U.S. Department of Housing and Urban Development

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

Special Attention of: Notice H 93-93

All Regional Directors of Housing Issued: 12/27/93

All Field Office Managers Expires: 12/31/94

All Directors of Housing Management
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

All Chief Property Officers Cross References:

All Regional Security Administrators

SAMS User Handbook

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

Subject: System Security Procedures for the Single Family Accounting

Management System (SAMS)

The Single Family Accounting Management System (SAMS) utilizes system

security programming that has been designed to provide the highest level
of

protection to the sensitive and critical applications SAMS supports.

However, in conjunction with the system\'s capabilities to guard against

unauthorized intrusions and tampering, the Department\'s staff must also

operate in a manner which is consistent with government-wide ADP
security

standards. These standards are set forth in HUD ADP Handbook

Handbook 2400.24, \"ADP Security Program,\" including all revisions.

The purpose of this Notice is to assist each office in understanding

its role in promoting and monitoring system security as it relates

specifically to SAMS. Adherence to the guidelines discussed in the

attached procedures will ensure that managers, security administrators,

and end users continue to practice essential data security safeguards as
a

function of controlling and maintaining the sensitive data managed by
SAMS.

The Attachment has been divided into three discussion areas as

follows:

I. Staff System Managers: Designations and Responsibilities

(page 1)

II\. LOGID/Password Procedures (page 6)

III\. Access Monitoring and Control (page 11)

The following Exhibits are included with the Attachment:

Exhibit 1: National List of Regional Security Administrators

Exhibit 2: Standard Procedures for Requesting LOGIDs/Passwords

Exhibit 3: Database Manager Designee Notification Form

Exhibit 4: Instructions for Accessing SAMS

Exhibit 5: Form SAMS-1304 System Access Signature Request

(Revised 9/93)

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

: Distribution: W-3-1,

Previous Editions Are Obsolete HUD 21B(3-80)

GPO 871 902

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

Managers and security staff should pay particular attention to the

following points:

\-- The Form SAMS-1304 has been revised. Use of the version dated

12/93 is required upon receipt of this Notice. Refer to

Attachment 2, Exhibit 5. Photocopies of this form are permitted

pending receipt of the HUD/OMB version.

\-- The Notice contains a request for the current names of

individuals serving as Regional Security Administrators and

local database managers. This information is due to Headquarters

on or before January 20, 1994 and will be used in the issuance of

new security access identification codes (\"LOGIDs\").

\-- There is a recommendation in Section I of the Attachment for

amending the performance planning process of staff who provide

security oversight so that annual reviews will reflect security

duties. Establishing accountability and performance standards

for security oversight work is becoming standard in the

administration of Federal ADP systems. However, while

adjustments to performance appraisals are recommended, they are

not required at this time.

\-- Attachment 1, Section III outlines a monitoring plan.

Implementation of this plan is required by February 1, 1994 after

which the Headquarters Security Administrator will begin

requesting on a random basis certifications of LOGID accuracy

from Regional Security Administrators.

The issue of ADP system security has assumed a significant role in any

discussion of internal controls, especially as these controls relate to
key

financial systems such as SAMS. The growing importance of security

monitoring is in direct response to the increasing volume, complexity,
and

sensitivity of Federal ADP database management networks. The objective
of

system security is to minimize the risks of accidental or intentional

corruption, destruction, or disclosure of sensitive data. To achieve
this

objective, data security cannot be transparent. It is intended to have
an

impact and requires the involvement of staff at all levels in order to

succeed.

As background to the attached procedures, all staff should be aware

that the Office of Housing administers its system security
responsibilities

for SAMS in compliance with OMB Circular A-130, \"Security of Federal

Automated Information Systems,\" and the Computer Security Act of 1987.

We comply with all applicable public laws and policies as outlined in
HUD

Handbook 2400.24. Within the Office of Housing, the SAMS system is

co-managed by the Single Family Property Disposition Division (SFPD) and

the Mortgage Insurance, Accounting, Servicing Division (MIAS).

The SAMS ADP network is a distributed system with decentralized

LOGID/password procedures whereby approvals for access begin at the
local

level and end with national oversight at Headquarters. Until such time
as

the Regional

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

reorganization effort now underway has been completed Regional Offices
will

continue to perform oversight for access activity in each local office

while Headquarters will review activity primarily at the Regional level.

This chain of accountability was deemed the most effective approach
because

it places responsibility for access closest to the level which has the

greater direct knowledge of staff needs and job functions.

Maintaining and enforcing security controls at the local level are

essential to providing reasonable assurance that funds and assets are

safeguarded against waste, loss, and unauthorized use or
misappropriation.

Security objectives are supported by system programs, many of which have

been periodically enhanced since the implementation of SAMS. Current

system security features include the following:

\-- LOGIDs that are not initialized within 21 days are disabled;

\-- Passwords must be changed every 21 days;

\-- Nonuse of SAMS for a 60-day period results in automatic LOGID

termination;

\-- Users are automatically disconnected after 20 minutes of

inactivity during a session;

\-- A record of unsuccessful log in attempts is system generated

and stored;

\-- A monthly report of all user activity is provided to the

Government Technical Representative for review;

\-- LOGIDs identified with sensitive data entry activities are

captured and stored by SAMS for audit and review purposes.

