1110.1 Purpose

The purpose of this chapter is to provide policy and procedures for
Bonneville Power Administration (BPA) ***Federal and contractor
employees and supervisors*** regarding the proper business-related use
of BPA Information Technology (IT) equipment. This policy applies to all
BPA ***Federal and contractor employees*** and supervisors and provides
notice of the consequences for improper use of BPA IT equipment. BPA IT
equipment represents a significant investment of BPA resources and its
proper use is essential to the efficient services that BPA provides.

1110.2 Definitions

A.  **BPA** **Federal Employees** are employees and supervisors employed
    by the Federal government and BPA.

    **B. BPA** **IT Equipment** includes BPA computer networks and any
    authorized BPA-owned computing device or component that can be
    attached or connected to BPA's computer network. BPA IT equipment
    includes desktop computers and monitors, laptop and portable
    computers, software, freeware, personal digital assistants (PDAs),
    telephones, digital cameras, cell phones, smart phones, facsimile
    machines, pagers, copiers, photocopies, printers, scanners, servers,
    fixed or portable storage devices (flash drives), routers,
    peripheral devices and multi-purpose machines (combined facsimile
    printer and copier).

    **C. Contractor** is defined by the Bonneville Purchasing
    Instructions (BPI) in Part 1.8, page 1-5 as a firm or individual
    that currently has a contract to supply goods or services to BPA.

    **D. Contractor Employee** is the employee of a contractor or is an
    independent contractor who has a contract with BPA to provide
    personnel to perform specific tasks. The contractor-BPA employee
    relationship is governed by the BPA contract and managed by the
    Contracting Officer (CO) and the Contracting Officer Technical
    Representative (COTR).

    **E. Cyber Security** or Information Security is the protection of
    information and information systems from unauthorized access, use,
    disclosure, disruption, modification, or destruction in order to
    provide confidentiality, integrity, and availability. (SOURCE: SP
    800-53; FIPS 200; FIPS 199; 44 U.S.C., Sec. 3542.)

    **F. Information Technology (IT)** is any equipment or
    interconnected system or subsystem of equipment that is used in the
    automatic acquisition, storage, manipulation, management, movement,
    control, display, switching, interchange, transmission, or reception
    of data or information.

    1110.3 Policy

    **A. BPA IT Equipment** is to be used [only]{.underline} by BPA
    ***Federal and contractor employees*** who are authorized system
    users and [only]{.underline} for BPA activities related to and
    consistent with the performance of BPA's mission and in a manner
    approved by this policy and consistent with Cyber Security policy
    (*References 1110.6*) or by authorized BPA personnel to determine
    proper use when this policy does not speak to a particular issue.
    This policy is intended to apply whether the work of BPA Federal and
    contractor employees is being done within the BPA work environment
    or working on BPA IT equipment from a remote location.

    **B**. **Limited** personal use of BPA IT equipment is allowed and
    is addressed in the Information Technology (IT) Equipment document
    1110.A. (*References 1110.6)*

    1110.4 Responsibilities

    **A. Federal and Contractor Employees** are responsible for the
    knowledge and the understanding of current BPA policy regarding the
    use of BPA IT equipment, including the limits of personal use,
    established in Cyber Security Chapter 1110.A, and are to conform to
    the use of such policy. BPA Federal and contractor employees, who
    have authorized access to BPA IT equipment, have an obligation to
    understand this policy and to limit their use to the activities as
    allowed. Failure of BPA ***Federal and contractor employees*** or
    BPA supervisors or CO/COTRs to satisfy their obligations, may
    subject the employee to loss of authorized system use and/or in the
    case of BPA Federal employees to possible disciplinary action.

    **B. Supervisors** are responsible for ensuring that BPA ***Federal
    employees***, under their supervision are current in their
    understanding of BPA policy regarding the use of BPA IT equipment,
    monitoring such use, and taking appropriate actions pursuant to BPA
    policy to correct improper use. BPA supervisors have an obligation
    to understand this policy and monitor the activities of BPA Federal
    employees sufficiently to ensure that their conduct is consistent
    with this policy.

**C. Contracting Officers (CO) and Contracting Officer Technical
Representatives (COTRs)** are responsible for ensuring that
***contractor employees*** working through their contractor manager, are
kept current in their understanding of BPA policy regarding the use of
BPA IT equipment, monitoring such use, and taking appropriate actions to
correct improper (inappropriate) use. BPA Contracting Officers
(COs)/Contracting Officer Technical Representatives (COTRs) have an
obligation to understand this policy and monitor the activities of
***contractor employees*** sufficiently to ensure that their conduct is
consistent with this policy. ***Contractor employees*** who do not
comply with the policy may be released in accordance with the contract
terms.

**D. Contractors** are responsible for oversight or supervision of the
***contractor employees*** and ensuring adherence to these policies.

1110.5 ProcedureS

No information in this section.

1110.6 References

[Cyber Security Chapter 1110/1110A, Policy for Business Use of
Bonneville Power Administration (BPA) Information Technology
Services](http://bpaweb.bpa.gov/orgs/orgs main/AgencyIT/cso/Security Updates/BPA Governance/Policies/BPAM_Chapter_1110_Final_20070103.pdf);
Allowances for Limited Personal Use of BPA Information Technology (IT)
Equipment.