• Security Process Framework, Security Program Management, Develop and System Security Policy
• NIST SP 800-14, para. 3.2.2
• SSE-CMM PA 10

Government BSP Owner:

• Janet L. Barnes
  Chief Information Officer
  Office of Personnel Management (OPM)
  Room 5415
  1900 E Street, NW Washington, DC 20415
  Telephone: 202.606.2150
  Fax: 202.418.3251

This policy establishes and communicates limitations on OPM employees' personal use of Government office equipment, particularly computer systems. The intent is to provide a professional and supportive work environment while meeting taxpayer expectations that tax dollars will be spent wisely. This policy also helps all OPM employees exercise their shared responsibility for protecting the security of this equipment with all other users.

Appendix III to OMB Circular No. A-130 - Security of Federal Automated Information Resources. A. Requirements. 3. Automated Information Security Programs.

Agencies shall implement and maintain a program to assure that adequate security is provided for all agency information collected, processed, transmitted, stored, or disseminated in general support systems and major applications.

Each agency's program shall implement policies, standards and procedures which are consistent with government-wide policies, standards, and procedures issued by the Office of Management and Budget, the Department of Commerce, the General Services Administration and the Office of Personnel Management (OPM). Different or more stringent requirements for securing national security information should be incorporated into agency programs as required by appropriate national security directives.

a. Controls for general support systems. 2) System Security Plan. a) Rules of the System.

Establish a set of rules of behavior concerning use of, security in, and the acceptable level of risk for, the system. The rules shall be based on the needs of the various users of the system. The security required by the rules shall be only as stringent as necessary to provide adequate security for information in the system. Such rules shall clearly delineate responsibilities and expected behavior of all individuals with access to the system. They shall also include appropriate limits on interconnections to other systems and shall define service provision and restoration priorities. Finally, they shall be clear about the consequences of behavior not consistent with the rules.

The following citation was transcribed from a signed document between OPM and the local chapter of the Agency's employees' union.

Quote

Memorandum of Understanding (MOU)

Between the U.S. Office of Personnel Management (OPM)

And the American Federation of Government Employees (AFGE), Local 32

Policy on personal Use of Government Office Equipment

OPM and AFGE, Local 32 understand that the Information Technology Use Policy Work Group has approved the attached policy for implementation in OPM. This policy was developed in partnership and represents a major success for OPM's Labor-Management Partnership.

The parties agree that all employees will receive training on the Information Technology Use Policy at the annual Computer Security Training beginning in September 2000. New employees will receive information on the Information Technology Use Policy in the New Employee Orientation sessions beginning October 2, 2000.

Attachment:

Policy on Personal Use of Government Office Equipment for Employees of the Office of Personnel Management

For Office of the Chief Information Officer: /s/ J.L. Barnes 9/20/2000

For AFGE Local 32: /s/ Michelle R. Tolson 9/20/2000

For Office of Human Resources and EEO: /s/ Kirke Harper 9/20/2000

Unquote

Input: Recommended Executive Branch Model Policy/Guidance on Limited Personal Use of Government Office Equipment including Information Technology

Output: U.S. Office of Personnel Management Policy on Personal Use of Government Office Equipment

Government office equipment includes, but is not limited to: personal computers, related equipment and software, Internet services, email, library resources, telephones, facsimile machines, photocopiers and office supplies.

Minimal additional expense means the expense incurred when the Government is already providing equipment, supplies or services and you use only limited additional amounts of electricity, ink, toner or paper. Wear and tear from normal use is also considered minimal additional expense.

Non-work time means the time when you are not performing an activity for the benefit of the agency and under the control or direction of the agency. Examples of non-work time include off-duty hours such as lunch periods, authorized breaks, before or after a workday, weekends or holidays, but only if your duty station would normally be available to you at such times.

Personal use means uses other than official Government business.

Privilege means that you have no inherent right to personal use of Government office equipment.