NYE Level II software Application software which is IT installed, fully ed and NYE licensed on an as needed basis for requested NYE workstations. Level II software requires a written Supervisor/Team Leader authorization request to the NYE IRM for approval prior to installation. NYE Level III Software Application software which IT verifies the license, installs the software on requested NYE workstations, but is not IT ed (personal production/organizational software i.e. an individually purchased Palm Pilot or Blackberry). If there is an issue with the installation of Level III software or the workstation performance after the installation, the workstation will be re-imaged. Level III software requires a written Supervisor/Team Leader authorization request to the NYE IRM for approval prior to installation. Revision History Author Date Comments Approved by Approved Date v 1.4 Author 01/17/16 Approver 01/18/16
ACCOUNT MANAGEMENT POLICY Introduction Computer accounts are the used to grant access to NYE information resources. These accounts provide a means of providing accountability, a key to any computer security program, for Information Technology usage. This means that creating, controlling, and monitoring all computer accounts is extremely important to an overall security program. Purpose The purpose of the NYE Account Management Security Policy is to establish the rules for the creation, monitoring, control and removal of user accounts. Account Management Policy All accounts created must have an associated request and approval that is appropriate for the NYE system or service. All users must sign the NYE Information Security Acknowledgement and Nondisclosure Agreement before access is given to an account. All accounts must be uniquely identifiable using the assigned user name. All default passwords for accounts must be constructed in accordance with the NYE Password Policy. All accounts must have a password expiration that complies with the NYE Password Policy.
Website: A location on the Wide Web, accessed by typing its address (URL) into a Web browser. A Web site always includes a home page and may contain additional documents or pages. Privacy Policy Electronic created, sent, received, or stored on information resources owned, leased, administered, or otherwise under the custody and control of NYE are not private and may be accessed by NYE IT employees, for business reasons at any time without knowledge of the information resource user or owner. To manage systems and enforce security, the NYE may log, review, and otherwise utilize any information stored on or passing through its IT systems in accordance with the provisions and safeguards provided in the Texas Administrative Code 202, Information Resource Standards. For these same purposes, the NYE may also capture User activity such as IP addresses and web sites visited. A wide variety of third parties have entrusted their information to NYE for business purposes, and all workers at the NYE must do their best to safeguard the privacy and security of this information. The most important of these third parties is the individual customer; customer account data is accordingly confidential and access will be strictly limited based on business need for access. Users must report any weaknesses in NYE computer security, any incidents of possible misuse or violation of this agreement to the proper authorities. An internal email address, , has been established within the NYE for reporting information security issues. must not attempt to access any data or programs contained on NYE systems for which they do not have authorization or explicit consent. Support Information This Policy is supported by the Security Policy Standard. Disciplinary Action Violation of this policy may result in disciplinary action may include termination. Additionally, individuals are subject to loss of NYE information resources access privileges, as well as civil and criminal prosecution. Violations of this policy or aggregate security policies are subject to the guides established in the Violations and Disciplinary Actions Policy of the NYE. Revision History Version Author Date Comments Approved by Approved Date v 1.0 Author Approver 07/20/2016
VENDOR ACCESS POLICY Introduction Vendors play an important role in the support of hardware and software management, and operations for customers. Vendors can remotely view, copy and modify data and audit logs, they correct software and operating systems problems; they can monitor and fine tune system performance; they can monitor hardware performance and errors; they can modify environmental systems, and reset alarm thresholds. Setting limits and controls on what can be seen, copied, modified, and controlled by vendors will eliminate or reduce the risk of loss of revenue, liability, loss of trust, and embarrassment to the NYE. Purpose The purpose of the NYE Vendor Access Policy is to establish the rules for vendor access to NYE information resources and support services (A/C, UPS, PDU, fire suppression, etc.), vendor responsibilities, and the protection of NYE information. Vendor Access Policy Vendors must comply with all applicable NYE policies, practice standards and agreements, including, but not limited to: Safety Policies Privacy Policies Security Policies Auditing Policies Software Licensing Policies Acceptable Use Policies Vendor agreements and contracts must specify: The NYE information the vendor should have access to How NYE information is to be protected by the vendor Acceptable methods for the return, destruction or disposal of NYE information in the vendor’s possession at the end of the contract