TN: DT-06-15

To: NRC Management Directives Custodians

Subject: Transmittal of Directive 2.7, "Personal Use of Information

Technology"

Purpose: Directive and Handbook 2.7 are being revised to

change the originating office from the Office of the

Chief Information Officer to the Office of Information

Services.

Office of Origin: Office of Information Services

Contact: Thomas Rich, 301-415-7458

Date Approved: February 27, 2003 (Revised: July 28, 2006)

Volume: 2 Information Technology

Directive: 2.7 Information Technology

Availability: Rules and Directives Branch

Office of Administration

Michael T. Lesar, 301-415-7163

Christy Moore, 301-415-7086

U.S. NUCLEAR REGULATORY COMMISSION

DIRECTIVE TRANSMITTAL

OFFICE OF ADMINISTRATION
Personal Use of

Information Technology

Directive

2.7
Volume 2, Information Technology

Personal Use of Information Technology

Directive 2.7

Approved: February 27, 2003 iii

(Revised: July 28, 2006)

Contents

Policy ....................................................... 1

Objectives ................................................... 1

Organizational Responsibilities and

Delegations of Authority ................................. 1

Director, Office of Information Services (OIS) ......................... 1

Director, Office of Human Resources (HR) ........................... 2

General Counsel (GC) ........................................... 2

Inspector General (IG) ........................................... 2

Office Directors and Regional Administrators ......................... 2

Applicability ................................................. 3

Handbook .................................................... 3

References .................................................. 3
Approved: February 27, 2003 1

(Revised: July 28, 2006)

U. S. Nuclear Regulatory Commission

Volume: 2 Information Technology OIS

Personal Use of Information Technology

Directive 2.7

Policy

(2.7-01)

It is the policy of the U.S. Nuclear Regulatory Commission to

permit employees limited use of agency information technology for

personal needs if the use does not interfere with official business

and involves minimal or no additional expense to the NRC. (011)

Management Directive (MD) 2.7 supersedes the guidelines of

MD 12.5, “NRC Automated Information Security Program,” Part II,

Section C(1), regarding individual use of automated information

systems. In every other respect, application of this directive

remains subordinate to the other requirements of the NRC

Security Program, as described in Chapter 12 of the NRC

Management Directives System. (012)

Objectives

(2.7-02)

To define acceptable conditions for NRC employees' personal use

of information technology.

Organizational Responsibilities and

Delegations of Authority

(2.7-03)

Director, Office of Information Services (OIS)

(031)

• Ensures that agency policy is consistent with Federal statutes

and regulations related to information technology. (a)
Volume 2, Information Technology

Personal Use of Information Technology

Directive 2.7

2 Approved: February 27, 2003

(Revised: July 28, 2006)

Organizational Responsibilities and

Delegations of Authority

(2.7-03) (continued)

Director, Office of Information Services (OIS)

(031) (continued)

• Establishes guidelines to ensure that limited personal use of

information technology does not interfere with official business

and results in minimal or no additional expense to the NRC. (b)

Director, Office of Human Resources (HR)

(032)

Provides advice and guidance related to the use of information

technology pursuant to MD 2.7 and to the conduct of employees.

General Counsel (GC)

(033)

Provides legal opinions and advice related to the appropriate use

of information technology.

Inspector General (IG)

(034)

Conducts audits and investigations related to all NRC programs

and operations.

Office Directors and 

Regional Administrators

(035)

Ensure that employees' personal use of information technology is

consistent with policy.
Volume 2, Information Technology

Personal Use of Information Technology

Directive 2.7

Approved: February 27, 2003 3

(Revised: July 28, 2006)

Applicability

(2.7-04)

The policy and guidance in this directive and handbook apply to

all NRC employees, including Special Government Employees.

NRC contractors are prohibited from personal use of agency

information technology.

Handbook

(2.7-05)

Handbook 2.7 provides guidelines to NRC employees for

acceptable personal use of information technology.

References

(2.7-06)

Code of Federal Regulations, 5 CFR Part 2635, “Standards of

Ethical Conduct for Employees of the Executive Branch.”

Departmental Regulations (5 U.S.C. 301).

Executive Order (E.O.) 12674, “Principles of Ethical Conduct for

Government Officials and Employees,” April 12, 1989, as modified

by E.O. 12731, “Principles of Ethical Conduct for Government

Officers and Employees,” October 17, 1990.