In addition to these automated security controls, the Department has

also implemented a number of non-automated operational controls
previously

announced in Notices issued by Housing during fiscal years 1992 and
1993.

In the same manner that we have strengthened oversight in the areas of

vendor database maintenance, contracting, and disbursements, by this
Notice

we are re-emphasizing the importance of oversight in the area of system

security. Separating access approval and monitoring responsibilities
among

local, regional, and Headquarters staff creates a mechanism of checks
and

balances that lessens the probability of unauthorized or inappropriate

access to SAMS and its data. It is, therefore, essential that all staff

with access to SAMS be apprised of the security procedures attached with

this Notice so that we can count on their full cooperation.

Suspected instances of security violations or questions regarding the

procedures set forth in this Notice and Attachment should be directed to

the Systems Management Branch, Single Family Property Disposition, at

\(202\) 708-4012.

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

Nicolas P. Retsinas

Assistant Secretary for Housing

Attachment - Federal Housing Commissioner

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

===========================================================================

ATTACHMENT, pages 1-13

Exhibits 1-5

System Security Procedures for SAMS

===========================================================================

December 1993

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

===========================================================================

I. STAFF SYSTEM MANAGERS

Functional Titles and Security Responsibilities

===========================================================================

A. Regional Security Administrators.

(formerly \"Regional Security Officers\")

To facilitate the decentralized access procedures applicable to SAMS,

Regional Directors of Housing are required to designate Regional
Security

Administrators (\"RSA\") to oversee Field Office and Regional Office
access

authorizations. There must be at least two RSAs for each region, a

principal and a back-up. These RSAs, as designees of the Regional

Director, act on behalf of the Regional Director to ensure that
individuals

accessing the system have a legitimate need for the access, that the
access

level is appropriate, and that access is subsequently modified or
deleted

if duties and/or jobs should change.

Regional Directors of Housing may not delegate Regional Security

Administrator authority to the local Field Offices. Regional monitoring

duties and authority to grant system access must reside with appropriate

Regional staff until such time as the transition to State and Area
Offices

is finalized. (New procedures will be developed and announced upon

completion of the field reorganization project.)

Please note that effective with the date of this Notice, regional

security staff will no longer be referred to as \"security officers\"
but

rather as \"security administrators.\" This change in terminology
conforms

to policy interpretations which will be clarified in revised HUD ADP

Handbooks. The changed designations are necessary to differentiate

between those security responsibilities carried out by Housing staff

(security administrators) and those relevant to only Regional Management

Information (MID) and Field Office systems division staff (security

officers).

Principal responsibilities of Regional Security Administrators (RSAs)

are as follows:

1\. Review and authorize Form SAMS-1300 System Access Requests for

local and regional staff.

NOTE: RSAs cannot serve as both the \"program official\" and

the \"authorizing official\" on the same Form SAMS-1300

request. The requesting official must differ to

ensure adequate oversight and internal control.

2\. Forward Forms SAMS-1300s to the SAMS Service Center (\"Service

Center\") for all addition, deletion, and access modification

action.

1

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

3\. Monitor usage activity on a monthly basis by retrieving the

SAMS GB RP LE LOGID/Security Classes Report. This report is

described on page 8, paragraph D. Also, refer to Section III,

page 10 for a discussion of access monitoring responsibilities.

4\. Provide the Headquarters Security Administrator (\"HSA\") with such

certifications regarding the accuracy and completeness of a

particular Region\'s system access activity as the HSA may

request. These requests will occur on a random basis. Routine,

monthly review of local access activity will ensure that

requests from Headquarters for activity certifications can be

easily met.

5\. Utilize system security training opportunities as these are made

available through Headquarters and/or Regional MID staff.

Communicate security guidelines and reminders to local offices

as needed and ensure local Field Office participation in any

security training which is made available on the local level.

6\. Ensure that audit trail and systems records relative to system

access are maintained and accessible for review. Audit trail

documentation includes copies of all Form SAMS-1300s authorized

by the RSA and forwarded to the Service Center, copies of monthly

LOGID/Security Classes Reports annotated as appropriate, and logs

of security violations. Regional Offices which have designated

more than one RSA should establish and maintain one central file

area for all system security audit trail documentation.

7\. Stay informed regarding HUD ADP Security Handbook procedures.

Refer to Exhibit 1 for a national list of RSAs whose signatures are

currently on file with the Service Center.

B. Field Office Database Managers.

At the time of SAMS implementation, each Field Office was required to

designate one database manager who would provide programmatic assistance

and serve as a local coordinator with Field Office administrative
systems

staff, Headquarters, Regional MID systems staff, and RSAs. In addition,

the function of database manager included several system security

responsibilities as outlined below:

1\. Maintain supplies of the most current version of the Form

Sams-1300 System Access Request form and make these available

to program officials (usually the Chief Property Officer) upon

request.

