## Sample Generic Policy and High Level Procedures[^1] for

## Passwords and Access Forms

### 

#### Issue Statement

Users of the XX agency systems must have access to the information they
need to do their jobs. *Access* is the ability to do something with a
computer resource (e.g., use, change, or view). *Access control* is the
means by which the ability is explicitly enabled or restricted in some
way (usually through physical and system-based controls.) The term
*computer resources* includes information as well as system resources,
such as applications, programs, subroutines, and hardware (e.g., modems,
communications lines).

#### Organization's Position

Account passwords are the foundation of the security of the Large
Service Application (LSA). Users of XX Agency automated information
systems expect information to be available when it is needed, to be
accurate, and to be safeguarded from access by unauthorized personnel.
XX Agency has established management controls for granting, changing,
and terminating access to automated information systems. These controls
are essential to the security of XX Agency automated information
systems.

#### Applicability

XX Agency requires all XX Agency organizations to have effective
passwords for access to all XX Agency systems. These procedures apply to
accounts on the LSA System. These procedures apply to systems or
applications that are operational and those that are in development.

#### Roles and Responsibility

[Director, Federal Systems]{.underline} shall:

-   provide management oversight of the process for administering
    passwords for XX Agency systems, and

```{=html}
<!-- -->
```
-   publish and maintain policy guidelines for the creation,
    safeguarding, and control of the passwords.

[Information Systems Security Officer (ISSO)]{.underline} shall:

-   grant access and review access every year to determine continued
    need for access; and, if the need continues, be re-approved through
    submission of System Access Request Form(s),

-   prepare policy guidelines for the creation, safeguarding, and
    control of passwords, and

```{=html}
<!-- -->
```
-   approve access of supervisor passwords and passwords for similar
    privileged accounts used on XX Agency network.

[Supervisor]{.underline} shall:

-   communicate to the users the system access and password requirements
    outlined in this policy,

-   inform LSA Security Officer when access is to be removed, and

-   immediately inform LSA Security Officer if it is suspected that
    password has been compromised.

> [LSA Security Officer -- XX Agency Site]{.underline} shall:

-   issue and manage passwords for systems and applications under their
    control in accordance with XX Agency policy described below, and

-   issue passwords for privileged accounts to the primary system
    administrator and no more than one designated alternate system
    administrator. These passwords shall be changed at least every 30
    days or when necessary due to employment termination, actual or
    suspected password compromise.

[Users]{.underline} shall:

-   understand their responsibilities for safeguarding passwords,

-   use Federal data in accordance with job function and XX Agency
    policy,

-   understand the consequences of their failure to adhere to statutes
    and policy governing information resources, and.

-   Immediately notify supervisor if it is suspected that password has
    been compromised.

**Access and password policy:**

-   Access to LSA shall be controlled and shall be based on an approved
    System Access Request Form for each of the systems.

```{=html}
<!-- -->
```
-   Individuals shall be granted access only to those information
    systems necessary for the performance of their official duties.
    Individuals must receive supervisor\'s and the ISSO\'s approval
    prior to being granted access to XX Agency\'s information resources.
    This requirement includes contracted employees and all other non-XX
    Agency personnel who have been granted access.

```{=html}
<!-- -->
```
-   Passwords shall be used on all XX Agency automated information
    systems to uniquely identify individual users.

```{=html}
<!-- -->
```
-   Passwords shall not be shared with, used by, or disclosed to others.
    Generic or group passwords shall not be used.

```{=html}
<!-- -->
```
-   To preclude password guessing, an intruder lock out feature shall
    suspend accounts after three invalid attempts to log on. Manual
    action by a security system administrator is required to reactivate
    the ID.

```{=html}
<!-- -->
```
-   All user and system passwords, even temporary passwords set for new
    user accounts, should meet the following characteristics:

```{=html}
<!-- -->
```
-   be at least six characters in length;

```{=html}
<!-- -->
```
-   consist of a mix of alpha, and at least one numeric, and special
    characters;

-   not be dictionary words;

-   not be portions of associated account names (e.g., user ID, log-in
    name);

-   not be character strings (e.g., abc or 123); and

-   not be simple keyboard patterns.

Furthermore, users are required to select a new password immediately
after their initial logon.

-   Passwords will be changed at least every 30 days. Previously used
    passwords will not be re-used.

```{=html}
<!-- -->
```
-   Password accounts not used for 30 days will be disabled and reviewed
    for possible deletion. Accounts disabled for 60 days will be
    deleted. Accounts for XX Agency contractors shall terminate on the
    expiration date of their contract.

```{=html}
<!-- -->
```
-   Passwords will not be embedded in automated programs, utilities, or
    applications, such as: autoexec.bat files, batch job files, terminal
    hot keys.

```{=html}
<!-- -->
```
-   Passwords will be not visible on a screen, hardcopy, or any other
    output device.

```{=html}
<!-- -->
```
-   Vendor or service accounts will be removed from computer systems
    prior to deployment and new passwords are to be implemented on all
    systems immediately upon installation at XX Agency facilities.

```{=html}
<!-- -->
```
-   Administrative account passwords will be changed promptly upon
    departure of personnel (mandatory or voluntary) or suspected
    compromise of the password. User accounts will be disabled promptly
    upon departure of personnel (mandatory or voluntary). Users should
    immediately change their password if they suspect it has been
    compromised.

