**MODULE 1**

**Introduction**

trainer notes

-   Display: Module 1, PowerPoint slide 1.

-   Throughout this course use every opportunity to emphasize the
    critical nature of management support for security.

```{=html}
<!-- -->
```
-   Generally speaking, employees will tend to engage in those behavior
    patterns and carry out those tasks they believe respond to
    management requirements.

-   Management's day-to-day practice of the security policies and
    procedures they have mandated is far more effective and convincing
    than being presented in a talk or through written communication.

-   Studies have proven that employees mimic management attitudes and
    actions. "Actions speak louder than words."

# Introduction

The training course---Child Support Enforcement Program: Securing the
Future: A Manager's Perspective---is designed to give managers an
overall sense of what they need to focus on to make security a priority
in the child support program. This course will provide managers with
information to use in their agencies to work toward the implementation
of an overall security plan.

We welcome your participation. This gives us a chance to exchange
experiences and learn from each other before returning to our respective
offices.

![](media/image1.wmf)This course is designed to focus on a manager's
awareness of privacy and security issues in the child support offices
they manage. Participants will be provided with an assessment of where
they are currently in security preparedness and will be provided helpful
tools for working toward implementing a successful security plan.

![](media/image2.wmf)

Training Notes

-   Introduction of Trainer(s)

-   Brief introduction to include: name, professional background, and
    training experience.

-   To deliver effective training, it is essential that the trainer have
    a high level of content mastery. The trainer must know the subject
    matter in depth in order to relay the information needed by the
    participants in fulfilling their job responsibilities. Trainers may
    opt to have a training team of two or more individuals who bring the
    combination of essential training skills and content mastery to the
    training experience.

-   Equipment/Supplies:

```{=html}
<!-- -->
```
-   Transparencies and overhead projector or;

-   PowerPoint slides, computer with MS PowerPoint (version 97 or
    higher) and a projection system

-   Projection screen

-   Flipchart stand with 2 pads of paper

-   Markers

-   Masking tape

-   Flannel boards (2)

-   Sign-in attendance roster

-   Course evaluation forms

-   Certificate (if applicable)

-   Name tents

-   "Security is Everyone's Responsibility" banner (optional, available
    from OCSE)

-   TV

-   VCR

-   "The Child Support Enforcement Programs-Securing the Future" video
    (available from OCSE)

-   TOT Course "The Child Support Enforcement Program: Securing the
    Future"

## target audience

The ultimate target audience for this training includes management staff
at all levels. The curriculum can easily be adapted to state-specific
use and policy, enabling trainers to tailor the material to meet a
specific audience's educational needs and interests.

training notes

-   Allow 5-10 minutes for participant introductions. Have each
    participant provide their:

```{=html}
<!-- -->
```
-   Name

-   Name of the agency/unit they represent

-   Position and/or area of responsibility

-   Briefly state their views on security. Are security measures
    necessary or unnecessary? Is there support for a solid security
    program in your agency?

-   Ask participants to indicate what security related issues they hope
    to get out of this course. Record their expectations on the
    flipchart. When finished, tape the flipchart pages around the room.

```{=html}
<!-- -->
```
-   Be sure to give ample opportunity for discussion. Establishing a
    comfortable environment now will give the class the confidence they
    need to participant throughout. It will also give you valuable
    information about the participants' feelings about security.

-   Advise participants to be considerate of others and turn off beepers
    and cell phones.

-   Be sure to cover all administrative tasks.

-   Explain the Participant Manual and how it should be used for note
    taking and as a guide. Be sure to call attention to the resource and
    reference material in the Appendices.

-   Point out to participants that copies of all of the PowerPoint
    slides we will present appear on each page in the Participant
    manual.

-   The training manual has extensive trainer notes on the left-hand
    page. To create participant manuals all that is necessary is to
    remove the pages with the trainer notes.

-   The information on the TRAINING NOTES pages is designed for the
    trainer to be able to provide additional information to the
    participants.

-   Information that the trainer should tell the participants is in
    italicized text on the TRAINING NOTES pages. The entire curriculum
    can be covered in a half day for up to a maximum of 25 participants.