2

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

2\. Assist local office program officials in the preparation of

access request Forms SAMS-1300. Ensure that Regional Security

Administrators receive the appropriate Form SAMS-1300 additions,

deletions or modifications to system access, as required.

3\. Maintain copies of every Form SAMS-1300 which originates from the

Field Office. Whenever facsimile copies may be used in lieu of

the original, ensure that signed originals are forwarded to the

RSA within the allotted time period.

4\. Review at least once a month the Field Office\'s GB RP LE

LOGID/Security Classes Report. Annotate the report with any

questions or comments regarding discrepancies.

5\. Respond to Regional Security Administrators\' requests for

confirmation of such staff access and usage information as the

RSA may require.

6\. Share approval authority with the Chief Property Officer for

requesting RESET passwords. Requests for RESETs are exempt from

requiring RSA authorization and may be forwarded directly to the

Service Center.

7\. Maintain security reports of system activities for use in

preparation and response to RSAs and audit inquiries.

8\. Utilize system security training opportunities as these become

available and ensure that appropriate field staff are scheduled

for such training. Coordinate all awareness and training

activities relating to system security.

9\. Report violations of security to the Regional Security

Administrator (RSA).

10\. Assist local managers and supervisors with maintaining a

separation of duties, especially in the vulnerable areas of

contracts and accounts payable.

11\. Assist local managers and supervisors in preplanning system

access capability for temporary or detailed staff. Initiate

deletions from SAMS when these employees discontinue their

duties.

12\. Maintain a liaison with the local ATA and other administrative

systems staff.

13\. Stay informed regarding HUD ADP Security Handbook procedures.

3

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

The responsibilities listed above are relevant to system security

functions only. Database managers may also be called upon to provide
user

assistance to staff and to coordinate other SAMS related activities at
the

local level.

C. SAMS Coordinators.

At the time of conversion to the SAMS system, SAMS Coordinators were

designated in each Regional Office to provide technical and programmatic

assistance to other Regional and Field Office end users. However, even

though the same person may serve as both the SAMS Coordinator and the
RSA,

the designation \"SAMS Coordinator\" does not involve system security

responsibilities.

D. Headquarters Security Administrator.

The Systems Management Branch, Single Family Property Disposition

Division, oversees national security administration for SAMS. This

function is assisted by the Office of Information Policies and Systems

(IPS), ADP Security Staff, in Headquarters. Because oversight and

monitoring of Field Office security issues are handled at the Regional

level, Field Office database managers report security matters directly
to

the Regional level. Regional Security Administrators in turn report

questions, violations, and other issues directly to the Headquarters

Security Administrator. Where appropriate, these issues may also be

communicated directly to the Service Center for immediate action.

Contact the Headquarters Security Administrator, Systems Management

Branch, Single Family Property Disposition Division, at (202) 708-4012
or

via SAMS Electronic Mail at LOGID suhsnrpa.

E. Performance Appraisals.

Headquarters\' Office of Information Policies and Systems (IPS)

provides administrative and technical guidance to Housing for the
purpose

of ensuring compliance with all federal regulations applicable to the

SAMS ADP system. In accordance with the Computer Security Act of 1987
and

Office of Management and Budget Circular A-130 which implements the Act,

IPS recommends that performance appraisal descriptions be amended for

those employees who serve as Regional Security Administrators and
database

managers providing security oversight for SAMS.

Amending rating elements to reflect system security responsibilities

has the desired effect of establishing accountability as well as
crediting

staff with the additional oversight contributions they make to system

security. However, while performance appraisal

4

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

adjustments reflecting these duties are strongly recommended, they are
not

required. Each Regional Director of Housing must determine the
appropriate

manner in which staff responsibilities for SAMS system security will be

acknowledged and evaluated locally. At a minimum, supervisors are

encouraged to consider these responsibilities when conducting
performance

appraisals.

In the event a local decision is made to reflect security

responsibilities in the EPPES of local and regional security staff,

descriptions may be based upon the duties enumerated in paragraphs A.
and

B. above.

F. End User Responsibilities for Security.

Every employee with access to SAMS has a responsibility to ensure the

security of the system and the data recorded in that system. In addition

to practicing reasonable safeguards to protect password privacy, end
users

must also be aware that data output represents sensitive information
that

requires reasonable internal control. For example, sensitive data
relevant

to SAMS includes any output that could compromise the integrity of the
bid

sales process, provide an unfair advantage to potential buyers or

contractors, violate the privacy of HUD vendors, or facilitate
fraudulent

or abusive activities. Examples of output from SAMS which fall within
the

definition of \"sensitive\" include appraisal values, profit and loss

figures, accounting and disbursement data, vendor data, contract and

purchase order values, and all monthly management reports. Due to the

scope and quantity of sensitive data stored in SAMS, it is advisable to

consider all SAMS output reports as sensitive for purposes of internal

security.

In accordance with standard HUD ADP guidelines, employees are

specifically cautioned to:

o avoid posting printouts of sensitive data on bulletin boards

o avoid leaving sensitive reports unattended or unsecured

o control input documents by returning them to files immediately

upon completion of input

o avoid violation of the Privacy Act which ensures the protection

of personal data contained in government/contractor data files

o dispose of data carefully

o maintain the secrecy of personal passwords (Refer to Section II,

paragraph F.)

