+--------+-------------------------------------------+-------+-------+
| ![]    | ## NATIONAL LABOR RELATIONS BOARD         | **    | **\_  |
| (media |                                           | CHAPT | \_\_\ |
| /image | **ADMINISTRATIVE POLICIES AND PROCEDURES  | ER:** | _\_\_ |
| 1.png) | MANUAL**                                  |       | \_\_\ |
|        |                                           | **    | _\_** |
|        |                                           | [IT-1 |       |
|        |                                           | ]{.un | *     |
|        |                                           | derli | *REVI |
|        |                                           | ne}** | SED** |
|        |                                           |       |       |
|        |                                           | **E   | **D   |
|        |                                           | FFECT | ATE** |
|        |                                           | IVE** |       |
|        |                                           |       |       |
|        |                                           | **D   |       |
|        |                                           | ATE** |       |
|        |                                           |       |       |
|        |                                           | 04/   |       |
|        |                                           | 02/03 |       |
+--------+-------------------------------------------+-------+-------+
| Su     |                                           |       |       |
| bject: |                                           |       |       |
|        |                                           |       |       |
| ## C   |                                           |       |       |
| OMPUTE |                                           |       |       |
| R SECU |                                           |       |       |
| RITY P |                                           |       |       |
| ROGRAM |                                           |       |       |
|        |                                           |       |       |
| *      |                                           |       |       |
| *INFOR |                                           |       |       |
| MATION |                                           |       |       |
| S      |                                           |       |       |
| YSTEMS |                                           |       |       |
| SE     |                                           |       |       |
| CURITY |                                           |       |       |
| POLICY |                                           |       |       |
| (      |                                           |       |       |
| INFOSY |                                           |       |       |
| SEC)** |                                           |       |       |
+--------+-------------------------------------------+-------+-------+

**CHAPTER PAGE**

Foreward

1.  Chapter 1. Security Management Program
    ......................................... 4

2.  Chapter 2. Security Requirements
    .................................................... 6

3.  Chapter 3. Network Security Controls
    ............................................... 8

4.  Chapter 4. Media Disposal and Use
    .................................................. 12

5.  Chapter 5. Roles and
    Responsibilities................................................. 13

6.  Chapter 6.
    References.....................................................................
    14

**NOTE:** This APPM Chapter will not be issued in the standard APPM
Chapter format.

# FOREWORD

[PURPOSE]{.underline}. This document establishes responsibilities and
authorities for the implementation and protection of National Labor
Relations Board (NLRB) Information Technology (IT) systems that store,
process or transmit classified and unclassified information. All IT
systems (data processing functions to include applications and support
platforms) shall be designated, at a minimum, to process Sensitive But
Unclassified (SBU) information.

[BACKGROUND]{.underline}. The Office of Management and Budget (OMB)
policy states that each federal Agency must:

-   Assure that systems and applications operate effectively and provide
    appropriate confidentiality, integrity, and availability; and

-   Protect information commensurate with the level of risk and
    magnitude of harm resulting from loss, misuse, unauthorized access,
    or modification.

-   Report annually on the status of the IT Security program.

-   Provide quarterly Plan of Action and Milestones (POAM) detailing the
    deficiency identified and providing a recommendation for correcting
    the deficiency.

> The NLRB is committed to establishing and maintaining an IT Security
> Program that will secure the Agency's information and system assets
> accordingly.

[SCOPE]{.underline}. This policy applies to all NLRB personnel (to
include government and contract personnel). The policy applies to all IT
systems, to include hardware, software, media, and facilities. This
policy also applies to any outside organizations, or their
representatives, who are granted access to NLRB IT resources, including
other Federal agencies.

[CANCELLATION]{.underline}. Reserved

[AUTHORITIES]{.underline}. The Chief of IT Security is responsible for
providing guidance, implementation and oversight for this policy.

[REFERENCES]{.underline}. References to various regulations and laws
applicable to the responsibilities of IT security are located in CHAPTER
6.

[DEFINITION OF TERMS]{.underline}. The National Information Systems
Security (INFOSEC) Glossary provides definitions applicable to NLRB IT
policies.