## Introductions 

### Student Introductions

Introduction Exercise

### Training Schedule, Facilities, and Administrative Tasks

Class hours

Announcement of breaks

Time and length of lunch

Lunch/snack facilities

Location of phones

Location of restrooms and water fountain

Smoking policy

Emergency phone number

Attendance roster

Name badges or name tents

Participant manuals

training notes

-   Display: Module 1, PowerPoint slide 2 and explain bullet points.

```{=html}
<!-- -->
```
-   Security often focused on "systems" or the traditional "blue suit"
    mentality of security guards. This often made it very easy to think
    of security as someone else's job. Technology has revolutionized the
    child support program. The whole scope of security needs to change
    to keep pace with the technology in the child support program and
    the change begins at the top---with management.

## security

Security---What picture comes to mind when someone mentions the word
security?

### Traditional Views on Security

![](media/image3.wmf)

Traditionally when we speak of security we think of men walking around
in blue suits flashing a security badge and uniformed security guards.
Child support managers tend to look at security as a very low priority
and deal with security issues as they happen---reactively not
proactively. In the past, this may have been appropriate.

training notes

-   Display: Module 1, PowerPoint slide 3.

```{=html}
<!-- -->
```
-   Technology has brought us many advancements, advantages, and
    disadvantages.

```{=html}
<!-- -->
```
-   It is a good idea to have some visual aid to emphasize these
    advantages that technology has provided. For example, the May 15,
    2000 issue of Newsweek
    ([www.newsweek.com](http://www.newsweek.com/)) on Page 12 shows the
    newest fads in "cyberscope." Access to the web in elevators, at the
    ATM machine, and a LazyBoy recliner with a built-in keyboard. The
    June 2-4, 2000 issue of USA Weekend (Newspaper insert) has articles
    on gaining medical help on the web, "Buying Your Dream House on the
    Web", and a "Beginner's Guide to Online Investing."

## Security in the New MillenNium

Security of yesterday is no longer sufficient. What does security look
like in the new millennium?

![](media/image4.wmf)

training notes

-   Display: Module 1, PowerPoint slide 4 and explain bullet points.

-   Ask participants if they remember the movie that had Sandra Bullock
    in it called "The Net"? Remember the bad guys erased her driver\'s
    license from the computer databanks, then her bank accounts, and
    finally all mention of her whatsoever. Welcome to the crime of
    identity theft.

-   Ask participants if they have ever heard of identity theft?

```{=html}
<!-- -->
```
-   Identity theft is an absolute epidemic. Hardly a week goes by that
    either the newspaper, magazines or television doesn't carry stories
    of identity theft. It affects everybody, there is very little you
    can do to prevent it---and worst of all, you can't detect it until
    it is probably too late. It is estimated that identity theft is
    affecting 500,000 new victims each year. Trans Union, one of the
    nation's three major credit bureaus, reported they receive
    approximately 1,400 calls per day from identity theft victims.

```{=html}
<!-- -->
```
-   If the majority of participants are not familiar with Identity Theft
    or have not attended "The Child Support Program: Securing the
    Future" for the child support worker, this would be an appropriate
    time to show the 48 Hours video segment. Tell participants that we
    are going to look at a segment of a "48 Hours" episode dealing with
    identity theft. Mention that many news shows have now done segments
    on this topic.

-   After the video has been shown, ask if anyone has ever been a victim
    of identify theft or known someone who has. Discuss the bullet
    points in discussion items and record discussion items on flipchart.

-   Give participants the Handout: ID Theft When Bad Things Happen to
    Your Good Name. Advise participants that this packet includes
    information on how to minimize your risk of becoming a victim of
    identity theft, what to do if you become a victim, help that is
    available to victims, and how to resolve credit problems that occur
    as a result. There is also a list of resources to provide
    assistance.

-   Ask participants if identify theft could be an issue with the data
    housed by the child support program? Absolutely. All the thief needs
    is a name, address, and Social Security number. How many documents
    and reports in our offices contain this information---90% or more?

### Identify Theft 

Identity theft is reaching epidemic proportions. What is Identity Theft?
Identity theft, or using someone else's name for financial or other
gain, is rapidly becoming an epidemic in the "Information Age."

-   Tens of thousands of Americans have been victims of identity theft.
    Imposters run up huge debts, file for bankruptcy, and commit serious
    crimes. It can take years for victims to restore their credit
    ratings and their reputations.

    ![](media/image5.wmf)

training notes

-   Display: Module 1, PowerPoint slide 5 and explain bullet points.

```{=html}
<!-- -->
```
-   In February 2000 a number of Top 10 web sites lost an estimated
    \$1.2 billion due to denial-of-service hacker attacks.
    Capitalization losses that exceed \$1 billion on the days of the
    attacks, and revenue loss of both sale and advertisement is expected
    to exceed \$100 million for sites such as eBay, Buy.com, e-Trade,
    and Amazon.com.