5

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

===========================================================================

II\. LOGID/PASSWORD PROCEDURES

===========================================================================

A. Standard Procedures for Requesting LOGIDs/Passwords.

In accordance with the SAMS User Handbook dated December 1991, the

standard process for requesting and receiving access to SAMS essentially

requires three steps as follows:

Step 1: Form SAMS-1304. The Regional Director of Housing must

complete a Form SAMS-1304 for each individual to whom he or

she is delegating authority to approve system access

requests. These individuals are referred to as Regional

Security Administrators. Completed, original Form

SAMS-1304s are forwarded to the Headquarters Security

Administrator for approval.

Step 2: Form SAMS-1300. A Form SAM-1300 must be completed and

signed by the local \"program official\" who is generally the

Chief Property Officer or local supervisor. Local

supervisors use the Form SAMS-1300 to approve the level and

type of access requested for specific staff. The form is

then routed to the appropriate RSA for review and final

authorization. The RSA forwards the completed Form

SAMS-1300 to the Service Center for action.

Step 3: LOGID/Password Assignments. Upon receipt of a properly

signed and authorized Form SAMS-1300, the Service Center

assigns a system access identification code (LOGID) and a

unique, initializing password for the end user. This is

mailed to the end user in a sealed envelope. Memoranda

confirming the assignments are mailed to the requesting

program officials and RSAs. (A quicker procedure to be

implemented by January 1994 is described in paragraph B.

below.)

Refer to Exhibit 2 for additional descriptions of each step.

Approval authority for system access, including additions, deletions,

and modifications, cannot be delegated to Field Offices or to officials

located outside of Housing. Only those Regional and Headquarters
Security

Administrators (RSAs and the HSA) whose signatures are on file with the

Service Center may authorize system access requests.

Exception: Field Office CPOs and database managers may authorize

password RESETS directly with the Service Center.

Refer to EXHIBIT 2 for processing instructions.

6

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

B. Fast Track Password Assignments.

A New Procedure to be Implemented by January 1994

In an effort to better accommodate work loads and daily system usage

requirements, we are developing a new procedure to expedite the

LOGID/password assignment process. We anticipate this new procedure will

reduce the response turnaround time from approximately 5 days to less
than

one day. Upon completion of the system programming necessary to achieve

the quicker response time, we will issue a separate notification

instructing each office when the procedures are available for use. The

new procedure will make it possible for RSAs and local database managers
to

retrieve uninitialized passwords by accessing a new SAMS report. The

report will be accessible only to Housing staff who have been assigned a

special security administrator LOGID and password.

Headquarters\' records indicate that a number of database managers

named at the time of system conversion are no longer accessing SAMS.

Therefore, our outdated records must be brought current before we can

begin the process of assigning the new security LOGIDs to appropriate

field staff. The attached Database Manager Designee Notification Form

(Exhibit 3) will be used by the HSA to assign new security LOGIDs.

In order for a Field Office to have access to the quicker password

assignments, Chief Property Officers (CPOs) must designate one staff
person

who will perform the duties of the local database manager. Forms are to
be

forwarded to each office\'s appropriate Regional Security Administrator
for

review. RSAs are asked to batch mail the forms no later than January 20,

1994 to the address below:

Single Family Property Disposition Division

Systems Management Branch

ATTENTION: Headquarters Security Administrator

Room 9284

HUD Headquarters Building

Headquarters will assign security administrator LOGIDs to all CPOs

automatically. CPO access with serve as a back-up to the database
manager.

Regional Security Administrators will receive the new LOGID upon

confirmation from each Regional Office that the names appearing in

Exhibit 1 are actively serving as RSAs. Regional staff may telephone
this

confirmation to the Systems Management Branch at (202) 708-4012 or send
a

facsimile confirmation in any format to (202) 708-4006. Any changes,

including additions and deletions, must be accompanied by an original,

signed Form SAMS-1304 (revised 12/93, Exhibit 5). Form SAMS-1304s are

mailed to the Systems Management Branch at the address noted above. All

confirmations identifying current RSAs by name and telephone number must

be received by the Systems Management Branch, Single Family Property

Disposition, no later than

7

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

January 20, 1994. Security administrator LOGIDs and passwords will not
be

assigned to any region that does not respond with a confirmation of RSA

identity.

C. SAMS Security Classification Levels.

The Form SAMS-1300 System Access Request requires the originator to

stipulate a \"system access group\" (line #4) for the person whose
request

is being submitted. The entry refers to system access security levels,

otherwise known as security classifications. SAMS is currently
programmed

to recognize three security levels at the field and regional level.

These are:

Level HFO .3: Reports only.

Level HFO .5: Data Entry and Reports. Data modifications are not

authorized for this level.

Level HFO .9: Supervisory/Data Entry and Reports. Modification of

data entered by others is permitted.

As discussed in paragraph B. above, an additional security

administrator level will be introduced by January 1994.