TABLE OF CONTENTS

> [Page No.]{.underline}

CHAPTER 1. SECURITY PROGRAM MANAGEMENT 4

1.  Information Technology Security Program 4

2.  Information Technology Security Reporting Requirements 4

3.  Repercussions for Non-Compliance 4

4.  Information Technology Security Education, Awareness and Training 4

5.  Computer Incident Response Capability 4

6.  Information Technology Security Life Cycle 4

7.  Certification and Accreditation 4

8.  Security Assurances 5

9.  Continuity of Operations Planning 5

10. Software Licenses and Use 5

11. Configuration Management 5

12. Privacy 5

13. Procurement 5

CHAPTER 2. SECURITY REQUIREMENTS 6

1.  System Sensitivity Designation and Mode of Operation 6

2.  Access Control 6

3.  Identification and Authentication 6

4.  Password Management 6

5.  Accountability and Audit Trails 6

6.  Warning Banner 6

7.  Classified Information 7

8.  Assignment of System Responsibilities/Permissions 7

9.  Personnel Security 7

10. Physical and Environmental Security 7

11. Storage and Marking 7

12. Data Integrity 7

CHAPTER 3. NETWORK SECURITY CONTROLS 8

1.  Network and Computer Connections to Non-NLRB entities 9

2.  Automatic Forwarding 9

3.  Security Architecture 9

4.  Portable Devices 9

5.  Boundary Protection Devices 9

6.  Virus Control 9

7.  Intrusion Detection Systems 9

8.  Encryption 10

9.  Mobile Code 10

10. Wireless Networks 10

11. Private Branch Exchange Security 10

12. Facsimile 11

CHAPTER 4. MEDIA DISPOSAL AND REUSE 12

1.  Media Disposal 12

2.  Media Reuse 12

CHAPTER 5. ROLES AND RESPONSIBILITIES 13

1.  Chief Information Officer 13

2.  Chief, Information Technology Security 13

3.  Heads of Offices 13

4.  Users 13

CHAPTER 6. REFERENCES 14

CHAPTER 1. SECURITY PROGRAM MANAGEMENT.

1.  [INFORMATION TECHNOLOGY SECURITY PROGRAM.]{.underline} The NLRB is
    responsible for the development, implementation and maintenance of
    an IT Security Program that satisfies all applicable federal
    requirements.

2.  [INFORMATION TECHNOLOGY SECURITY REPORTING
    REQUIREMENTS]{.underline}. The NLRB is required to report annually
    to the Office of Management and Budget (OMB) on the status of the IT
    Security Program initiatives. These initiatives include:

    -   [Certification and Accreditation (C&A)]{.underline}. Date each
        Agency system was C&A'd, the dates of the latest C&A for each
        operational system, and the projected dates for C&A's to be
        completed for operational systems.

    -   [Inventory of systems.]{.underline} An up-date list of all
        software and hardware components (both developmental and
        operational).

    -   [External Network Connections and Wireless Local Area Network
        (LANS)]{.underline}. The identity of all systems connected to
        NLRB systems or accessed by NLRB employees used for official
        business. We are responsible for ensuring all vulnerabilities
        have been addressed.

    -   [Annual IT Security Assessment]{.underline}. The IT Security
        Program is responsible for evaluating all systems protection
        mechanisms and reporting deficiencies. The report shall include
        actions and milestones for addressing any identified
        deficiencies.

    -   [Annual IT Security Awareness Training]{.underline}. NLRB is
        responsible for reporting the statistics associated with annual
        IT Security awareness training. Statistics include total number
        of employees and number of employees receiving training.

3.  [REPERCUSSIONS FOR NON-COMPLIANCE]{.underline}. The CIO may take
    appropriate action to restrict IT operations and IT funding of any
    system in the event non-compliance with Agency IT security policies
    is identified.

4.  [INFORMATION TECHNOLOGY SECURITY EDUCATION, AWARENESS and TRAINING
    (ITSEAT).]{.underline} NLRB is responsible for establishing an IT
    security awareness, training, and education program, which comply
    with NIST Special Publication 800-16.

5.  [COMPUTER INCIDENT RESPONSE CAPABILITY (CIRC)]{.underline}. NLRB is
    responsible for reporting applicable incidences to the Federal
    Computer Incident Response Center (FEDCIRC). The Chief of IT
    Security shall establish the NLRB Computer Incident Response
    Capability process (NLRBCIRC). The NLRBIRC is responsible for
    providing guidance in reporting incidences and time frames for
    reporting incidences.

6.  [INFORMATION TECHNOLOGY SECURITY LIFE CYCLE (SDLC)]{.underline}.
    NLRB is responsible for the development of an Agency System
    Development Life Cycle (SDLC). All systems must comply with and be
    consistent with the Agency established SDLC.

-   All Agency systems must include IT security as part of their SDLC
    process (refer to the NLRB SDLC guidelines.)

-   System data sensitivity, security requirements, boundaries, data
    owners and interconnections must be identified before starting
    formal development of a new system and shall be consistent with the
    time frame outlined in the SDLC.

-   All systems must have a security plan in accordance with NLRB
    guidelines (NLRB follows the NIST Special Publication 800-18
    guidelines).

-   A configuration management process shall be in place to maintain
    control of changes to any system.

-   A risk management process shall be implemented to assess the risks
    to IT systems and to determine adequate security for the system by
    analyzing threats and vulnerabilities. Risk assessments will be
    performed in accordance with NLRB guidelines (NLRB follows the NIST
    Special Publication 800-30.)

7.  [CERTIFICATION AND ACCREDITATION (C&A)]{.underline}. All systems
    within the Agency must have an accreditation prior to operation.
    Prior to obtaining an accreditation, the C&A process must be
    completed. The accreditation is a formal declaration by a Designated
    Approving Authority (DAA) that an IT system is approved to operate
    in a particular security mode using a prescribed set of safeguards
    at an acceptable level of risk. The certification is a comprehensive
    evaluation of the technical and non-technical security features of
    an IT system and other safeguards (e.g., physical, personnel,
    procedural, and environmental) to establish the extent to which a
    particular design and implementation meet a set of specified
    security requirements. Each system must be re-accredited every three
    years or when significant security relevant changes are made, that
    are not captured in the system development life cycle process. The
    Agency requires that all systems are to be C&A'd prior to operation.