“Recommended Executive Branch Model Policy/Guidance

on ‘Limited Personal Use’ of Government Office Equipment

Including Information Technology,” Federal Chief Information

Officer Council, May 19, 1999.
Personal Use of

Information Technology

Handbook

2.7
Volume 2, Information Technology

Personal Use of Information Technology

Handbook 2.7

Approved: February 27, 2003 iii

(Revised: July 28, 2006)

Contents

Personal Use of Information Technology ........................ 1

General (A) ................................................... 1

Definitions (B) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

Specific Provisions on the Use of Equipment and Services (C) ........... 3

Inappropriate Personal Uses (D) ................................... 3

Proper Representation (E) ....................................... 6

Privacy Expectations (F) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

Sanctions for Misuse (G) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Volume 2, Information Technology

Personal Use of Information Technology

Handbook 2.7

Approved: February 27, 2003 1

(Revised: July 28, 2006)

Personal Use of Information Technology

General (A)

New technology, such as computers, facsimile machines, and the

Internet, has made it possible for employees to more efficiently

manage their careers and their personal lives. The policy

established herein allows NRC employees to use agency

information technology for personal reasons when such use

involves minimal or no additional expense to the Government, is

performed on the employee's non-work time, does not interfere

with NRC's mission or operation, does not violate the Standards

of Ethical Conduct for Employees of the Executive Branch

regulations, and is not otherwise prohibited by law. (1)

The relationship between NRC and an employee is based on trust.

Consequently, employees are expected to follow rules and

regulations and to be responsible for their own personal and

professional conduct. (2)

NRC is extending the opportunity to its employees to use

Government property for personal use in an effort to create a more

supportive work environment. In this sense, the policy grants a

privilege, not a right, to use agency information technology for

certain non-Government purposes. (3)

Definitions (B)

Employee non-work time. Times when the employee is not

otherwise expected to be addressing official business. Employees

may, for example, use agency information technology during their

own off-duty hours such as before or after a workday (subject to

local office hours), lunch periods, or weekends or holidays (if their

duty station is normally available at such times). (1)
Volume 2, Information Technology

Personal Use of Information Technology

Handbook 2.7

2 Approved: February 27, 2003

(Revised: July 28, 2006)

Definitions (B) (continued)

Information technology. Any equipment or interconnected

system or subsystem of equipment that is used in the automatic

acquisition, storage, manipulation, management, movement,

control, display, switching, interchange, transmission, or reception

of data or information. This equipment includes personal

computers and related peripheral equipment (e.g., printers),

software, telephones, pagers, facsimile machines, photocopiers,

e-mail, Internet connectivity and access to Internet services. (2)

Minimal additional expense. Little or no increase in cost to the

Government. An employee's personal use of agency information

technology is limited to those situations in which the agency is

already providing equipment or services. The employee's use of

such equipment or services should result in only minimal or no

additional expense to the agency, only normal wear and tear on

equipment, and the expenditure of only small amounts of

electricity, ink, toner, or paper. Examples of activities that incur

only minimal additional expense include making a few

photocopies, using a computer printer to print out a few pages of

material, infrequently sending personal e-mail messages, or other

limited use of the Internet for personal reasons. In addition, brief

telephone calls or short facsimile transmittals within the local

calling area are also acceptable. (3)

Personal use. An employee's activity that is conducted for

purposes other than accomplishing official or otherwise authorized

activity. NRC employees are specifically prohibited from using

agency information technology to maintain or support a personal,

private business. Examples of this prohibition include employees

using an agency computer and Internet connection to run a travel

business or an investment service. The ban on using agency

information technology to support a personal, private business

also includes employees using agency information technology to

assist relatives, friends, or other persons in such activities.

Employees may, however, make limited use under this policy of

agency information technology to, for example, check their Thrift

Savings Plan or other personal investments, to seek employment,
Volume 2, Information Technology

Personal Use of Information Technology

Handbook 2.7

Approved: February 27, 2003 3

(Revised: July 28, 2006)

Definitions (B) (continued)

to communicate with a volunteer charity organization, or to file a

Freedom of Information Act or Privacy Act request (see

Section (E) regarding proper representation). (4)

Specific Provisions on the Use of 

Equipment and Services (C)

Authorized limited personal use of agency information technology

must not result in loss of employee productivity and must not

interfere with official duties. The use of the agency's information

technology for official business has priority over personal use.

Moreover, such use should incur only minimal or no additional

expense to the agency in such areas as—

• Communications infrastructure costs (e.g., telephone charges,

data traffic) (1)

• Limited use of consumables (e.g., paper, ink, toner) (2)

• General wear and tear on equipment (3)

• Data storage on storage devices (4)

• Transmission of moderately sized e-mail messages and

attachments (5)

Inappropriate Personal Uses (D)

Employees are expected to conduct themselves professionally

in the workplace and to refrain from using agency

information technology for activities that are inappropriate. Misuse

or inappropriate personal use of agency information technology

includes— (1)
Volume 2, Information Technology

Personal Use of Information Technology

Handbook 2.7

4 Approved: February 27, 2003

(Revised: July 28, 2006)

Inappropriate Personal Uses (D) (continued)

• Any personal use that could cause congestion, delay, or

disruption of service to any agency system or equipment.

