Federal Retirement Thrift Investment Board’s Rules of Behavior for Accessing IT Systems
July 2020 Update 1
All data contained on information systems in support of the Federal Retirement Thrift Investment Board (FRTIB or Agency) is owned by the FRTIB. User activity may be monitored, intercepted, recorded, read, copied, captured, or disclosed by authorized FRTIB personnel. FRTIB may give law enforcement officials any potential evidence of crime, fraud, or employee misconduct found on FRTIB information systems. Furthermore, law enforcement officials may be authorized to access and collect evidence from these systems. USE OF THIS SYSTEM BY ANY USER, AUTHORIZED OR UNAUTHORIZED, CONSTITUTES EXPRESS CONSENT TO MONITORING.
I understand and acknowledge:
1. Policies and Procedures: a. Federal Employees: I will abide by all Agency policies and procedures. b. Contractor Employees: I will abide by the Agency policies and procedures
applicable to me in connection with the services provided to the Agency under the scope of my employer’s contract. The Agency will provide me with access to all applicable policies and procedures.
2. I HAVE NO REASONABLE EXPECTATION OF PRIVACY while using any information system that processes, transmits, or stores FRTIB data.
3. I understand and acknowledge monitoring includes, but is not limited to the review of: a. Audit logs of any IT device used to support FRTIB; b. Access and use of the Internet while on the FRTIB network; c. Electronic communication activity; or d. Any device used to process FRTIB data (regardless of device ownership).
4. I shall successfully complete FRTIB Cyber Security Awareness training and Privacy Awareness training at the time of onboard and on an annual basis. I shall also complete any additional information technology, security, records management, and privacy training as required. If any required training is not completed, access to FRTIB information systems will be suspended.
5. I may have access to Controlled Unclassified Information (CUI) depending on my job duties. I shall protect the confidentiality1, integrity2, and availability3 of FRTIB information in a manner consistent with its sensitivity.
6. I will use FRTIB information only in connection with the performance of my official duties. I will not disclose FRTIB information to unauthorized persons. I will not use non- FRTIB email, social media accounts (e.g., Outlook, Instagram, Gmail, Twitter, Facebook), or other external resources to conduct FRTIB business, thereby ensuring that official business is never confused with personal business.
7. I will encrypt all CUI using an Agency approved tool that is:
1 NISTIR 7298, Revision 2 “Glossary of Key Information Security Terms” defines confidentiality as “The property that sensitive information is not disclosed to unauthorized individuals, entities, or processes.” 2 NISTIR 7298, Revision2 “Glossary of Key Information Security Terms” defines integrity as “The property that sensitive data has not been modified or deleted in an unauthorized and undetected manner.” 3 NISTIR 7298, Revision 2 “Glossary of Key Information Security Terms” defines availability as “The property of being accessible and useable upon demand by an authorized entity.”
Federal Retirement Thrift Investment Board’s Rules of Behavior for Accessing IT Systems
July 2020 Update 2
a. Downloaded from FRTIB information systems onto a FRTIB authorized portable storage device;
b. Downloaded to any FRTIB authorized device; or c. Emailed to any entity external to the FRTIB organization (to non -“TSP.GOV” or
“FRTIB.GOV” email address.) 8. I will only access CUI when I am authorized to do so. I will only access the minimal
amount of CUI needed, and I will delete my copy of CUI data downloaded from FRTIB information systems immediately when its official use is no longer required.
9. I will protect my passwords and/or authentication tokens from disclosure and loss at all times. I will utilize the Agency provided password manager and I will never reveal my passwords, write them down, or store them in clear-text. I will not construct my password from obvious personal data (e.g., social security number, telephone numbers, relative’s names, pet’s name).
10. I will only create passwords that are unrelated to any existing password and I will not reuse a password from any other account, system, website, or application.
11. I am accountable for all actions taken under my User ID. I will not allow others to use my User ID and I will not access other users’ accounts. I will not attempt to access accounts or data that are not expressly authorized to me.
12. When logged on, I will lock my workstation and remove my PIV (Personal Identity Verification) card prior to leaving my workstation. All activity occurring when the workstation is active is the responsibility of the logged-on user.
13. I will not install, use, or reproduce unauthorized or illegally obtained software. Privately- owned software is prohibited from being used. FRTIB employees and contractors are only permitted to use FRTIB-approved applications and software. Employees and contractors must go through the Service Desk or ServiceNow to request applications and software.