#### Compliance

Unauthorized personnel are not allowed to see or obtain sensitive data.
The gross negligence or willful disclosure of LSA information can result
in prosecution for misdemeanor or felony resulting in fines,
imprisonment, civil liability, and/or dismissal.

#### Supplementary Information

XX Agency Automated Information Systems Security Program Handbook, May
1994.

XX Agency Non-Disclosure Oath

**Points of Contact**

Information Systems Security Officer LSA Security Officer -- XX Agency
Site

XX AGENCY

AGREEMENT TO SAFEGUARD SENSITIVE DATA

I,
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_,
acknowledge that I have access to sensitive data maintained by the
Federal XX Agency in the Large Service Applications (LSA).

I agree that I will obtain, use or disclose such data only in connection
with the performance of my official duties solely for authorized
purposes.

I agree to maintain the confidentiality of information in accordance
with the Federal Regulations. *(List Regulations)*

I understand that failure to safeguard Sensitive data may result in the
imposition of penalties, including fines, costs of prosecution,
dismissal from office, discharge from employment, and imprisonment. (42
USC s.653 (1); 26 USC ss.7213, 7213A, 7431, 5 USC s.552a (i)).

If I observe any conditions, which could cause said information to be
compromised in any way, I understand that it is my responsibility to
take action to safeguard XX Agency data and report the incident to my
manager.

I agree that my obligation to safeguard the confidentiality of LSA data
shall survive the termination of my employment with the Federal XX
Agency.

**ACKNOWLEDGES AND WITNESSED:**

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

(Employee) (Date)

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

(Supervisor/Witness) (Date)

# 

**Office of LSA to Request Access to XX Agency or XX Agency Protected
Data**

**[I. "APPLICATION FOR ACCESS TO XX Agency SYSTEMS" FORM
SSA-120]{.underline}**

-   The XX Agency-120 form is used to request a \$PIN or \$USERID and
    password (initial access) to SSA computer systems.

-   The XX Agency-120 is a two-sided multi-page form.

-   If a photocopy is used, both the front and back (the Security
    Requirements and the Privacy Act Statement) of the XX agnecy-120
    must be submitted.

-   The XX Agency-120 form must contain original signatures.

-   XX Agency Contractors must also complete the "Contractor Personnel
    Security Certification" (exhibit attached). Note: this form must be
    submitted along with the initial XX Agency-120.

-   Separate XX Agency-120 forms must be completed for each type of
    access requested, i.e.,

```{=html}
<!-- -->
```
-   one for PPF (XX Agency Production Systems) and/or for the MISF
    (Management Information Systems Facility;

-   one for access to the XX Agency Software Engineering Facility (SEF);
    and

-   one for access to the XX Agency LAN and/or for a \$PIN or \$USERID.

> (Note: after the individual receives his/her \$PIN or \$USERID, to
> request access to top secret resources, the form XX Agency-613, "Top
> Secret Resource Access Authorization," must be completed. Instructions
> for completing the XX Agency-613 follow those for the XX Agency-120.)

Outlined below are the steps to follow for completing and processing
form XX Agency-120 requests for a \$PIN or \$USERID from:

1)  State and Local Child Support Enforcement Employees;

2)  Federal XX agency Employees; and

3)  XX agency Contractors.

-   Requestor completes blocks 1 through 10. Complete block 7 by
    entering code #702 which is the XX Agency organization number for XX
    Agency computer systems. *Reminder:* a separate XX agency-120 form
    must be completed for each type of access (refer to 1.e above).

> [Note: block 9 must explain what type of access is needed and
> why.]{.underline}

-   Blocks 10a, b, c, d and e, are completed by the supervisor or
    project leader of the requestor.

> [Note]{.underline}: [it]{.underline} [is]{.underline}
> [critical]{.underline} [that when]{.underline} [someone]{.underline}
> [who]{.underline} [has]{.underline} [been]{.underline}
> [given]{.underline} [Top Secret Access changes jobs or leaves their
> current agency, the supervisor notifies Jim Fox, the XX agency
> Security Officer located at XX agency, so]{.underline}
> [the]{.underline} [access]{.underline} [can]{.underline}
> [be]{.underline} [terminated]{.underline} [timely]{.underline}. Jim
> can be reached on 410-965-5634; Fax 410-966-7784. A written
> notification of the termination should also be sent to Jim Fox at
> jfox@acf.dhhs.gov.

