**VOLPE CENTER ORDER 1370.4B**

Subject: NETWORK AND COMPUTER-BASED INSTITUTIONAL APPLICATIONS POLICY

Date: 12-JUL-02

OPI: Computer Center

1.  [PURPOSE]{.underline}

This Order establishes the policy for connection to and use of the Volpe
Center's Local Area Network (LAN) as well as for support of that LAN and
the personal computers (PCs) attached to it. It includes provisions to
ensure these connections do not adversely impact the security and
performance aspects of the Volpe Center\'s Information Technology (IT)
infrastructure and of the systems and data that can be accessed through
that infrastructure.

2.  [APPLICABILITY]{.underline}

This Order applies to all Volpe Center employees, onsite contractors,
and all other users of the Volpe Center LAN (Volpe Private Network).

3.  [CANCELLATION]{.underline}

Volpe Center 1370.4A, LOCAL AREA NETWORK (LAN) AND PERSONAL COMPUTER
(PC) POLICY, of 1/14/97.

4.  [REFERENCE]{.underline}

Departmental Information Resource Management Manual (DIRMM), DOT Order
1350.2, of 1/31/02.

5.  [BACKGROUND]{.underline}

In the late 1980s, the Volpe Center implemented its first campus LAN
primarily to provide access from a limited number of remote locations
within the Volpe Center to applications housed in the Volpe Data Center.
In the early 1990s, this network was widely expanded to allow general
use of e-mail by on-site Volpe Center and contractor staff. This, in
turn, was quickly followed by what has been called in the industry the
"networking revolution" with the Volpe Center LAN being expanded even
further and becoming a "mission critical" resource to the Center. That
expansion has included providing on-site staff with access to the
Internet, to the Volpe Intranet (VolpeNet), to wide area links to the
Department and Volpe Center customers, to application systems maintained
both within the Data Center and elsewhere, and to each other through
collaborative software applications. Most recently, the LAN has been
part of the chain that provides Volpe customers access to data and
applications managed for them at the Center.

6.  [POLICY]{.underline}

As a "mission critical" resource, the Volpe Center LAN will:

-   Be used for only officially authorized purposes;

-   Be available to authorized users to perform their official duties;

-   Meet required performance levels;

-   Provide adequate protection for all sensitive systems, data, and\
    resources; and

-   Comply with departmental network security policy and guidelines.

7.  [RESPONSIBILITIES]{.underline}

> a\. Network Administrator
>
> The Network Administrator in the Computer Center will administer the
> Volpe Center Backbone Local Area Network, associated Wide Area
> Networks, and support for institutional computer-based applications
> (desktop and server). Specifically, the Network Administrator\'s
> responsibilities include:
>
> \(1\) LAN Modifications
>
> The Network Administrator will:

-   Approve any modifications to be made to the Volpe Center LAN based
    on a review of the business case, architecture, and security
    implications;

-   Manage the implementation of LAN modifications; and

-   Ensure that the modified LAN meets all operational requirements
    including those related to security.

> \(2\) PC/Server Connectivity to the LAN
>
> The Network Administrator will:

-   Be the approving authority for connection of any PC or server to the
    network;

-   Provide registration services for those that are approved (through
    the Helpdesk) including providing a network address;

-   Be the approving authority to permit changes to any registered PC or
    server connected to the network;

-   Conduct an initial security assessment as a gating element to
    allowing physical connection to the network;

-   Conduct on-going assessments to identify any new security
    vulnerabilities in any server/PC connected to the LAN; and

-   Disconnect any server/PC that is not formally registered, does not
    meet Volpe standards, or is found to be configured in a way that is
    not in the best interest of the Volpe Center.

> \(3\) Other Connections
>
> The Network Administrator will:

-   Approve the connection of any wireless LAN, modem, DSL Internet
    Connection, Cable Internet Connection, Network Enabled Device, Wide
    Area Network, or other type of external network connection to the
    Volpe Center LAN;

-   Approve the request for implementation of any Remote Access Service
    (RAS) facility connecting to the Volpe LAN; and

-   Approve any individual use of any RAS.

> \(4\) LAN/PC Support
>
> The Network Administrator and his technical support team will provide
> services to Volpe organizational entities, as follows:

  ----------------------- ----------------------------- ------------------------
  [Support                [Personnel                    [Comments]{.underline}
  Area]{.underline}       Supported]{.underline}        

  LAN Backbone and        Volpe Center employees and    Contractors included
  Servers                 onsite contractors            

  Connectivity for        Office Directorates (1-80),   Onsite contractors
  Directorate Servers and Deputy Director, and          excluded
  PCs                     Administrative Staff          

  Division PCs and        Division Office Staff and all Onsite contractors
  Institutional           Administration Staff          excluded
  Applications                                          

  Stand-alone             Volpe Center employees        Onsite contractors
  Workstations                                          excluded
  ----------------------- ----------------------------- ------------------------

> Support will cover installation, operation, maintenance, and trouble
> shooting of hardware and software as well as connectivity to the LAN.
> Software support will be limited to the current products that the
> Network Administrator has identified as "standard." Volpe Center
> standards will be provided on an annual basis, or as needed, in a
> Volpe Center Announcement.
>
> The Network Administrator will establish and operate a central
> Helpdesk through which required support will be provided.
>
> \(5\) Independent LANs
>
> LANs independent of and isolated from the Volpe Center LAN are the
> responsibility of the initiating organization. However, if there is a
> future requirement for connection of such LANs to the Volpe Center
> LAN, the Network Administrator and the Volpe Information Systems
> Security Officer (ISSO) must review and approve those plans in
> accordance with this Order and Volpe Order 1640.5A (Computer Security
> Program).
>
> b\. Chief, Facilities Management Division
>
> The Chief of the Facilities Management Division will review all
> approved plans for wiring changes associated with the LAN for
> adherence to OSHA and other requirements in accordance with Volpe
> Center LAN policies and procedures.
>
> c\. Volpe Center LAN Users
>
> Authorized LAN users must:

-   Register a network device (i.e., PCs, servers)or any application
    which requires network changes or modifications with the Network
    Administrator (through the Helpdesk) and obtain approval before
    connecting it to the Volpe LAN;

-   Inform the Network Administrator (through the Helpdesk) when
    planning changes to a connected device and follow the process
    defined for maintaining the approval for an altered connection;

-   Provide a System Security Plan (SSP)and receive formal certification
    from the Volpe ISSO for any application system that will run on a
    server directly connected to the LAN;

-   Ensure that any approved/registered network-connected devices
    connect only to the Volpe Center LAN and not to another network
    (Telework network connectivity guidelines will be addressed in the
    Telework policy); and

-   Refrain from using network "sniffers," "probes", or any other
    network monitoring hardware-software that would be directly
    connected to the Volpe Private Network.

> Edith Boyden
>
> Executive Director, Office of Strategic Programs and Resources