D. The SAMS LOGID/Security Classes Report (GB RP LE).

SAMS provides a system security monitoring report from the Global

Subsystem. This report, the LOGID/Security Classes Report, is accessed

using the initials \"GB RP LE.\" The report outputs the LOGID identifier

for all current systems users along with each user\'s name, security

classification level, date of password assignment, and date the system
was

last accessed by every SAMS end user. Data may be sorted by security

classification or by LOGID. Regional output is limited to all Field
Office

and Regional end users within the requester\'s regional jurisdiction
while

Field Office output is limited to a list of current users within the

requester\'s Field Office jurisdiction. RSAs and Field Office database

managers are required to review this report at least monthly to ensure

that requests for additions and changes to system access have been

implemented as requested and to verify that user LOGIDs identified for

deletion have been removed from the list of active system users. Refer
to

the SAMS User Manual, Section GB, for a snapshot example of this report.

E. The \"Initializing\" Password.

Refer to Exhibit 4 for instructions on using the SAMS password as

assigned by the Service Center. The first time this password is

\"initialized\" or keyed-in by the user, the user must be prepared to

convert the initializing password to a personal password

8

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

known only to the user. Personal passwords must be at least six(6)

characters long and at least one character must be a number.

LOGIDs are assigned by the Service Center, are not secret, and cannot

be changed. These are fixed system identifiers which define the end user

by name, office location, and security access level.

SAMS will automatically disable passwords that are not initialized

within 21 days of assignment. The system will also prompt the user to

change to a new, personal password every 21 days.

F. Password Privacy.

Avoiding Common Security Breaches

The Service Center notifies Headquarters immediately whenever a breach

in system security is suspected. The most frequent incidence of

unauthorized use occurs when staff is either detailed into a property

disposition area without having been added to the system or when
temporary

employees are hired to assist local staff, again without having been
added

as a new LOGID to SAMS. There have been instances where passwords of

vacationing or reassigned staff have been \"loaned\" to detailed and

temporary employees who will need system access for only a brief time

period.

Actions of this type constitute a violation of system security. In every

instance where Headquarters determines that someone other than the user
to

whom a LOGID was originally assigned is, in fact, accessing the system

using another\'s LOGID, the LOGID will be immediately terminated from
SAMS.

It is the responsibility of Chief Property Officers to ensure that all

staff scheduled to work in the Property Disposition Branch at any given

time have been assigned personal passwords that identify the specific

individual to perform the tasks. Many data entry screens, especially
those

that pertain to disbursements, capture and store the users LOGID
identity

at the time of data entry. This feature permits auditors and other

reviewers to ascertain the source of the data. Therefore, managers and

system security staff must not condone or encourage the disclosure or

sharing of any end user\'s personal password.

G. End User Responsibility for Password Privacy.

It is crucial to the overall security of the SAMS system that

individuals safeguard their passwords. Passwords must always be secured

and never displayed or divulged to anyone. To do otherwise could cause a

breach in security for which liability would initially rest with the

original end user to whom the LOGID was assigned. A breach of

9

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

security by any staff member will result in immediate termination of the

LOGID from SAMS. Also, if the recipient of a new LOGID/password notices

that the envelope containing the password has been tampered with, the

individual should notify the appropriate Regional Security Administrator

so that the assigned password can be disabled and a new password issued.

It is recommended that the following password security measures be

routinely practiced by all SAMS users:

o Do not share your password

o Memorize your password

o Do not create a personal password that could be easily associated

with you, i.e., nickname, family name, phone number, or street

address

o Log-off when leaving the system/workstation area

o Change your password frequently. (SAMS will force this change

every 21 days.)

o Do not leave written passwords on furniture or in the

workstation area.

H. Termination of System Security Access.

It may become necessary to terminate the access of an individual

because of a change in duties or discontinued employment. A LOGID and

password can be cancelled by requesting deletion on the Form SAMS-1300.

To expedite deletion, the Service Center will accept FACSIMILE copies of

the Form SAMS-1300 forwarded from the Regional Security Administrator.

FAX to (301) 622-1664. A follow-up original to the Service Center is

NOT required for LOGID deletions, but the original must be retained by

the RSA for a period of six months for audit purposes. Records storage

after six months is not required.

NOTE: RSAs are not required to wait for Field Offices to initiate

the deletion process. Whenever an RSA knows that local

staff changes should result in deletion of one or more

users from SAMS, the RSA may initiate the deletion action

using the Form SAMS-1300. When RSAs initiate deletions,

the signature of a \"program official\" is not required.

Users who do not access SAMS during a 60 consecutive day period will

be system deleted. System generated deletions cannot be RESET. Users

whose LOGIDs and passwords have been disabled for non-use may request
new

access capabilities using the \"ADD\" option on the Form SAMS-1300.

Also, the Headquarters Security Administrator may terminate any user

immediately upon discovery or determination that a LOGID/password has
been

compromised. For example, instances where a single LOGID/password is
being

shared with one or more individuals or a password has been \"loaned\" by
one

system user to another will result in termination of that LOGID.

10

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

LOGIDs/Passwords are assigned to specific individuals and may be used
only

by the individual whose name and access level is defined with the
password.

