Town of Warner, New Hampshire Information Security Policy

Size: px

Start display at page:

Download "Town of Warner, New Hampshire Information Security Policy"

Christiana Gibbs
5 years ago
Views:

1 Twn f Warner, New Hampshire Infrmatin Security Plicy Date Adpted: Bard f Selectmen David E. Hartman David Karrick, Jr. Clyde Carsn

2 Table f Cntents Table f Cntents 1 Intrductin 2 Ethics and Acceptable Use Plicies 2 Disciplinary Actin 2 Prtect Stred Data. 2 Prtect Data in Transit... 3 Restrict Access t Data 3 Physical Security 3 Security Awareness and Prcedures 4 Security Management / Incident Respnse Plan. 4 Appendix A Agreement T Cmply Frm 5

3 Intrductin This plicy cvers the security f municipal infrmatin and must be distributed t all municipal emplyees wh may directly interact with the cardhlder envirnment. Management will review and update this infrmatin security plicy at least nce a year t incrprate relevant security needs that may develp. Each emplyee must read and sign a frm verifying they have read and understand this plicy. Ethics and Acceptable Use Plicies The municipality expects that all emplyees cnduct themselves in a prfessinal and ethical manner. An emplyee shuld nt cnduct business that is unethical r illegal in any way, nr shuld an emplyee influence ther emplyees t act unethically r illegally. Furthermre, an emplyee shuld reprt any dishnest activities r damaging cnduct t an apprpriate supervisr. Security f municipal infrmatin is extremely imprtant t ur business. We are trusted by ur citizens t prtect sensitive infrmatin that may be supplied while cnducting business. Sensitive infrmatin is defined as any persnal infrmatin (i.e. - name, address, phne number, , Scial Security number, driver s license number, bank accunt, credit card numbers, etc.) r municipal infrmatin nt publicly available (i.e. clients, financial infrmatin, emplyee infrmatin, schedules, technlgy, etc.). It is imprtant the emplyees d nt reveal sensitive infrmatin abut ur municipality r ur citizens t utside resurces that d nt have a need t knw such infrmatin. Disciplinary Actin An emplyee s failure t cmply with the standards and plicies set frth in this dcument may result in disciplinary actin up t and including terminatin f emplyment. Prtect Stred Data Prtect sensitive infrmatin stred r handled by the municipality and its emplyees. All sensitive infrmatin must be stred securely and dispsed f in a secure manner when n lnger needed fr business reasns. Any media (i.e paper, flppy disk, backup tape, cmputer hard drive, etc.) that cntains sensitive infrmatin must be prtected against unauthrized access. Media n lnger needed must be destryed in such a manner t render sensitive data irrecverable (i.e. shredding, degaussing, dis-assembly, etc.). Credit Card Infrmatin Handling Specifics Destry cardhlder infrmatin in a secure methd when n lnger needed. Media cntaining card infrmatin must be destryed by shredding r ther means f physical destructin that wuld render the data irrecverable (shred, degauss, etc.). It is prhibited t stre the cntents f the credit card magnetic stripe (track data) n any media whatsever.

4 It is prhibited t stre the card-validatin cde (3 r 4 digit value printed n the signature panel f the card) n any media whatsever. All but the last 4 numbers f the credit card accunt number must be masked (i.e. x s r * s) when the number is displayed electrnically r n paper. Transactin reprts will be destryed after annual financial audit. Prtect Data in Transit If sensitive infrmatin needs t be transprted physically r electrnically, it must be prtected while in transit (i.e. t a secure strage facility r acrss the Internet). Credit Card Infrmatin Handling Specifics Credit card accunt numbers must never be ed withut using prper encryptin technlgies (i.e. PGP encryptin). Media cntaining credit card accunt numbers must nly be given t trusted persns fr transprt t ff-site lcatins. Restrict Access t Data Restrict access t sensitive infrmatin (business data and persnal infrmatin) t thse that have a need-t-knw. N emplyees shuld have access t credit card accunt numbers unless they have a specific jb functin that requires such access. Physical Security Restrict physical access t sensitive infrmatin, r systems that huse that infrmatin (ex. cmputers r filing cabinets string cardhlder data), t prtect it frm thse wh d nt have a need t access that infrmatin. Media is defined as any printed r handwritten paper, received faxes, flppy disks, back-up tapes, cmputer hard drive, etc. Media cntaining sensitive infrmatin must be securely handled and distributed. Media cntaining stred sensitive infrmatin (especially credit card accunt numbers and scial security numbers) shuld be prperly inventried and dispsed when n lnger needed fr business by deleting, shredding degaussing befre dispsal. 1. Visitrs shuld always be escrted and easily identifiable when in areas that may cntain sensitive infrmatin. 2. Passwrd prtected screen savers shuld always be used n any cmputers that may cntain sensitive infrmatin.