-   All systems shall be certified and accredited in accordance with the
    NLRB Guidelines (NLRB follows the NIST Special Publication 800-37)
    prior to being placed into operation. Therefore, until an IT system
    is certified and

    accredited, operational data should not be used, including testing
    in pilot systems. If live data is used or if the pilot system is to
    be connected to an Agency network, a waiver must be obtained by the
    CIO.

```{=html}
<!-- -->
```
-   A Certification Official shall be identified for each system.

-   The Designated Approving Authority (DAA) will assume responsibility
    for operating a system in a particular security mode using a
    prescribed set of safeguards to an acceptable level of risk.

-   When operational need or mission criticality require a system to
    become operational and the system does not provide adequate
    safeguards, the DAA may grant an accreditation with conditions.

8.  [SECURITY ASSURANCES]{.underline}. All IT systems shall be examined
    for security prior to being placed into operation. All IT systems
    shall have safeguards in place to detect and minimize inadvertent or
    malicious modifications or destruction of the IT system.

-   All hardware and software procured and/or developed shall be
    reviewed and tested to ensure there are no features that might be
    detrimental to the security of an Agency infrastructure.

-   A Security Test and Evaluation (ST&E) of each IT system shall be
    conducted to validate security requirements are satisfied.

9.  [CONTINUITY OF OPERATIONS PLANNING (COOP)]{.underline}. The NLRB is
    responsible for ensuring all IT systems shall have a continuity of
    operations plan prepared in the event of loss or failure in
    accordance with NIST Special Publication 800-34. This ITB shall:

-   Ensure a continuity of operations plan (COOP) for each general
    support system and major application is prepared.

-   Ensure a site plan that details responses to emergencies for IT
    facilities exists.

-   Ensure the COOP has been tested prior to implementation and after
    any changes to the environment that would alter the in-place
    assessed risk.

10. [SOFTWARE LICENSES AND USE]{.underline}. All IT systems shall be
    compliant with applicable NLRB policies and copyright laws.

11. [CONFIGURATION MANAGEMENT]{.underline}. All IT systems shall follow
    ITB configuration management. Each system shall:

-   Have a change control process established for each system.

-   Have all changes documented and tested before being modified such
    that new vulnerabilities are not introduced into the operational
    environment.

-   Have configuration information updated. The C&A package shall
    include an updated system security plan, risk assessment, COOP, etc.

12. [PRIVACY.]{.underline} Privacy issues will be considered when
    requirements are being analyzed and decisions are being made about
    what data is actually necessary, how data will be used once
    collected, and how data will be protected in the system design. A
    Privacy Impact Assessment (PIA) must be conducted and documented for
    any new information system or modification to an existing system.
    The Agency's policy on the use of PIAs is [not]{.underline} derived
    from requirements under the Privacy Act, but rather from a
    commitment by the Agency to take privacy issues into account when
    developing computer systems. In addition, conducting a PIA does
    [not]{.underline} absolve the requirement of publishing a Privacy
    Act System notice if one is required.

-   A privacy policy statement shall be posted on each NLRB web site.

13. [PROCUREMENT.]{.underline} All proposal or technical specification
    for IT security/operations services or products will include
    contractual requirements from the Federal Acquisition Regulations
    (FAR). Appropriate security requirements for the services being
    procured will be specified in all Statements of Work. Contractual
    requirements for position risk level determination shall be included
    in contract clauses for computer security operations services.
    Contract requirements must specify physical security reviews of
    contractor facilities of an off site contractor, restrictions on
    access to privileged information, and a means to monitor and
    evaluate contractor requirements, qualifications, and performance.

    1.  CHAPTER 2. SECURITY REQUIREMENTS.

        1\. [SYSTEM SENSITIVITY DESIGNATIONS AND MODE OF
        OPERATION]{.underline}. All IT systems shall be categorized with
        a system sensitivity designation and mode of operation.
        Dedicated Security Mode and System High Security Mode are the
        only modes of operation authorized.

-   All IT systems that process unclassified information shall be
    designated as a minimum Sensitive But Unclassified (SBU).

-   All IT systems that process litigation sensitive information shall
    be designated by the highest classification, and category of
    information processed.

2.  [ACCESS CONTROL]{.underline}. Access controls shall be in place and
    operational for all NLRB IT systems in accordance with NLRB Access
    Control and Password Management Guidelines.

3.  [IDENTIFICATION AND AUTHENTICATION (I&A)]{.underline}.
    Identification and authentication methods (passwords, tokens,
    biometrics, etc) shall be commensurate with the risk of compromise.
    All NLRB IT systems shall:

-   Identify every individual user as unique.

-   Authenticate a user before allowing access to system resources.

-   Comply with the NLRB Access Control/Password Management guidelines.

-   Store passwords, algorithms, keys, certificates, codes, or other
    schemes that are used, maintained, or managed by the system for
    authentication purposes in a manner that prevents unauthorized
    individuals from gaining access to them.

4.  [PASSWORD MANAGEMENT]{.underline}. Agency IT systems shall implement
    the following minimum features:

-   Prevent the capture and viewing of passwords through operating or
    application system features that may allow an individual access to a
    clear text password or a password in any form that can be
    regenerated, unless it is used solely for the monitoring of user
    compliance with password policy and approved by the DAA.