I. Computer Based Training Assistance.

IPS has recently introduced a tutorial computer based training (CBT)

program entitled \"MicroSecure II.\" This CBT program is available on
the

LAN network to all HUD personnel. Typical access from the LAN main menu

is F. GENERAL INFORMATION, A TUTORIALS, G. COMPUTER BASED TRAINING.

However, should local access vary from this sequence, contact the local

ATA for further assistance. \"MicroSecure II\" provides a user friendly,

quick overview of system security reminders that are especially
worthwhile

for all system users regardless of experience level. It is, therefore,

recommended that local database managers offer such assistance as
required

to ensure that all end users, including temporary and detailed staff,

complete this program.

J. Security Background Investigations.

Positions within HUD that involve access to sensitive unclassified

information often require background investigations beyond the initial

National Agency Check and Inquiries (NACI). The type of investigation

required depends on the sensitivity rating assigned to the duties of the

position. Sensitivity levels range from Level 1, the lowest and least

sensitive rating, to Level 6, the highest and most sensitive rating.

Background investigations for HUD employees are normally conducted by
the

Office of Personnel Management in accordance with Chapters 731, 732, and

736 of the Federal Personnel Manual. The Office of Inspector General

manages the investigation process. To assist each office in complying

with these investigation requirements, detailed procedures for
initiating

Federal background security reviews will be developed by the Systems

Management Branch, Headquarters Security Administrator for SAMS, and

forwarded to Field and Regional Offices at a future time.

===========================================================================

III\. ACCESS MONITORING AND CONTROL

===========================================================================

The SAMS decentralized or distributed access controls require diligent

monitoring at all levels to ensure that security violations do not
occur.

To this end, RSAs play a key role in overseeing system usage at the
local

level. This role will continue until further notice.

The following access monitoring plan sets forth the minimum access

oversight to be provided by the RSAs. Full implementation of this plan

is required no later than February 1, 1994.

11

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

MONITORING PLAN PROCEDURES

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

MONITORING

FREQUENCY AREA DESCRIPTION

Monthly Access and Usage Retrieve the GB RP LE LOGID/Security Classes

Report.

1\. Compare copies of all Form SAMS-1300s

authorized during the review month

with data on the report.

Additions, access modifications, and

deletions must agree with the

authorizations forwarded to the Service

Center by the RSA.

Annotate the GB LE report with any

discrepancies noted and forward these

for explanation and resolution to the

Service Center. Retain a copy of the

annotated report on file for audit

purposes along with applicable copies

of the Form SAMS-1300s.

2\. Where appropriate, contact each local

database manager for confirmation of

staff names and turnover information.

Inquire about the status of any detailed

or temporary employees to ensure these

have been deleted from access where

appropriate.

3\. Provide the Headquarters Security

Administrator with such certifications

regarding the accuracy of the GB LE

report as the HSA may request.

Daily Access Review and authorize all requests for

Authorizations system access as these are forwarded

from Field Offices. Contact the

CPO or database manager to verify any

discrepant or questionable information.

For instance, local offices should not

be requesting access, especially data

entry access, for any staff located

outside of Housing. Any exceptions

granted by RSAs must be documented in

the RSAs files for audit purposes.

Initiate the deletion of local

LOGIDs/passwords when it is known to

the RSA that such action is warranted.

Daily Security Violations Maintain a log of any security

violations that are known to the RSA

or reported to the RSA by Headquarters

or local offices.

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

12

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

It is recommended that RSAs stagger Field Office monitoring by

reviewing local offices at different times during the review month
rather

than reviewing all offices at the same time. RSAs are also encouraged to

divide review responsibilities within a region in such a manner that the

same RSA reviews the same office(s) monthly. This approach will
facilitate

greater familiarity with each office\'s staffing levels, usage needs,
and

normal practices so that deviations will be more apparent to the RSA

familiar with each particular office.

Diligent implementation of the above plan will provide the monitoring

oversight essential to maintenance of SAMS security. It will also ensure

that Housing continues to protect its sensitive asset and accounting
data

in conformance to Federal standards for sound ADP management and
control.

The following Exhibits 1-5 support the procedures discussed herein.

Questions regarding the procedures or Exhibits presented in this
Attachment

may be directed to the Headquarters Security Administrator, Systems

Management Branch, Single Family Property Disposition Division, at (202)

708-4012 or via SAMS electronic mail to LOGID suhsnrpa.

13

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

EXHIBITS 1-5

System Security Procedures for SAMS

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

Exhibit 1

SAMS REGIONAL SECURITY ADMINISTRATORS

The following is a list of Regional Security Administrators (RSA)

authorized as of September 1993 to approve system access for the Single

Family Accounting Management System (SAMS). The name and telephone
number

of each primary RSA appears as the first entry for each region. Back-up

RSAs are named next. Refer to page Section II, page 7 of the Notice

Attachment for instructions on updating and confirming this list to
ensure

that Security LOGID access is assigned to the appropriate
administrators.