-   The government is getting bent out of shape about this. The attacks
    were a wake-up call to the fragility of the Net and kicked off a
    worldwide dragnet in search of "cyberperps." The Environmental
    Protection Agency (EPA) was asked to shut down its Internet
    connection until it improves its Net security. That request came
    after the General Accounting Office (GAO) investigators found they
    could easily hack into EPA's main computer systems from the
    Internet.

-   At a White House high tech summit, some of the biggest companies in
    high technology and the online world are proposing an effort similar
    to the big push to eliminate [Y2K](mailto:Y@K) glitches to improve
    computer and internet security. **Many companies have skimped on
    security in the past because it has not been seen as helping a
    company's bottom line or visibility.**

-   On a "smaller" scale, a little more than a month ago a hacker
    calling himself "Maxim" exploited bugs in software at an online
    music retailer, CDUniverse. He lifted 300,000 credit card numbers.
    He tried something relatively new to online crime: extortion. He
    said he'd destroy the records for \$100,000. Otherwise he'd post
    them on the Net. And that's exactly what he did. On Christmas Day he
    began listing the credit card numbers, names and addresses online.
    CDUniverse refused to pay and called in the Feds, while credit card
    companies began re-issuing cards. Note: The FBI web site was hacked
    last year and they still haven't caught the perpetrators.

```{=html}
<!-- -->
```
-   Ask participants how this may impact the child support program? Web
    based technology is quickly becoming attractive for the child
    support program. Security of the confidential data is critical. In
    Module 2 we will explore some of the viruses that can have an impact
    on the child support program as well as how a hacker can gain access
    through a PC in your office.

### Cybercrime {#cybercrime .unnumbered}

It is, simply, the story of the age---how technology is changing the way
we spend our time and money. The Internet and businesses are rapidly
converging. E-security is being turbo-charged by the rise of **computer
hackers**.

-   A new breed of security firms is being born, and many are hiring
    "hacker trackers" to locate intruders.

![](media/image6.wmf)

TRAINING NOTES

-   Display: Module 1, PowerPoint slide 6 and explain bullet points.

```{=html}
<!-- -->
```
-   Technology has changed the rules of privacy. We go through life
    inadvertently dropping crumbs of data about ourselves---providing
    data to "data warehouses," marketing companies, and businesses.

-   Doubleclick is a firm that has compiled profiles of roughly 100
    million Internet users. They track where people go online. Privacy
    advocates were outraged when Doubleclick began attaching names,
    addresses, and phone numbers to the profiles that were formerly
    anonymous.

### Internet Access

Are You for Sale? The web is a great place to do research about
everything and everyone---whether you know it or not. **Huge databases**
compile information about people from names, addresses to credit card
numbers.

-   The Internet works by sending information from computer to computer
    until the information reaches its destination. When data is sent
    from point A to point B, every computer and network in between
    provides an opportunity for someone to look at what is being sent.
    This can pose a security problem. Unfortunately, one of the
    computers in between could be infiltrated by criminals who watch the
    data passing through until they see something interesting, such as
    your credit card number.

    ![](media/image7.wmf)

training notes

-   Display: Module 1, PowerPoint slide 7 and explain bullet points.

-   Tell participants that we are going to look at a segment of a "60
    Minutes" episode dealing with DoubleClick and data mining.

### "60 Minutes" Video Segment

![](media/image8.wmf)

training notes

-   Display: Module 1, PowerPoint slide 8 and explain bullet points.

```{=html}
<!-- -->
```
-   According to the FBI, workplace violence is the number one growing
    crime in the United States.

-   "Every year approximately 1.5 million people are victims of nonfatal
    workplace violence. Most of these assaults occur in service settings
    such as hospitals, nursing homes, and social service agencies.
    Another 1,000 workers each year are victims of workplace violence."
    Quote by Secretary Shalala.

-   One type of prevention that managers can use to limit workplace
    violence is a thorough confidential background check. We will
    explore this in Module 3.

```{=html}
<!-- -->
```
-   In addition to the injured employee, workplace violence leads to
    loss of productivity, law suits, legal expenses, property damage and
    possibly a diminished public image. An Emergency Preparedness Plan
    will help minimize chaos in the event of workplace violence. Refer
    to page A-2 of Appendix A for suggestions on information to be
    contained in a Sample Workplace Violence Emergency Preparedness
    Plan.

```{=html}
<!-- -->
```
-   Ask how many participants have a written plan of action should
    workplace violence occur?