Examples of possible misuse include automated greeting cards

and video, sound, or other large file attachments that can

degrade the performance of the entire network. (a)

• Use of the agency systems as a staging ground or platform to

gain unauthorized access to other systems. (b)

• The creation, copying, transmission, or retransmission of chain

letters or other unauthorized mass mailings regardless of the

subject matter. (c)

• Use of agency information technology for activities that are

illegal, inappropriate, or construed as justifiably offensive to

fellow employees or the public. Such activities include, but are

not limited to, hate speech or material that ridicules others on

the basis of race, age, parental status, religion, color, sex,

disability, national origin, or sexual orientation. (d)

• Use of information technology, including telephone or facsimile

service, to create, download, view, store, copy, transmit, or

receive sexually explicit or sexually oriented materials or

materials related to illegal gambling, illegal weapons, terrorist

activities, and any other illegal activities or activities otherwise

prohibited. (e)

• Use of information technology for commercial purposes or in

support of “for-profit” activities or in support of other outside

employment or business activity (e.g., consulting for pay, sales

or administration of business transactions, sale of goods or

services). (f)

• Engaging in fundraising activities (except as provided in 5 CFR

950.102), endorsing any product or service, participating in any

lobbying activity, or engaging in any prohibited political

activity. (g)
Volume 2, Information Technology

Personal Use of Information Technology

Handbook 2.7

Approved: February 27, 2003 5

(Revised: July 28, 2006)

Inappropriate Personal Uses (D) (continued)

• Use of information technology for posting agency information

to external newsgroups, bulletin boards, or other public forums

without authority. This includes any use that could create the

perception that the communication was made in one's official

capacity as an NRC employee, unless appropriate agency

approval has been obtained or the employee uses an

appropriate disclaimer. (h)

• Any use of information technology prohibited by Management

Directive (MD) 2.3, “Telecommunications.” Generally, this

category precludes personal use of long distance telephone or

long distance facsimile service and use of cellular telephones

and message pagers. However, MD 2.3 does permit personal

use of these services under certain circumstances. (i)

• The unauthorized acquisition, use, reproduction, transmission,

or distribution of any controlled information, including computer

software or data that includes privacy information, copyright,

trademark, or material with other intellectual property rights

(beyond fair use), proprietary data, or export-controlled

software or data. (j)

• Any use of information technology involving modification of

agency equipment, including configuration changes or loading

of personal software. (“Personal” means “not provided by the

Government.” “Software” generally refers to executable code,

as opposed to data, documents, electronic mail, images, or

spreadsheets.) Guidelines regarding the use of software for

agency business are provided in MD 12.5, “NRC Automated

Information Security Program.” (k)

• Any other activity that interferes with official duties. (l)

Employees should report any instance of abuse, fraud, or other

wrongdoing to the Office of the Inspector General. (2)
Volume 2, Information Technology

Personal Use of Information Technology

Handbook 2.7

6 Approved: February 27, 2003

(Revised: July 28, 2006)

Proper Representation (E)

It is the responsibility of employees to ensure that they are not

giving the false impression that they are acting in an official

capacity when they are using agency information technology for

non-Government purposes. If there is an expectation that such a

personal use could be interpreted to represent the NRC (e.g., use

of the “nrc.gov” domain name in the return address of an e-mail

message), then an adequate disclaimer must be used. One

acceptable disclaimer is “The contents of this message are mine

personally and do not reflect any position of the NRC.” Employees

should also avoid using other forms of agency identification, such

as letterhead stationery, in situations in which they represent

themselves as private citizens rather than NRC employees (e.g.,

submitting a Freedom of Information Act request).

Privacy Expectations (F)

NRC employees do not have a right, nor should they have an

expectation, of privacy while using any agency information

technology at any time, including accessing the Internet or using

e-mail. To the extent that employees wish that their private

activities remain private, they should avoid using agency

information technology such as their computer, the Internet, voice

mail, or e-mail. By using agency information technology, NRC

employees imply their consent to disclosing the contents of any

files or information maintained in, or passing through, agency

equipment.

Sanctions for Misuse (G)

Unauthorized use of agency information technology could result in

any or all of the following: loss of use or limitations on use of

equipment, disciplinary or adverse actions, criminal penalties, and

employees being held financially liable for the cost of improper

use.