===========================================================================

REGION SAMS SECURITY TELEPHONE

ADMINISTRATOR

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

I Robert Cormier (615) 565-5105

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

II Alice Oxner (212) 264-5063

Elaine McCermott

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

III Sidney Severe (215) 597-2645

Thomas W. Langston

Phillip Caulfield

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

IV Robert Reavis (404) 331-4801

Kenneth Williams

William Miller

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

V Alice Gueno (312) 886-6437

James Zale

Dan Coughlin

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

VI Ruth Pompa (615) 885-2701

James Hicks

James Brewer

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

VII Jimmie Hollis (913) 551-6816

Klifton Barrett

Bill Greenwood

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

VIII Rose Fasso (303) 844-2005

Rita Vautrin

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

XI Robert Dutra (415) 556-3880

Ron Dizon

Joanne Lee

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

X Renee Greenman (206) 220-5200

EX3249

David Rodgers

===========================================================================

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

Exhibit 2

STANDARD PROCEDURES FOR INITIATING SAMS

LOGID/PASSWORD REQUESTS

===========================================================================

STEP 1. Form SAMS-1304 \"System o Regional Directors complete the

Access Signature Request\" Form SAMS-1304 designating one or

more RSAs with authority to approve

system access requests from Field

(Only original forms are Offices;

acceptable. FAXED copies

are not permitted to be o Each RSA signs the Form

used in lieu of SAMs-1304.

originals.)

o Signed Form SAMS-1304s are

mailed from the Regional Office to

the Headquarters Security

Administrator (HSA), Systems

Management Branch, SFPD.

o The HSA reviews the Form

SAMS-1304 and, if approved,

forwards it to the Service Center.

Signature verifications for each

RSA remain on file with the Service

Center.

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

STEP 2. Form SAMS-1300 \"System o The Form SAMS-1300 is required

Access Request(s)\" for each request to ADD, MODIFY,

originate at the RESET, and DELETE a

local level. LOGID/Password for system users.

(For ADDs and o Local approval is required by

MODIFICATIONS: Original the user\'s supervisor who signs the

forms are required. However form as the \"program official.\"

FAXED copies may be

acceptable with prior o Program officials do NOT provide

approval of the HSA. signature verifications to the

Where a FAX is accepted, Service Center. However, at the

it must be followed with option of the RSA, \"program

a signed original within officials\" may be required to

7 business days of the provide the RSA with a signature

request. Non-receipt of verification (Form SAMS-1304).

the original could result This may be prudent when the

in immediate termination program official is located outside

of the LOGID. of Housing, such as with OIG or OGC

officials. (Form SAMS-1304s

provided for RSA use only are NOT

forwarded to the Service Center.)

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

For RESETS (Field Office o Form SAMS-1300s are forwarded

level) and DELETIONS to RSAs for authorization. RSA

(Regional level): approval is NOT required for

FAX copies are permitted. RESET passwords. Requests for

FAX to (301) 622-1664. RESETS may be signed locally by

The signed original is not the CPO or database manager

required but must be retained and faxed to the contractor.

at the local level for 6

months. No further records o RSAs mail authorized original

retention is necessary.) Form SAMS-1300s to the Service

Center for action.

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

STEP 3. LOGIDs/Passwords are Once assigned, the Service Center

assigned by the Service mails the LOGID/Password in a

Center. sealed envelope directly to the

system end user. Program officials

receive a letter from the

contractor advising that the

requested action has been

completed. The \"LOGID/Security

Classes Report\" is updated to

reflect current user access data.

RSAs monitor this report to verify

activity.

===========================================================================

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

Exhibit 3

DATABASE MANAGER DESIGNEE NOTIFICATION FORM

===========================================================================

Instructions to Chief Property Officers:

Complete, sign, and forward the original of this form to your Regional

Security Administrator for receipt prior to January 20, 1994.

Instructions to Regional Security Administrators:

Retain copies of this form on file for reference. Batch mail

notifications for the region to:

Single Family Property Disposition Division

Systems Management Branch - HUD Headquarters

ATTN: Headquarters Security Administrator

Room 9284

Washington, D.C.

Notification forms are due in Headquarters no later than January 20,

1994\.

===========================================================================

The following person has been designated to serve as the SAMS database

manager:

Field Office:
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

Designee\'s Name:
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

HUD Job Title:
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

Tele. Number:
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

In designating the above person to serve as the SAMS database manager,

I also authorize this person to have special Security LOGID access to

the Single Family Accounting Management System.

Approved By:

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

Chief Property Officer Date

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

Exhibit 4

INSTRUCTIONS FOR ACCESSING SAMS

Use the system LOGID and initializing PASSWORD assigned by the SAMS

contractor to access SAMS as follows:

\(1\) After dialing into SAMS, the system will provide various logging
in

prompts. With the exception of the \"password expired\" prompt, these

prompts and responses will also be required each time the user

accesses SAMS subsequent to the initial log-on.

\(2\) Use lower case letters (NO CAPITAL LETTERS) when accessing SAMS.

\(3\) This first logging on sequence accesses the TYMNET
telecommunications

network:

CONNECT 2400 Wait about 5 seconds and then type the

letter a.

please log in: Type hudsf and press the ENTER key.

password: Type happy day and press the ENTER key.