-   The guidelines and recommendations from OSHA contain three basic
    elements for workplace prevention:

1.  Management commitment and employee involvement. May include simply
    clear goals for worker security.

2.  Worksite analysis. Involves identifying high-risk situations through
    employee surveys, workplace walkthroughs, and reviews of
    injury/illness data.

3.  Training and education. Ensures that employees know about potential
    security hazards and ways to protect themselves and their
    co-workers.

### Workplace Violence

Violence in the workplace takes many forms, from raised voices and
profanity or sexual harassment to robbery or homicide.

-   Workplace violence costs employers almost two million lost workdays
    each year.

-   Protect your employees, your business, and yourself.

    ![](media/image9.wmf)

training notes

-   Display: Module 1, PowerPoint slide 9 and explain bullet points.

```{=html}
<!-- -->
```
-   To assess a workplace\'s vulnerability to violence, management
    should look at the following areas:

```{=html}
<!-- -->
```
-   Is your office secure? Do you have easy-to-use phone systems with
    emergency buttons, sign-in policies for visitors, panic buttons,
    safe rooms, security guards, office access controls, good lighting,
    and safety training? (These issues will be addressed in detail in
    Module 4)

-   Does your employer take care in hiring and firing? Before hiring,
    are employment gaps, history, references, and criminal and
    educational records thoroughly examined? Are termination procedures
    defined clearly with attention to advance notice, severance pay, and
    placement services? (These issues will be addressed in detail in
    Module 3)

-   Could you recognize potentially violent employees? Signs of stress
    that could erupt into violence include: depression, frequent
    absences, talking in a louder-than-normal voice, being startled
    easily, increased irritability and impatience, and concentration and
    memory problems.

```{=html}
<!-- -->
```
-   Employers have a common law duty to exercise reasonable care when
    hiring and retaining workers and can be liable for employees actions
    both within and outside of the scope of employment where the
    employer knew or should have known that the employee poses a risk to
    others.

-   In the Department of Health and Human Resources, Office of the
    Inspector General's report on Workplace Violence, a child support
    worker is quoted as saying: "With more enforcement tools available,
    noncustodial parents are getting angrier all the time. With the
    increased power provided to us to collect money, file liens, and
    seize assets, comes the greater risk that our actions may be all
    that is needed to push someone over the edge."

### Where Does the Liability Lie for Workplace Violence?

Employers have a general duty to furnish each employee with employment
and a place of employment that is free from recognized hazards that are
causing, or likely to cause, death or serious harm to the employee under
federal and state OSHA regulations.

-   An employer may be held liable for failing to take adequate safety
    and security measures.

-   Employers may be held liable on the grounds of negligent hiring or
    negligent retention of an employee who has a known propensity for
    violence.

    ![](media/image10.wmf)

Training notes

-   Display: Module 1, PowerPoint slide 10 and explain bullet points.

```{=html}
<!-- -->
```
-   We have talked about the identity theft, cybercrime, and check
    washing, what does all this have to do with the child support
    program? Let's take a look at some child support statistics.

-   The child support program has improved dramatically in the last few
    years:

```{=html}
<!-- -->
```
-   in FY 1997 there were 19.1 million child support cases

-   In FY 1998 a record \$14.3 billion was collected in child support
    (an increase of \$6.3 billion or 79% since 1992)

```{=html}
<!-- -->
```
-   So, who is in the NDNH? This is a national directory of employment
    information. Everyone in this room is in there! Either you are
    reported because you are newly hired, or are reported as a result of
    the quarterly wage match and it contains information on unemployment
    insurance claimants.

## FPLS

The Child Support Program has access to an unprecedented amount of
confidential information, which has improved the program dramatically.
In fiscal year 1999 the child support program collected \$15.5 billion,
which nearly doubled the amount collected in 1992.

### NDNH

National Directory of New Hires (NDNH). The NDNH is a database
consisting of newly hired employee data, quarterly wage data, and
unemployment compensation claimant information. As of September 1999,
the National Directory of New Hires (NDNH) contained over 1 billion
employment and uninsurance claimant records.