-   Require technical implementation to support the NLRB Access Control
    Standards/Password Management guidelines.

-   Disable system default passwords as soon as possible after system
    installation and before the system becomes operational.

-   Restoration of passwords shall be in accordance with approved NLRB
    guidelines.

-   Store passwords in an encrypted form.

-   Encrypt passwords during network transmission.

-   Disable user accounts after no more than three consecutive invalid
    attempts are made to supply a password, and require the
    reinstatement of a disabled user account by a system administrator.

5.  [ACCOUNTABILITY AND AUDIT TRAILS]{.underline}.

-   Agency IT systems shall:

    -   Use automated tools to review audit records in real or near real
        time.

    -   Maintain an audit trail of activity sufficient to reconstruct
        security relevant events.

    -   Include in the audit trail the identity of each entity accessing
        the system, time and date of the access, time and date the
        entity terminated access, activities performed using an
        administrator's identification, and activities that could
        modify, bypass, or negate the system's security safeguards.

    -   Protect the audit trail from actions such as unauthorized
        access, modification, and destruction that would negate its
        forensic value.

    -   Retain the audit trail for a period of 90 days, the minimum
        record retention period specified by the office, or the period
        specified in the system security plan, whichever is longer.

```{=html}
<!-- -->
```
-   Audit trails shall be reviewed in compliance with the review period
    specified for the audit trail in the system's security plan.

-   IT systems operating in the Dedicated Mode of Operation or in a
    stand-alone environment that do not implement an audit trail must be
    justified and documented in the risk analysis and C&A process.

6.  [WARNING BANNER]{.underline}. All Agency IT systems shall implement
    a system banner for establishing the "knowingly" and "with intent"
    provisions of Title 18 U.S.C. Section 1030 and display such a banner
    at a point prior to the user signing onto the system.

7.  [CLASSIFIED INFORMATION]{.underline}. The NLRB has not identified
    the need to process "Classified" information as defined by the
    National Security standards. However for those individuals having a
    need to handle "Classified" information, guidance can be provided by
    the Chief of IT Security.

8.  [ASSIGNMENT AND SEGREGATION OF SYSTEM
    RESPONSIBILITIES/PERMISSIONS]{.underline}. Agency IT systems shall
    have assignment and segregation of system responsibilities defined
    and documented.

-   At a minimum, there shall be a clearly defined role for a security
    officer and a system administrator.

    -   The security officer is responsible for ensuring that the
        adding, changing, and deleting of users and the user\'s system
        access privileges are in accordance with NLRB policies. In
        addition, they are responsible for viewing and archiving
        security logs and audit trails.

    -   System administrators may view security logs and may add,
        change, or delete users and their system access privileges.

-   Controls shall be in place to ensure that the user has access to
    only the resources required to accomplish their duties and no more.

-   Controls used to implement and enforce roles shall be compliant with
    the NLRB Access Control/Password Management guidelines.

9.  [PERSONNEL SECURITY]{.underline}.

-   Agency personnel and non-Agency personnel, including but not limited
    to contractors, shall have personnel security clearances
    commensurate with the highest level of information processed by the
    system pursuant to the provisions of Agency directives and shall be
    documented in the system security plan. The security plan will also
    document the security aspects of hiring, terminating and
    transferring employees, and assessing their job performance.

-   For all Agency IT systems the office shall:

```{=html}
<!-- -->
```
-   Review and classify each assignment of system responsibility as a
    position in terms of its sensitivity, in accordance with Agency
    personnel policies.

-   Ensure that an appropriate background investigation has been
    conducted on individuals who fill each position, in accordance with
    Agency personnel policies.

-   Foreign Nationals shall not access or assist in the development,
    operation, management or maintenance of Agency IT systems, unless
    the CIO has granted a waiver.

10. [PHYSICAL AND ENVIRONMENTAL SECURITY]{.underline}.

-   Agency IT systems shall be physically protected commensurate with
    the highest classification or sensitivity of the information and in
    accordance with federal guidelines (NIST 800-18 and FIPS 31).

-   Agency IT systems shall be environmentally protected, and the means
    for providing this protection shall be documented.

-   Facilities supporting large scale IT operations, such as enterprise
    servers and telecommunication facilities, require consideration of
    additional environmental and physical controls as determined by a
    risk analysis.

11. [STORAGE AND MARKING]{.underline}. IT systems and electronic media
    shall be protected and marked in accordance with the data
    sensitivity and to the highest classification level authorized.

-   Users shall not store data on electronic media that cannot be
    adequately secured against unauthorized access.

12. [DATA INTEGRITY]{.underline}. Data integrity and validation controls
    shall be used to provide assurance that information has not been
    altered and that the system functions as intended. Reconciliation
    routines (i.e. integrity verification programs, checksums, hash
    totals, record counts) shall be used by applications to look for
    evidence of data tampering, errors, and omissions. Where
    appropriate, message authentication will be used by applications to
    ensure that the sender of the message is known and that the message
    has not been altered.

CHAPTER 3. NETWORK SECURITY CONTROLS.

1\. [NETWORK AND COMPUTER CONNECTIONS AND CONNECTIONS TO NON-AGENCY
ENTITIES]{.underline}.