\(4\) This last sequence accesses SAMS:

dprmpt

login: Type your LOGID and press ENTER.

password: Type your initializing PASSWORD (six

alpha-numeric characters) and press

ENTER.

Your password has expired:

Old password: Retype your initializing PASSWORD.

New password: Type in a new, personal password

selected by the user. The new password

must be a minimum 6 characters long and

at least one character must be a number.

Re-enter new password: Repeat previous step.

THE SYSTEM WILL NOW PROCEED TO THE MAIN MENU SCREEN.

NOTE: The initial password assigned by the SAMS contractor must

be used within 21 days of issuance, or it will be

automatically system-purged. Once initialized, the user

must access SAMS at least once every 60 days. Nonuse

for a consecutive 60-day period will result in automatic

termination of access.

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

Exhibit 5

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

SAMS 1304 SYSTEM ACCESS SIGNATURE REQUEST File ID No.

Rev. 12/93

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

1\. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ Date:
\_\_/\_\_/\_\_

HUD Office \# HUD Office Name Format:(MM/DD/YY)

THE FOLLOWING PERSON IS AUTHORIZED TO APPROVE SYSTEM ACCESS

REQUESTS ON BEHALF OF THE DEPARTMENT OF HOUSING AND URBAN

DEVELOPMENT FOR SINGLE FAMILY PROPERTY DISPOSITION ACTIVITIES:

2\. Name:
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
Telephone: \_\_\_\_\_\_\_\_\_\_\_\_\_

3\. Title:
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

4\. Signature:
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

THE FOLLOWING PERSON OR PERSONS ARE NO LONGER AUTHORIZED TO

APPROVE SYSTEM ACCESS REQUESTS FOR SINGLE FAMILY PROPERTY

DISPOSITION:

5\. Name(s):
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

===========================================================================

THE FOLLOWING \"PROGRAM OFFICIAL\" SIGNATURE IS REQUESTED FOR

VERIFICATION USE ONLY BY THE REGIONAL SECURITY ADMINISTRATOR.

THE SIGNATORY WILL NOT HAVE ACCESS APPROVAL AUTHORITY.

6\. Name:
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

7\. Signature:
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

===========================================================================

8\. Authorizations and/or Deletions Approved By:

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

Regional Director of Housing Headquarters Security Administrator

Mail completed Form to: HUD Headquarters, SF Property Disposition,

Systems Management Branch, Room 9284,

Attention: Headquarters Security Administrator

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

INSTRUCTIONS FOR COMPLETION OF FORM SAMS-1304

(Please use typewriter or print in ink)

NOTE: Use of the \"File ID No.\" block is optional. This block is
intended

for a sequential numbering should the originator of the form prefer

to maintain an internal filing and control system for these forms.

1\. HUD OFFICE #: This is the SAMS identifier number (i.e., FO800 or

RG01) assigned to the office. Until further

notice, only Regional Offices or Headquarters are

permitted to originate the Form SAMS-1304.)

HUD OFFICE NAME: Provide Regional Office location.

DATE: Date requested action is signed by the Regional

Director of Housing. Exception: Use signature

date of program official when completing lines 6

and 7 only.

2\. NAME: Person designated by Regional Director of Housing

to authorize access.

3\. TITLE: Position title of designated person.

4\. SIGNATURE: Inked signature of the designee named in Line 2.

5\. NAME(s): List names of persons to be removed from access

approval authority. The Regional Director of

Housing\'s signature is required to approve

deletions.

6\. NAME: This line is available for the RSA\'s use ONLY when

the RSA will require a signature verification for

any \"program official\" who may submit a Form

SAMS-1300 Access Request. This is an optional

section of Form SAMs-1304 and is recommended

primarily whenever offices outside of Housing have

been permitted to request system access through

Regional Security Administrators. Program

officials signing this section of the Signature

Request form will never have authority to grant

system access to SAMS.

7\. SIGNATURE: Optional field. Signature of program official who

will submit Form SAMS-1300s to the RSA for action.

RSAs determine whether this signature verification

is required.

8\. AUTHORIZATION OR

DELETION ACTION Inked signature of the Regional Housing Director.

APPROVED BY: Completed forms are forwarded to the Headquarters

Security Administrator (HSA) at the address

shown on the form. The HSA\'s signature is

required for final approval of the request.

===========================================================================

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

REMINDERS:

\(a\) Each Region must designate a minimum of two RSAs, a primary

authorizing official and a back-up. Security LOGIDs will be assigned

to each designee approved by the Regional Director of Housing.

Security LOGIDs will be automatically purged for designees whose

approval authority has been rescinded by the Regional Director.

\(b\) The signatures of the \"Authorizing Official\" and the \"Program

Official\" on each Form SAMS-1300 Access Request must be different.

RSAs cannot both recommend and approve access for the same

individual on the same form.

\[Search\] \[Prev List\] \[Doc List\] \[Next List\] \[First Doc\] \[Prev
Doc\] \[Curr Doc\]

\[Next Doc\] \[Last Doc\] \[Top\] \[Help\]