(SBU))**

Information that requires protection due to the risk and magnitude of
loss or harm that could result from inadvertent or deliberate
disclosure, alteration, or destruction of the data. The term includes
data whose improper use or disclosure could adversely affect the ability
of the Agency to accomplish its mission, proprietary data, records
requiring protection under the Privacy Act, and data not releasable
under the Freedom of Information Act. It is also certain sensitive
official information and material which is not national security
information, and therefore, is not classifiable, but nevertheless
warrants a degree of protection. Such information or material may
include, among other things, information received through privileged
sources and certain personnel, medical, investigative, commercial, and
financial records. Material of this type which requires protection and
limited dissemination shall be designated by any official having signing
authority for the material. (Chapters 545, 552, 562, 566, 567)

**STU-III**

Secure Telephone Units (Chapter 545)

**system**

An assembly of hardware and software configured for the purpose of
processing, transmitting and receiving, storing and retrieving data; a
system may include microcomputers, facsimiles, private branch exchanges,
gateways and firewall equipment of any sort. (Chapter 545)

**\*System Security Authorization Agreement (SSAA)**

# The SSAA is a formal agreement among the DSAA(s), certifier, IS user representative, and the program manager. It is used throughout the C&A process to guide actions, and to document decisions, security requirements, certification tailoring and level-of-effort, certification results, certifier's recommendation, and the approval to operate. {Source: NSTISSI No. 1000} Note: C&A is the acronym for Certification and Accreditation; DSAA is the acronym for Designated Security Accreditation Authority; and IS is the acronym for information system(s), all these terms are listed elsewhere in this glossary. (Chapter 545)

**TEMPEST**

The investigation, study, and control of compromising electromagnetic
emanations from telecommunications and IS equipment. Sometimes refers to
system components that use approved emanation suppression/containment
systems for the processing and storage of classified national security
information. (Chapters 545, 552, 562)

**unclassified information**

A category of information which includes both Sensitive But Unclassified
(SBU) and non-sensitive information and materials which at a minimum
must be safeguarded against tampering, destruction, or loss. SBU
information and materials must also be afforded additional protections
commensurate with the sensitivity level of the data involved. (Chapter
545)

**USAID system**

A system funded by the Agency and operated by or for the Agency and
located in space owned or directly leased by the Agency or another
agency of the USG. (Chapter 545)

\*Validation

**The process of applying specialized security test and evaluation
procedures, tools, and equipment needed to establish acceptance for
joint usage of an IS \[information system\] by one or more departments
or agencies and their contractors. {Source: NSTISSI No. 1000} (Chapter
545)**

**\*Verification**

**The process of comparing two levels of an IS \[information system\]
specification for proper correspondence, e.g., security policy model
with top-level specification, top-level specification with source code,
or source code with object code. {Source: NSTISSI No. 1000} (Chapter
545)**

**\*Vulnerability**

**A weakness (or weaknesses) in an IS \[information system\], system
security procedures, internal controls, or implementation that could be
exploited. {Source: NSTISSI No. 1000} (Chapter 545)**

**\*Vulnerability Assessment**

**A systematic examination of an IS \[information system\] or product to
determine the adequacy of security measures, identify security
deficiencies, provide data from which to predict the effectiveness of
proposed security measures, and confirm the adequacy of such measures
after implementation. {Source: NSTISSI No. 1000} (Chapter 545)**

545_062601_w081601