5 Security Awareness and Prcedures Keeping sensitive infrmatin secure requires peridic training f emplyees t keep security awareness levels high. The fllwing cmpany plicies and prcedures address this issue. Hld peridic security awareness training meetings f emplyees and cntractrs t review crrect handling prcedures fr sensitive infrmatin. Emplyees are required t read this security plicy and verify that they understand them by signing an acknwledgment frm (see Appendix A). Backgrund checks (as required by the jb psitin) will be cnducted fr all emplyees that handle sensitive infrmatin. All third parties with access t credit card accunt numbers are cntractually bligated t cmply with card assciatin security standards (PCI/DSS). Municipal security plicies must be reviewed annually and updated as needed. Security Management/Incident Respnse Plan There will be an emplyee f the municipality designated by the Bard f Selectmen as the security fficer. The security fficer is respnsible fr cmmunicating security plicies t emplyees and cntractrs and tracking the adherence t plicies. In the event f a cmprmise f sensitive infrmatin, the security fficer will versee the executin f the incident respnse plan. Incident Respnse Plan 1. If a cmprmise is suspected, alert the infrmatin security fficer. 2. Security fficer will cnduct an initial investigatin f the suspected cmprmise. 3. If cmprmise f infrmatin is cnfirmed, the security fficer will alert management and begin infrming parties that may be affected by the cmprmise. If the cmprmise invlves credit card accunt numbers perfrm the fllwing: Cntain and limit the extent f the expsure by shutting dwn any systems r prcesses invlved in the cmprmise. Alert necessary parties (Merchant Bank, Visa Fraud Cntrl, law enfrcement). Prvide cmprmised r ptentially cmprmised card numbers t Visa Fraud Cntrl within 24 hrs. Mre Infrmatin:

6 Appendix A Agreement t Cmply Frm

7 Agreement t Cmply With Infrmatin Security Plicies I agree t take all reasnable precautins t assure that municipal internal infrmatin, r infrmatin that has been entrusted t the municipality by third parties such as citizens, will nt be disclsed t unauthrized persns. At the end f my emplyment r cntract with the municipality, I agree t return all infrmatin t which I have had access as a result f my psitin. I understand that I am nt authrized t use sensitive infrmatin fr my wn purpses, nr am I at liberty t prvide this infrmatin t third parties withut the express written cnsent f the internal manager wh is the designated infrmatin wner. I have access t a cpy f the Infrmatin Security Plicies, I have read and understand these plicies, and I understand hw it impacts my jb. As a cnditin f cntinued emplyment, I agree t abide by the plicies and ther requirements fund in the municipal security plicy. I understand that nn-cmpliance will be cause fr disciplinary actin up t and including dismissal, and perhaps criminal and/r civil penalties. I als agree t prmptly reprt all vilatins r suspected vilatins f infrmatin security plicies t the designated security fficer. Emplyee Name (printed) Emplyee Signature Department Date

Software Usage Policy Template

Software Usage Policy Template Sftware Usage Plicy Template This template is t accmpany the article: The Sftware Usage Plicy - An Indispensible Part f Yu SAM Tlbx The full article can be fund here: http://www.itassetmanagement.net/tag/plicy-template/