-   Connections to external networks (such as the Internet), dial-in and
    dial-out facilities and services, and dedicated connections to other
    government, public, or private entities shall be obtained through
    resources provided by Information Technology Branch (ITB) or
    approved by the CIO.

-   All connections to networks and systems that are outside Agency
    security administration boundaries shall be managed in accordance
    with the requirements described below:

```{=html}
<!-- -->
```
-   Boundary protection devices (firewalls and guards), anti-viral
    software, and Intrusion Detection Systems (IDS) shall be implemented
    on Agency networks and networked systems that connect to networks
    that are outside the Agency security administration boundary.

-   Permitted services shall be documented in the system security plan.
    All other services shall be disabled and/or removed.

-   Modems shall not be attached or installed on workstations or other
    devices connected to an Agency network except for:

    -   Devices that require remote access to facilities to conduct
        maintenance and diagnostic (a waiver granted by the CIO).

    -   Mobile computing devices that require a modem to connect to the
        network.

    -   Devices that provide for managed remote access services (e.g.,
        modem pools).

    ```{=html}
    <!-- -->
    ```
    -   When using a non-networked computer that connects to external
        networks or systems use reasonable precautions to protect Agency
        systems and data from unauthorized access, modification, or
        destruction.

    -   System performance monitoring will be utilized to analyze system
        performance logs in real time to look for data availability
        problems.

    -   Network connections will automatically disconnect at the end of
        a session.

    -   External network connections shall be managed in accordance with
        an Agreement that is included in the accreditation package. A
        Systems Interface Agreement (SIA) shall include:

        -   Purpose and duration of the connection as stated in the
            memorandum of understanding/agreement, lease, or contract.

        -   Points-of-contact and cognizant officials for both the
            Agency and non-Agency organizations.

        -   Roles and responsibilities of points-of-contact and
            cognizant officials for both Agency and non-Agency
            organizations.

        -   Security measures to be implemented by the non-Agency
            organization to protect the Agency's IT assets against
            unauthorized use or exploitation of the external network
            connection.

        -   Requirements for notifying a specified official immediately,
            or as soon as possible of a security incident on the
            network.

        -   An agreement allowing the Agency to periodically test the
            ability to penetrate the network through the external
            network connection or system.

    ```{=html}
    <!-- -->
    ```
    -   Dial-in and dial-out connections shall be managed as follows:

        -   Session activity shall be recorded in an audit trail.

        -   Identification and Authentication (I&A) mechanisms shall be
            used to establish a dial-in connection in compliance with
            the NLRB Access Control and Password Management guide.
            However, if the purpose of the dial-in connection is to
            conduct system diagnostics or maintenance, the password for
            that session shall expire at the conclusion of the session
            and be verified unusable.

        -   Encryption technology used for sessions across non-Agency
            networks, including public switched networks and the
            Internet, shall comply with the National Institutes of
            Standards and Technology (NIST) encryption guidelines.

        -   Computing capability (devices) used to remotely access
            Agency systems from a remote location (e.g., an employee's
            residence) must be documented in the system security plan,
            approved by the DAA, and configured to comply with the
            policies and procedures established for the system.

        -   Computing devices used to remotely access an Agency system
            shall not be connected to any other network during networked
            sessions with an Agency system unless security can be
            afforded to the data and the Agency system and the system
            security plan identifies this type of functionality.

        -   Agency networks and systems allowing for dial-in or dial-out
            sessions shall be certified and accredited for this purpose.
            The documentation C&A shall identify the devices that are
            permitted to access Agency networks and systems as well as
            the circumstances and reasons for their connection.

        ```{=html}
        <!-- -->
        ```
        -   External network connections shall be reviewed annually by
            office personnel and documented in the annual IT security
            assessment transmitted to the NLRB Chief, IT Security.

2.  [AUTOMATIC FORWARDING.]{.underline} Automatic forwarding of email
    (via rule or macro) of e-mail received in an Agency e-mail system to
    or through a non-Agency e-mail system shall be restricted, unless
    the DAA of the system grants a waiver based upon risk and
    operational needs.

3.  [SECURITY ARCHITECTURE]{.underline}. RESERVED.

4.  [PORTABLE COMPUTING DEVICES]{.underline}.

    -   Portable computing devices (e.g. - personal digital assistants,
        notebook computers, etc.) approved for processing SBU
        information shall:

    ```{=html}
    <!-- -->
    ```
    -   Not be connected to Agency networks or systems unless the
        network or system is certified and accredited for that
        functionality. In such cases the system security plan shall
        identify the specific type of devices that can be used to access
        the network or the system, the purposes for the access, and the
        security controls for the connection.

    -   Employ virus protection software on laptop devices.

    -   Employ encryption technology on Agency provided laptop devices.

-   Offices who issue or otherwise allow the use of mobile computing
    devices for Agency business purposes shall enforce the Guidance for
    operating NLRB IT resources to address the unique operating
    environment presented by mobile computing devices. The Guidance for
    operating NLRB IT resources shall address at a minimum:

    -   Authorized and official use,

    -   Prohibitions against unauthorized users, and

    -   Changes to system configurations unless an authorized system
        administrator makes the changes.

```{=html}
<!-- -->
```
-   Portable computing devices are not authorized to process or store
    classified information unless approved in writing by the Chief, IT
    Security.