### FCR

Federal Case Registry---National registry of participants in child
support cases, constructed from abstracts of participant and case
information that State Case Registries transmit electronically.

As of September 1999, the Federal Case Registry (FCR) contained over 12
million child support cases.

![](media/image11.wmf)

training notes

-   Display: Module 1, PowerPoint slide 11 and explain bullet points.

### Risks

With all the confidential data stored in the child support systems comes
added risks.

-   What would happen if your agency lost access to the vital resources
    you now have? You would be out of business. It is the manager's
    responsibility to ensure that appropriate risks are evaluated and
    proper actions taken to provide safety in the workplace.

-   Managers can be held liable for the issue of negligence. Negligence
    can be in the form of hiring appropriate personnel through taking
    appropriate security measures---for the people, the physical
    location and security of data. It is far better to have security
    measures in place than to face gross negligence.

-   Supervisory and management personnel should be assigned
    responsibility for both performance and attitude of staff with
    respect to security.

    ![](media/image12.wmf)

training notes

-   Display: Module 1, PowerPoint slide 12 and explain bullet points.

## Why is security so important? 

We live in the "Age of Information." Information is power, and more
efficient and comprehensive access to automation translates into more
power. Today, information is one of the most important assets of the
child support program. Protecting information and the infrastructure
that processes and maintains information is critical to the continuance
of the program.

> ![](media/image13.wmf)

training notes

-   Security is everyone's responsibility. Now let's discuss the
    manager's perspective and how a manager's actions dictate staff
    perception of security.

```{=html}
<!-- -->
```
-   Display: Module 1, PowerPoint slide 13 and explain bullet points.

-   As we work through today's training, it is important to keep in mind
    that the purpose of the training is to focus on the many security
    issues managers face in today's Child Support program. As we explore
    the many ways that security can be breached, questions of local
    policy may arise. It is the job of the trainer to acknowledge those
    questions but to refer them to the appropriate person. We suggest
    that, prior to the session, the trainer establish a policy contact
    to whom questions or issues may be referred.

```{=html}
<!-- -->
```
-   Some of the tools include New Hire Directories, the Federal Case
    Registry, National Law Enforcement Tracking System (NLETS), credit
    bureaus, licensing agencies, and the IRS.

```{=html}
<!-- -->
```
-   Ask the participants to name other resources available to the Child
    Support Program.

-   Introduce the security trilogy and lead into the modules that we
    will cover today.

## What is the manager's role?

Management must concern itself with safeguarding the resources under its
jurisdiction. Technology is revolutionizing the way we do business. The
manager's function is to protect human and information resources in a
technologically challenging and risk-filled environment. Top management
must concern itself with adequate recognition of the risks in order to
be assured that adequate protective measures are in place.

-   Remember, child support agencies are in an enviable position with
    regards to their investigatory tools. Child support staff have
    privileged access to many resources unavailable to other
    governmental agencies and private entities. We, as managers, must
    take every precaution to protect this confidential data.

-   Should the trust be broken, should child support agencies become lax
    resulting in a breach in confidentiality, privileged access could be
    significantly curtailed, if not lost completely.

![](media/image14.wmf)

training notes

-   Display: Module 1, PowerPoint slides 14 and 15 and explain bullet
    points.

## Course topics

During this course we will cover security as a "trilogy", covering the
following topics: data, people, and facility security.

![](media/image15.wmf)

![](media/image16.wmf)

training notes

-   Display: Module 1, PowerPoint slide 16.

```{=html}
<!-- -->
```
-   How prepared are you?

```{=html}
<!-- -->
```
-   Tell participants that we are now going to do a short assessment of
    their personnel practices. This should be done individually.
    Participants should take an honest look at their respective
    personnel procedures. Make sure participants understand that this
    will not be collected but is to be used as an evaluation piece to
    see where their security measures may need improvements.

-   Advise participants that a complete copy of the Assessment Tool is
    located in Appendix A on page 20.

## Assessment Tool

![](media/image17.wmf)

training notes

-   This data protection assessment tool is designed to help you assess
    your strengths and weaknesses with respect to data protection
    issues. Please evaluate each area carefully. As we go through the
    next module we will focus on each area and give you information that
    will help you to prepare, implement, modify, or improve on your data
    protection procedures.

```{=html}
<!-- -->
```
-   Allow about 15 minutes for participants to complete this assessment.

-   Advise participants that this leads us into Module 2: Data: What
    Measures Should be Taken to Ensure that Child Support Data is
    Protected.