-   Blocks 11a through 19 are left blank for completion by the
    appropriate XX agency official.

```{=html}
<!-- -->
```
-   Forms are then sent to Joan O'Connor at DPO/XX agency, Aerospace
    Building, Washington, D.C. Joan O'Connor reviews and initials the
    form, enters the information from the form onto the XX agency ATSAFE
    computer system and forwards the XX agency form 120 to the XX agency
    Security Officer, Jim Fox, located at XX agency/NCC, room 436. (Joan
    O'Connor retains a copy for the file.)

```{=html}
<!-- -->
```
-   Jim Fox reviews the form, signs next to block 10b, c, d, e and
    forwards to Nelson Brenneman, XX agency/OTSO, room 490 NCC, the SSA
    Project Manager for the XX agency Project.

-   Nelson Brenneman concurs by providing his signature on the form in
    blocks 10 b, c, d, e and forwards to the OTSO Component Security
    Officer, room 590 NCC.

-   If approved, the OTSO Component Security Officer signs in block 11,
    and forwards to Joan Hash, SSA's Systems Security Officer (SSASSO),
    room GD10, East High Rise.

```{=html}
<!-- -->
```
-   Once approved and signed in block 16, by the SSASSO, the \$PIN or
    \$USERID is provided to the requestor either by phone or in writing.
    If an ATSAFE record has been entered earlier, the SSASSO will
    process it at this time. The original SSA-120 form is then returned
    to Jim Fox as the official XX agency record copy.

**[II. "TOP SECRET RESOURCES ACCESS AUTHORIZATION" FORM
SSA-613]{.underline}**

Once the form XX agency-120 has been approved and the requestor has been
provided an ID and password, he/she can now complete the form XX
agency-613 to request Top Secret access to a protected system(s) on the
XX agency mainframe computer system. These requests can come from XX
agency employees, or XX agency contractors for access to *XX agency* or
*XX agency* protected systems, or from XX agency employees or
contractors for access to *XX agency* protected systems. Requests can be
submitted online through ATSAFE.

A.  **ACCESS TO OCSE DATA FROM**

```{=html}
<!-- -->
```
1)  STATE CSEA EMPLOYEES;

2)  FEDERAL XX AGENCY EMPLOYEES; OR

3)  XX AGENCY CONTRACTORS.

-   Requestor completes Part I, blocks 1a, 2, 3, 4 (always 702), 5, 6
    and 7.

-   Requestor completes Part II, blocks 1, 2, 3A, 3B and 4.

-   Requestor completes Part III, "Justification", [which must clearly
    explain what access is needed and why.]{.underline}

-   Requestor leaves blocks 6 through 11 blank to be completed by the
    Resource Owner (if known).

-   Requestor forwards to supervisor or project leader for concurrence
    and initialing.

> [Note: it is critical that the XX agencySystems Security Officer, Jim
> Fox, is notified immediately upon any change in a persons authorized
> access so the access can be terminated timely.]{.underline}

-   Form is then sent to Joan O'Connor to enter on ATSAFE.

```{=html}
<!-- -->
```
-   Form is then sent to Jim Fox, XX agency Security Officer, room 436
    NCC, for final approval and signature. The XX agency Security
    Officer has final approval authority for requests for access to XX
    agency data---no XX agency involvement is necessary.

B.  **ACCESS TO XX agency DATA FROM:**

```{=html}
<!-- -->
```
1)  STATE CSEA EMPLOYEES;

2)  FEDERAL XX AGENCYH EMPLOYEES; OR

3)  XX AGENCY CONTRACTORS.

> (Requests can be submitted online through ATSAFE as well.)

-   Requestor completes Part I, blocks 1a, 2, 3, 4 (always 702), 5, 6
    and 7.

-   Requestor completes Part II, block 2, 3A, 3B and 4.

-   Requestor completes Part III, "Justification".

-   Requestor forwards to Resource Owner to complete blocks 6 through 11
    or leaves blank.

-   Requestor forwards to supervisor or project leader to initial
    indicating concurrence.

-   Form is then sent to Joan O'Connor to enter data on ATSAFE.

-   Form is then sent to Jim Fox, XX agency Security Officer at NCC,
    room 436, for approval and signature in blocks 12 through 17.

-   After Jim's signature, form is sent to Nelson Brenneman, XX
    agency/OTSO, room 490 NCC, for concurrence.

-   Nelson Brenneman then forwards the form to the OTSO Component
    Security Officer (CSO), room 590 NCC, for approval and signature in
    Part V.

-   The OTSO CSO then forwards the form to Joan Hash, SSA System
    Security Officer, room GD10 East High Rise, for Top Secret Access
    approval and signature in Part V. (The final approval in XX agency.)