5.  [BOUNDARY PROTECTION DEVICES]{.underline}. Agency networks shall be
    protected by boundary protection devices (firewalls and trusted
    guards) at identified points of interface with lesser or unsecured
    networks. These security devices and configurations shall be
    designed and implemented employing a system security
    engineering/risk management process. Only trusted guards should be
    specified for use in security configurations bridging and protecting
    networks at various classifications and shall be approved by the
    Chief, IT Security.

-   Agency firewalls shall:

```{=html}
<!-- -->
```
-   Define and implement a network security policy based on an
    engineering/risk management process.

-   Block all services not required and disable unused ports.

-   Hide and prevent direct accessing of Agency trusted network
    addresses from un-trusted networks.

-   Maintain comprehensive audit trails.

-   Fail in a closed state.

-   Operate on a dedicated platform (device).

6.  [VIRUS CONTROL]{.underline}. All Agency IT systems shall employ
    virus protection software. Anti-virus software shall:

-   Detect and eliminate viruses on computer workstations, laptops,
    servers, and simple mail transfer protocol gateways.

-   Be enabled on workstations and servers at start-up and employ
    resident scanning.

-   Update virus signature files immediately, or as soon as possible,
    with each new release.

7.  [INTRUSION DETECTION SYSTEMS (IDS)]{.underline}. Agency IT systems
    and networks that employ routable protocol devices shall contain
    IDS. IDS's shall be:

-   Installed with boundary protection devices (e.g., firewalls) and/or
    routers to detect network intrusions and potential breaches in
    progress at all points external to the Agency network and when the
    risk analyses dictate an IDS on internal networks.

-   Installed on multi-user systems to detect intrusions on hosts,
    including servers that are located on wireless LAN segments and
    servers that are directly accessible from a network outside Agency
    security administration boundaries.

-   Operated in a manner that is compliant with Title 18, Section 2511
    of the United States Code (USC 2511), the Electronic Communications
    Privacy Act, Title 7, of the Civil Rights act of 1964, and Title 1
    of the American with Disabilities Act.

8.  [ENCRYPTION]{.underline}.

-   Encryption technology shall be applied to the following during
    transmission

```{=html}
<!-- -->
```
-   Passwords and symmetric or private asymmetric keys from their point
    of origin to their destination.

-   Activities of a system administrator or for system maintenance that
    could affect the security of another networked system;

-   Packets transmitted on wireless network segments.

-   Classified information using equipment and keying material approved
    by the National Security Agency (NSA) (Type 1 products).

```{=html}
<!-- -->
```
-   Encryption technology shall be applied to the following while they
    are electronically stored:

```{=html}
<!-- -->
```
-   Passwords, this requirement allows automatic waivers of Federal
    Information Processing Standards (FIPS) 140-1 requirements until
    standards compliant encryption of passwords becomes available in
    COTS operating systems.

-   Symmetric or private asymmetric keys.

-   Classified information stored on laptop computers.

-   SBU IT systems employing encryption shall comply with applicable
    FIPS Publications, and Guidelines for encryption except in those
    situations where encryption products or technologies are prohibited
    from exportation or deployment in a foreign country, across a
    national boundary, or in cooperation with a foreign country. In
    those cases, the NLRB Chief, IT Security can consider other
    compatible encryption technology upon a favorable determination of
    their protection.

```{=html}
<!-- -->
```
-   The Chief of IT Security must approve waivers for use of
    noncompliant encryption in writing.

9.  [MOBILE CODE]{.underline}. Until reliable executable content
    scanning technology is available to address security concerns with
    regard to mobile code or executables obtained via the Web, the
    following shall apply**:**

-   All mobile code or executable content employed within the Agency
    intranet shall be documented in the system security plan and
    approved by the DAA.

-   As feasible, offices shall implement a code review and quality
    control process for deployed mobile code or executable content.

-   For those instances where there is no operational need to download
    mobile code or executable content, the IT system shall be configured
    to prevent the downloading of mobile code or executable content.

-   Downloading of mobile code and executable content from a controlled
    interface between interconnected systems shall be permitted only
    when a boundary protection device is appropriately configured (to
    handle such a download) and is in place and approved by the DAA.

10. [WIRELESS NETWORKS]{.underline}. Wireless LAN that employ routable
    protocols shall:

-   Establish addressable network segment.

-   Employ boundary protection devices at the precise and definable
    entry point to other Agency network segments.

-   Employ encryption technology for wireless transmissions (from origin
    to termination).

-   Provide a virtual private network for those transmissions that
    traverse between the wireless LAN and Agency trusted network
    segments.

-   Authenticate network users by processes that are stronger than those
    that rely only on a password for establishing the validity of a
    claimed identity.

-   Discriminate access to the network by media access control address.

-   Wireless transmission technology that does not employ routable
    protocols shall encrypt transmissions from the wireless source
    device of the transmission to the destination wireless device.

11. [PRIVATE BRANCH EXCHANGE (PBX) SECURITY]{.underline}.