-   Advise participants that we will go through the assessment and see
    if there are other areas that should be covered at the end of module
    2.

+-----------------------------------------------------------------------+
| **SECURITY ASSESSMENT TOOL**                                          |
|                                                                       |
| > **[Rating Scale]{.underline}**                                      |
| >                                                                     |
| > **1 = Fully Implemented**                                           |
| >                                                                     |
| > **2 = Implementation Planned**                                      |
| >                                                                     |
| > **3 = Non-Existent**                                                |
+-----------------------------------------------------------------------+

+-----------------------------------+-----------------------------------+
| **[Technical                      | > **[1]{.underline}               |
| (Data)]{.underline}**             | > [2]{.underline}                 |
|                                   | > [3]{.underline}**               |
+-----------------------------------+-----------------------------------+
| 1.  Employees follow strict       |                                   |
|     password and log-on           |                                   |
|     protection procedures.        |                                   |
+-----------------------------------+-----------------------------------+
| 2.  Virus detection and           |                                   |
|     elimination software is       |                                   |
|     installed on each personal    |                                   |
|     computer.                     |                                   |
+-----------------------------------+-----------------------------------+
| 3.  Virus detection and           |                                   |
|     elimination software is       |                                   |
|     regularly updated             |                                   |
|     automatically or manually.    |                                   |
+-----------------------------------+-----------------------------------+
|                                   |                                   |
+-----------------------------------+-----------------------------------+
| 4.  Audit trails are established  |                                   |
|     and monitored to              |                                   |
|     prevent/reduce misuse of      |                                   |
|     data.                         |                                   |
+-----------------------------------+-----------------------------------+
| 5.  Terminals are monitored       |                                   |
|     closely to prohibit the       |                                   |
|     installation of off-the-shelf |                                   |
|     and pirated software.         |                                   |
+-----------------------------------+-----------------------------------+
| 6.  User access is restricted to  |                                   |
|     minimum necessary to perform  |                                   |
|     the job.                      |                                   |
+-----------------------------------+-----------------------------------+

Training notes

+-----------------------------------------------------------------------+
| **SECURITY ASSESSMENT TOOL**                                          |
|                                                                       |
| > **[Rating Scale]{.underline}**                                      |
| >                                                                     |
| > **1 = Fully Implemented**                                           |
| >                                                                     |
| > **2 = Implementation Planned**                                      |
| >                                                                     |
| > **3 = Non-Existent**                                                |
+-----------------------------------------------------------------------+

+--------------------------------+----------------------+---------+---+
| 7.  System tests are regularly |                      |         |   |
|     conducted to determine if  |                      |         |   |
|     it is "hacker" proof.      |                      |         |   |
+--------------------------------+----------------------+---------+---+
| 8.  All connections go through |                      |         |   |
|     a "firewall" system.       |                      |         |   |
+--------------------------------+----------------------+---------+---+
| 9.  Transmission of sensitive  |                      |         |   |
|     data is protected from     |                      |         |   |
|     unauthorized disclosure    |                      |         |   |
|     through encryption.        |                      |         |   |
+--------------------------------+----------------------+---------+---+
|                                |                      |         |   |
+--------------------------------+----------------------+---------+---+
| **TOTAL =**                    |                      |         |   |
+--------------------------------+----------------------+---------+---+
| **[Scoring]{.underline}**      |                      |         |   |
|                                |                      |         |   |
| **Total this section adding    |                      |         |   |
| the value from each column     |                      |         |   |
| (1=1, 2=2, 3=3)**              |                      |         |   |
|                                |                      |         |   |
| **If you scored:**             |                      |         |   |
|                                |                      |         |   |
| **9-11 = No action             |                      |         |   |
| necessary.**                   |                      |         |   |
|                                |                      |         |   |
| **12-27 = Your technical       |                      |         |   |
| resources may need to be       |                      |         |   |
| reviewed to tighten security.  |                      |         |   |
| Review the technical section   |                      |         |   |
| and carefully evaluate any     |                      |         |   |
| answers that are marked 2 or   |                      |         |   |
| 3.**                           |                      |         |   |
|                                |                      |         |   |
| **\*For information and        |                      |         |   |
| resources available from OCSE  |                      |         |   |
| on Security see page 14:       |                      |         |   |
| Security Resources.**          |                      |         |   |
+--------------------------------+----------------------+---------+---+