-   Once approved by SSASSO, the form is returned to Jim Fox, room 436
    NCC, to retain the official record copy for XX agency.

C.  **ACCESS TO OCSE DATA FROM:**

```{=html}
<!-- -->
```
1)  FEDERAL XX AGENCY EMPLOYEES; OR

2)  XX AGENCY CONTRACTORS.

(Requests can be submitted online through ATSAFE as well.)

-   Requestor completes Part I, blocks 1a, 2, 3, 4, 5, 6 and 7.

```{=html}
<!-- -->
```
-   Requestor completes Part II, block 2, 3A, 3B and 4.

```{=html}
<!-- -->
```
-   Requestor completes Part III, "Justification".

-   Requestor forwards form to Division/LAG\* Director for review and
    completion of blocks 6, 7, 8, 9, 10 and 11.

> \*If the requestor is an OSDD employee, OSDD Division/LAG Directors
> review the SSA-613, approve and forward it to Bill Sherman (OSDD/CSO),
> 2J25 Operations Building;
>
> \*If the requestor is an OSR employee, OSR Division/LAG Directors
> review the SSA-613, approve the request and forward it to John LeBedda
> (OSR/CSO), room 3R14 Operations Building;
>
> \*If the requestor is an OTSO employee, OTSO Division/\
> LAG Directors review the XX agency-613, approve the request and
> forward it to the OTSO/CSO, room 590 NCC;

-   The CSO reviews the form, approves if appropriate by providing
    signature in Part III, and forwards to Paul Swanenberg, OSR, room
    3A17 Operations Building.

-   Paul reviews the form, approves if appropriate by providing
    signature in Part III, and forwards to Joan Hash, SSASSO, room GD10
    East Building, for final SSA review and approval.

-   Joan Hash reviews the SSA-613, approves if appropriate by providing
    signature in Part III, and forwards to Jim Fox, room 436 NCC.

-   Jim Fox reviews the form, and if appropriate, indicates final XX
    agency authorization by completing blocks 12, 13, 14, 15, 16 and 17.
    The requestor is then notified that the access has been granted. A
    copy of the SSA-613 is retained by Jim Fox as the official XX agency
    record copy.

[IMPORTANT CONTACTS FOR XX AGENCY RELATED SECURITY ACCESS
REQUESTS]{.underline}

James Fox, OCSE Security Officer at SSA

Room 436 National Computer Center (NCC)

6201 Security Boulevard

Baltimore, Maryland 21235

Phone: 410-965-5634

Fax: 410-966-7784

Email: <jfox@acf.dhhs.gov>

Joan O'Connor

OCSE, 4^th^ Floor East

Aerospace Building

370 L'Enfant Promenade, S.W.

Washington, D.C. 20447

Phone: 202-690-5375

202-401-9389

202-401-9267

Fax: 202-401-5647

Email: <joconnor@acf.dhhs.gov>

Nelson Brenneman

SSA/OTSO

Room 490 National Computer Center (NCC)

6201 Security Boulevard

Baltimore, Maryland 21235

Phone: 410-965-2241

Fax: 410-966-1936

Email: nelson.brenneman@ssa.gov

[COMMONLY USED TERMS]{.underline}

OCSE -- Office of Child Support Enforcement

SCSEA -- State Child Support Enforcement Agency

LCSEA -- Local Child Support Enforcement Agency

SSA -- Social Security Administration

FPLS -- Federal Parent Locator Service

NCC -- National Computer Center (SSA)

MISF -- Management Information Systems Facility (SSA)

SEF -- Software Engineering Facility (SSA)

CSO -- Component Security Officer (SSA)

SSO -- Systems Security Officer (SSA)

IRG -- Interstate Referral Guide

SSA-120 -- Application for Access to SSA Systems

SSA-613 -- Top Secret Resource Access Authorization

DPO -- Division of Program Operations (OCSE)

OTSO -- Office of Telecommunications and Systems Operations (SSA)

ATSAFE -- Automated System Access Forms Environment (SSA)

OSDD -- Office of Systems Design and Development (SSA)

OSR -- Office of Systems Requirements (SSA)

**Flow Chart of**

**Application For Access to XX agency Systems (Form XX agency-120)**

**Flow Chart of**

**Top Secret Resource Access Authorization (Form SSA-613)**

**Requests for Access to *[OCSE]{.underline}* Data from State CSEA
Employees, Federal OCSE Employees or OCSE Contractors**

**Flow Chart of**

**Top Secret Resource Access Authorization (Form SSA-613)**

**Requests for Access to *[SSA]{.underline}* Data from State CSEA
Employees, Federal OCSE Employees or OCSE Contractors**

[^1]: This document was written for a large application it can be
    modified to service as a chapter in an organization's information
    security manual by replacing any reference to one application with
    the words "all systems."