-   PBX processors that require remote vendor maintenance via a dial in
    telephone line must have a single dedicated telephone line and shall
    comply with the following:

```{=html}
<!-- -->
```
-   Access to the public-switched telephone network shall be disabled at
    all times except during an authorized and supervised maintenance
    session.

-   An audit trail containing date, time, identity of users, and
    activities performed is required.

-   Encryption is required for transmissions.

-   I&A is required. If authentication is provided through a password
    mechanism, the password lifetime use for the remote session shall be
    limited only to that session. Stronger authentication mechanisms are
    recommended.

```{=html}
<!-- -->
```
-   Administrative or maintenance activities performed using a routable
    network shall comply with the Agency encryption policy.

-   Technical and administrative controls shall be in place,
    operational, and compliant with the applicable sections of this
    policy.

-   End-user applications, such as voice mail, shall be secured with a
    password.

12. [FACSIMILE]{.underline}.

-   A cover sheet shall precede all SBU facsimile transmissions. The
    cover sheet shall contain the following:

```{=html}
<!-- -->
```
-   The classification and sensitivity of the information.

-   The recipient and sender's names, office, and voice/fax telephone
    numbers.

-   A warning banner with instructions to the recipient if the facsimile
    was received in error.

-   Classified information shall be transmitted only with equipment
    operating with NSA approved encryption.

```{=html}
<!-- -->
```
-   A cover sheet shall precede all classified facsimile transmissions.
    The cover sheet shall contain the following:

```{=html}
<!-- -->
```
-   The classification of the information.

-   The recipient and sender's names, office, and voice/fax telephone
    numbers.

-   A warning banner with instructions to the recipient if the facsimile
    was received in error.

-   Classified information shall be transmitted only with equipment
    operating with NSA approved encryption.

> CHAPTER 4. MEDIA DISPOSAL AND REUSE.

1.  [MEDIA DISPOSAL.]{.underline} Agency IT equipment under maintenance
    warranty contracts shall include stipulations that equipment removed
    from the Agency's physically protected offices shall be sanitized
    before its removal.

-   Authorized personnel shall destroy diskettes, tape cartridges,
    ribbons, and other similar items (when no longer usable) that were
    used to process information by shredding, incineration, or
    degaussing, whichever method is available, appropriate, and cost
    effective. A record shall be kept of who implemented the disposal
    actions and verification that the information or media was
    sanitized. Classified media shall be disposed in accordance with
    measures established by NSA.

    -   IT systems that have processed, stored, or transmitted SBU
        and/or classified information shall not be released from an
        office's control until the equipment is sanitized and all stored
        information memory has been cleared. For SBU information, the
        office shall approve the sanitization method. For classified
        systems, NSA-approved measures shall be used. The sanitization
        method must ensure that data recovery is not possible and the
        method must be approved in writing by the office for SBU
        information and follow NSA-approved measures for classified
        information. This requirement includes equipment transferred to
        schools.

2.  [MEDIA REUSE]{.underline}. When no longer required for mission or
    project completion, IT storage media that will be re-utilized by
    another person within the office shall be sanitized (overwritten
    with software), and protected consistent with the data sensitivity
    and/or at the highest classification level at which they were
    previously used. The procedures shall be documented in the system
    security plan.

CHAPTER 5. ROLES AND RESPONSIBILITIES.

The NLRB strives to align management responsibilities with the
organizational structure of the agency through the definition of the
following roles and responsibilities:

1.  [AGENCY CHIEF INFORMATION OFFICER (CIO)]{.underline}. The Agency CIO
    is responsible for:

-   Designating the Agency's IT security official responsible for
    ensuring the Agency's IT security program is established and
    implemented in compliance with Federal laws and regulations.

-   Approving and monitoring waivers to IT security requirements.

-   Enforcing Agency security policy, including levying sanctions for
    non-compliance.

-   Serving as the Agency's Critical Infrastructure Assurance Officer in
    support of Presidential Decision Directive (PDD) 63, Critical
    Infrastructure Protection.

2.  [NLRB CHIEF OF IT SECURITY]{.underline} The NLRB Chief of IT
    Security is responsible for:

    -   Implementing an Agency-wide IT Security program.

    -   Providing IT security policy, guidance and standards.

    -   Reporting to the CIO and OMB on the status of the Agency's IT
        security program.

    -   Providing advice and recommendations to the CIO on waiver
        requests.

    -   Assessing office compliance with Agency IT security policies.

    -   Working with offices to identify Agency IT security issues.

    -   Approving encryption technologies that are not FIPS-compliant in
        those situations where FIPS-compliant products are not
        available.

    -   Ensuring annual IT security program reviews are conducted.

    -   Ensuring and validating that a risk management process
        throughout the SDLC of each system has been conducted.

    -   Ensuring and validating that C&A activities have been performed
        throughout the SDLC.

    -   Ensuring best security practices (i.e., requirements)
        implemented and maintained throughout the SDLC.

-   Implementing configuration/change management.

-   Implementing an effective security education, training, and
    awareness program.

-   Administering a virus prevention and incident-reporting program
    coordinated with the Agency's Computer Incident Response Team
    (NLRBCIRT).

-   Ensuring separation of duties and assign appropriate system
    permissions and responsibilities for office system users.

-   Ensuring that user accounts and passwords are properly managed.