14. I shall not connect unauthorized devices to FRTIB information systems under any circumstance. Examples include, but are not limited to: personal external hard drives, personal phones, unauthorized flash/thumb drives, networked cameras, or microphones.
15. Changes in my employment status or changes in my job responsibilities may require my access to be modified or terminated.
16. I am using a CUI system. I am NEVER authorized to originate, process, and/or store classified information on an unclassified system.
17. This agreement shall not nullify or affect in any manner any other confidentiality or nondisclosure agreement which I have executed or may execute with FRTIB.
18. I shall never attempt to tamper with, circumvent, or otherwise impede the security of any FRTIB system. I shall never install or utilize any tools designed to assist in doing the same.
19. I am not authorized to post organizational data to social media or social networking sites. Only authorized users with cleared content by the Office of External Affairs, the Office of Resource Management, or the Office of Communications and Education may post to social media or social networking sites as required to support the organizational mission. Personal use of social media while on work time or equipment must be limited with minimal cost to the government (see “Limited Personal Use” Policy) and must not interfere with my duties and responsibilities. I must seek approval from the Office of General Counsel prior to using or referencing my formal position when writing in a
Federal Retirement Thrift Investment Board’s Rules of Behavior for Accessing IT Systems
July 2020 Update 3
nonofficial capacity. I will never use my FRTIB e-mail address to register on social networks, blogs, or other online tools utilized for personal use and that any misconduct committed on social media that has a nexus to my position at FRTIB may result in appropriate discipline, up to and including removal from Federal service. As an employee of the Federal Government, when using social medial tools, whether on behalf of FRTIB or on my own time, I am bound by the Standards of Ethical Conduct for Employees of the Executive Branch, 5 C.F.R. Part 2635 and the Hatch Act (5 U.S.C. §§ 7321-7326).
20. I will immediately report a potential incident4, password compromise, anomaly in system performance, or suspicious activity to IncidentResponse@tsp.gov.
21. I shall not take any government-furnished equipment (including, but not limited to an FRTIB-issued laptop or phone) outside the United States or the territories of the United States without prior written approval from the Chief Technology Officer or designee.
22. Users are prohibited from sharing any FRTIB passwords with any other person or entity. 23. Viewing of pornographic or other offensive content is strictly prohibited on FRTIB
furnished equipment and networks. 24. I shall promptly report lost, stolen or misplaced Government Furnished Equipment (e.g.,
laptop, phone, PIV card) to the FRTIB Service Desk, IT Asset Management Team and my supervisor (or Contracting Officer Representative if applicable). Users may be financially liable for lost, stolen or misplaced Government Furnished Equipment5.
25. Any user who does not comply with or violates these rules may be subject to appropriate administrative action, including suspension or cancellation of system privileges and/or disciplinary action up to and including removal from the Federal service. Under some circumstances, noncompliance or violation of these rules may result in criminal prosecution. FRTIB will enforce the use of appropriate penalties against any user who fails to comply or violates IT Security Management policies.
Remote Access FRTIB Rules of Behavior for Remote Access apply to remote access connections used to do work on behalf of FRTIB, including reading or sending email and viewing Intranet web resources. Remote access implementations that are covered include, but are not limited to, dial-in modems, frame relay, ISDN, DSL, VPN, SSH, and cable modems, etc. These rules of behavior apply to all users which include FRTIB staff, contractors, vendors, and agents with remote access privileges to FRTIB’s network.
1. The user is responsible for ensuring that their remote access connection is given the same security considerations as the user’s on-site connection when connecting to FRTIB. For example, if an individual is processing sensitive (e.g., For Official Use Only, Controlled Unclassified Information) information via remote access, the individual will ensure unauthorized individuals cannot view the content. The user is responsible for ensuring unauthorized users do not access the FRTIB network, do not perform illegal activities, and do not use the access for outside business interests. The user bears responsibility for
4 NISTIR 7298, Revision 2 “Glossary of Key Information Security Terms” defines incident as “An occurrence that actually or potentially jeopardizes the confidentiality, integrity, or availability of an information system or the information the system processes, stores, or transmits or that constitutes a violation or imminent threat of violation of security policies, security procedures, or acceptable use policies.” 5 OTS.501 IT Asset Management Procedures, Section 4.6 Lost and Stolen Assets
Federal Retirement Thrift Investment Board’s Rules of Behavior for Accessing IT Systems
July 2020 Update 4