    -   Ensuring continuity of operations (system back-ups, redundancy,
        and disaster recovery) process has been identified.

3\. [ALL OFFICES]{.underline} (Regional, Headquarters, etc.). Office
Heads, or their designee, are responsible for:

-   Supporting the evaluation, and effectiveness of security policies,
    procedures and practices as identified by NLRB IT Security Program.

-   Maintaining the IT Security Program initiatives in accordance with
    the NLRB IT Security Program policy and guidelines.

-   Ensuring all Office procedures are consistent and comply with the
    NLRB IT Security Program and Agency policy.

-   Enforcing the compliance with NLRB IT Security Program and Agency
    policies, consistent with applicable laws and regulations.

-   Reporting annually, as requested by the IT Security Program, on the
    status of various IT security program initiatives.

-   Assuring that all IT Security policies have been made available to
    employees.

4\. [USERS]{.underline}. All users of NLRB equipment are responsible
for:

-   Completing agency provided annual IT Security Awareness training.

-   Complying with all Agency IT Security policies, standards and
    guidelines.

-   Complying with Agency established "User Guidelines".

CHAPTER 6. REFERENCES

The following references are applicable to the Agency's IT security
policy:

[CONGRESSIONAL MANDATES]{.underline}.

-   [Clinger Cohen Act of 1996]{.underline}, Pub. L. 104-106, Feb. 10,
    1996, 110 Stat. 186; 4 U.S.C. 40001 et seq.; and, Pub. L. 104-208,
    Sept. 30, 1996, 110 Stat. 3009; 8 USC 808.

-   [Computer Fraud and Abuse Act of 1986]{.underline}, 18 U.S.C. § 1030
    (1996).

-   [Computer Security Act of 1987]{.underline}, Pub. L. 100-235, Jan.
    8, 1988, 101 Stat. 1724; 15 U.S.C. 272, 278h, 278g-3, 278g-4, and 40
    U.S.C 759.

-   [Electronic Communications Privacy Act]{.underline}, 18 U.S.C. §
    2511.

-   [Federal Managers Financial Integrity Act (FMFIA) of
    1982]{.underline}, public law 97-255.

-   [Freedom of Information Act]{.underline} (FOIA) 5 U.S.C. § 552 and
    [Electronic Freedom of Information Act]{.underline} (E-FOIA) 5
    U.S.C. § 552a.

-   [Government Information Security Reform Act (GISRA) of
    2000]{.underline}, Public Law 106-398 (part of the National Defense
    Authorization Act).

-   [Paperwork Reduction Act of 1995]{.underline} (PRA), Pub. L. 104-13,
    May 22, 1995, 109 Stat. 163; 44 U.S.C. 3501-3520.

-   [Privacy Act of 1974]{.underline} (as amended by the Computer
    Matching and Privacy Protection Act of 1988; Notices (FR Vol. 54,
    No. 116, June 19, 1989), 100-503), 5 U.S.C. § 552 and 5 U.S.C. §
    552a.

[FEDERAL/AGENCY REGULATIONS/GUIDANCE]{.underline}.

-   [28 C.F.R. §45.4]{.underline}, Personal Use of Government Property.

-   [36 C.F.R. 1194]{.underline}, Electronic and Information Technology
    Accessibility Standards (65 FR 80500, Dec. 21, 2000).

-   [41 C.F.R, Part 101-35]{.underline}, Telecommunications Management
    Policy.

-   [Government Paperwork Elimination Act (GPRA)]{.underline}*,* 44USC
    3504.

[PRESIDENTIAL AND OFFICE OF MANAGEMENT AND BUDGET (OMB)
GUIDANCE.]{.underline}

-   [Executive Order 12958]{.underline}, Classified National Security
    Information, dated 20 April 1995.

-   [Executive Order 12968]{.underline}, Access to Classified
    Information, dated 4 August 1995.

-   [National Security Directive 42]{.underline}, National Policy for
    the Security of National Security and Telecommunications and
    Information Systems, dated 5 July 1990.

-   [Presidential Decision Directive 63]{.underline}, Protecting
    America's Critical Infrastructures.

-   [Presidential Decision Directive 67]{.underline}, Enduring
    Constitutional Government and Continuity of Government.

-   [OMB Circular A-130]{.underline}, Management of Federal Information
    Resources (with Appendices and periodic revisions).

-   [OMB Memorandum M-99-18]{.underline}, Privacy Policy on Federal Web
    Sites.

-   [OMB Memorandum M-00-13]{.underline}, Privacy Policies and Data
    Collection on Federal Web Sites.

-   [General Accounting Office (GAO) Federal Information System Control
    Audit Manual (FISCAM)]{.underline}

-   [OMB Memorandum M-01-05]{.underline}, Guidance on Inter-Agency
    Sharing of Personal Data -- Protecting Personal Privacy.

-   [NIST Special Publication 800-14]{.underline}, Generally Accepted
    Principles and Practices for Security Information Technology
    Systems.

-   [NIST Special Publication 800-15]{.underline}, Guide to Security
    Training.

-   [NIST Special Publication 800-18]{.underline}, Guide for Developing
    Security Plans for Information Technology Systems.

-   [Federal Information Processing Standard (FIPS)]{.underline}