Fe deral Mobile Workplace Security: An Interagency Security Committee W hite Paper st 1 Edition Janu ary 2017 Interagency Security Committee This page left intentionally blank. Federal Mobile Workplace Security: An ISC White Paper i Message from the Program Director One of the Department of Homeland Security’s (DHS) priorities is the protection of Federal employees and private citizens who work within and visit United State government-owned or -leased facilities. The Interagency Security Committee (ISC), established by Executive Order 12977 and chaired by DHS, consists of 60 Federal departments and agencies and has as its mission the development of security standards and best practices for non-military Federal facilities in the United States. As Program Director of the ISC, I am pleased to introduce the new ISC document titled Federal Mobile Workplace Security: An Interagency Security Committee White Paper. This ISC white paper provides a set of recommendations for action that will shape policy and standardize procedures that agencies housed in non-military Federal facilities can use to ensure the security of telework arrangements and alternative workspaces and the employees who utilize them. This document also defines key terms to identify policy and planning considerations, expected behaviors, and approaches for agencies to implement mobile work solutions in the Federal workplace to ensure the security of employees, their workplace, sensitive/unclassified information, and the public. This white paper is a significant milestone and represents exemplary collaboration across the ISC and among the ISC Future of Federal Workplace Security Working Group. With full concurrence, ISC Primary Members approved this white paper will review and update the document as needed. Daryle Hernandez Program Director Interagency Security Committee ii Federal Mobile Workplace Security: An ISC White Paper Table of Contents Message from the Program Director........................................................................................... ii 1.0 Background .......................................................................................................................... 1 2.0 Applicability and Scope ....................................................................................................... 2 3.0 Introduction .......................................................................................................................... 3 4.0 Roles and Responsibilities ................................................................................................... 4 4.1 Terms of Telework Participation .................................................................................... 4 4.2 Telework Eligibility and Participation ............................................................................ 4 4.3 Telework Managing Officer ........................................................................................... 5 4.4 Telework Coordinator ..................................................................................................... 5 4.5 Privacy Office Oversight ................................................................................................ 5 4.6 Telework Supervisor ....................................................................................................... 6 4.7 Employee / Teleworker ................................................................................................... 7 5.0 Security Considerations for Teleworking .......................................................................... 8 5.1 Virtual Security ............................................................................................................... 8 6.0 Security Considerations for Teleworking and Alternative Workplace Environments .............................................................................................................................. 10 6.1 Teleworking from Home............................................................................................... 10 6.1.1 Potential Threats/Risks when Teleworking from Home .............................................. 11 6.1.2 Recommendations to Address Physical Threats when Teleworking from Home ........ 11 6.2 Teleworking in Public Spaces ....................................................................................... 12 6.2.1 Recommendations to Address Cyber Threats when Teleworking in Public Spaces .... 13 6.2.2 Recommendations to Address Physical Threats when Teleworking in Public Spaces 13 6.3 Working in Offices Using Alternative Workplace Strategies....................................... 14 6.3.1 Recommendations when Working with Alternative Workplace Strategies ................. 15 7.0 Securing Equipment & Sensitive Materials for Teleworking and Alternative Workplace Environments .......................................................................................................... 16 7.1 Safeguarding Sensitive Materials ................................................................................. 16 7.2 Reporting a Breach or Loss........................................................................................... 17 7.2.1 Procedures for Reporting Possible PII, Sensitive, and Government Proprietary Information Breach ................................................................................................................ 18 8.0 Training .............................................................................................................................. 19 9.0 Health and Safety ............................................................................................................... 20 Federal Mobile Workplace Security: An ISC White Paper iii 10.0 Continuity Planning ........................................................................................................... 21 11.0 References ........................................................................................................................... 22 12.0 Interagency Security Committee Participants ................................................................ 25 List of Abbreviations/Acronyms/Initializations ....................................................................... 26 Glossary of Terms ....................................................................................................................... 27 Appendix A: Recommendations to Address Cyber Threats when Teleworking from Home .......................................................................................................................................... A-1 A.1 Wired Network............................................................................................................ A-1 A.2 Wireless Network........................................................................................................ A-1 Appendix B: Secure Transmission Considerations ............................................................... B-1 B.1 Transmission of PII and Sensitive Material ................................................................ B-1 B.2 Encryption ................................................................................................................... B-1 Appendix C: Example Employee Safety Template for Telework Program ........................ C-1 Appendix D: Training Scenario Example............................................................................... D-1 Appendix E: Individual Preparedness Continuity ................................................................ E-1 E.1 Basic Emergency Go Kit ............................................................................................. E-1 E.2 Emergency Plan Card .................................................................................................. E-2 E.3 Office Go Kit ............................................................................................................... E-2 iv Federal Mobile Workplace Security: An ISC White Paper 1.0 Background The Interagency Security Committee (ISC) was formed by Executive Order (E.O.) 12977 signed by President Bill Clinton in 1995 following the Oklahoma City bombing. This devastating event prompted the White House to establish a permanent body to address the continuing government- wide physical security needs for Federal facilities. Today, the ISC is chaired by the Department of Homeland Security (DHS) and consists of a permanent body with representatives from 60 Federal agencies and departments. Since the inception of the ISC, developments in technology introduced a virtual or cyber component to the Federal facilities security profile. Like the physical security element for the Federal worker environment, the virtual or cybersecurity element also requires analysis and review. On December 9, 2010, President Barack Obama signed the Telework Enhancement Act of 1 2010. The Telework Enhancement Act broadens the traditional Federal facility to include employee duties and responsibilities at approved worksites other than the normal employee workplace. In response to the implementation of the Telework Enhancement Act as well as to other new policy directives, the ISC created the Future of Federal Workplace Security Working Group to assess the impact on physical and cybersecurity policies and practices. The working group was chartered to: • Survey existing requirements, guidance, and pilot programs regarding telework and alternative workplaces and associated security; • Analyze current requirements for information technology (IT) security and physical security and make recommendations on how those activities should overlap or be integrated; • Recommend appropriate roles and responsibilities for employees, supervisors, and security providers regarding telework and alternative workplace security, including responsibility and requirements for staffing and training; and • Recommend common standards and processes that should be developed to ensure telework and alternative workplace security. Based on the working group’s findings, the ISC presents the Federal security community Federal Mobile Workplace Security: An ISC White Paper. 1 Public Law 111-292; 5 USC § 6501 - 06: Telework Enhancement Act of 2010. Federal Mobile Workplace Security: An ISC White Paper 1 2.0 Applicability and Scope The Federal Mobile Workplace Security White Paper is a reference for Federal agencies when implementing mobile Federal workplace security. This document defines key terms, identifies existing policy and security planning considerations, and outlines expected behaviors to include methods for agencies to utilize when implementing mobile Federal workplace solutions. On February 12, 2013, two key documents were released by the White House: the Presidential Policy Directive 21 (PPD-21), Critical Infrastructure Security and Resilience, and E.O. 13636, Improving Critical Infrastructure Cybersecurity. Both were issued to underscore the Federal Government’s responsibility to strengthen the security and resilience of its own critical infrastructure, for the continuity of national essential functions, and to organize itself to partner effectively with and add value to the security and resilience efforts of critical infrastructure owners and operators. This guide is designed to provide Federal employees, their supervisors, and agency security personnel with a framework for understanding and mitigating risks posed to an organization when instituting a mobile workplace. There are a wide range of potential threats that can be introduced to a government facility by telework/mobility. This document will address the security concerns associated with both government-furnished equipment (GFE) and personally owned equipment. The authority for Federal departments and agencies to provide security for their facilities and employees is cited in various sections of the United States Code (USC) and the Code of Federal Regulations (CFR). It is beyond the scope of this document to cite individual department and agency authority. For more information regarding authorities, the reader should contact their agency Office of General Counsel (OGC). In accordance with their respective authority, each department or agency obtains the funds to provide security. 2 Federal Mobile Workplace Security: An ISC White Paper 3.0 Introduction Modern advances in technology now make it possible for an enterprise to continue operating under all but the most catastrophic circumstances. The workplace can be truly mobile, and it offers tremendous opportunities for the Federal Government. Many employees are no longer tied to a desk, let alone a single location, to complete the core tasks of their mission. A single flood or snowstorm no longer means agencies and departments grind to a halt for want of available employees. In light of this, Federal entities need to take full advantage of teleworking benefits when available. Continuity of operations efforts can be augmented by teleworking capabilities. While this expands the operational boundaries, the use of teleworking must be conducted in accordance with Telework Enhancement Act of 2010. The nature of the agency’s mission and certain functions may dictate activities be performed at dedicated continuity facilities with access to systems conforming to the National Communications Systems Directive 3-10. The purpose of this document refers to the usage of information technologies (such as telecommunications and computers) for work-related activities. It moves the workplace to the workers, instead of moving the workers to the workplace that is the typical scenario for 2 professionals. In the Federal Government, the terms "telecommuting" and "telework" are used interchangeably, but telework is the official term and is defined in the Telework Enhancement Act as follows: "the term 'telework' or 'teleworking' refers to a work flexibility arrangement under which an employee performs the duties and responsibilities of such employee's position, and other authorized activities, from an approved worksite other than the location from which the 3 employee would otherwise work." In practice, "telework" is a work arrangement allowing an employee to perform work during any part of regular paid hours at an approved alternative worksite (e.g., home, telework center). This definition of telework includes what is generally referred to as remote work but does not include 4 any part of work done while on official travel or mobile work. Even though outside of the official Federal definition, many agencies use the term telework to describe a wide range of work settings and alternative work practices better termed “mobile work” or “mobility.” These could include, for example, working inside the office in areas other than assigned workstations, at home, outside the office while traveling, or in the field. Mobile work refers to an employee’s ability to work freely inside and outside the office. Mobility also encompasses all remote work functionally required for a job. Telework is a sub-set of mobility wherein an employee works specifically at home or at a satellite office location near the employee’s home. These guidelines include all forms of mobility as well as telework, and they are both used interchangeably. 2 Refer to http://www.uscg.mil/hq/cg1/cg121/benefits/telework.asp. 3 Public Law No. 111-292 of December 9, 2010 (The Telework Enhancement Act of 2010). 4 OPM “Guide to Telework in the Federal Government: https://www.telework.gov/guidance-legislation/telework­ guidance/telework-guide/. Federal Mobile Workplace Security: An ISC White Paper 3 4.0 Roles and Responsibilities First Line Supervisors are responsible and accountable for supervising work in accordance with 5 the Fair Labor Standards Act (FLSA). All employees, teleworking or not, are required to follow established office practices, agency policies, and laws for requesting and obtaining approval of leave, overtime, or any change to the work schedule. 4.1 Terms of Telework Participation Telework is a voluntary agreement between the employee and her or his supervisor. Employees are not required to telework, and supervisors are not required to offer the option if it presents hardships or security issues to the organization. Some agencies and divisions may have operational concerns negating the telework option (e.g., emergency operations centers, classified material handling). However, in agencies or departments where telework is generally allowed, employees are 6 required to complete a telework agreement and agency specific training for use either on a routine basis or in emergency situations. This will allow the agency greater flexibility in circumstances, such as emergent weather conditions posing a risk to employee travel, where daily work can be completed at an alternative worksite. This will be especially true for those agencies and departments that must perform essential work regardless of conditions. In some cases, it may be the only viable means for a division to continue functioning. 4.2 Telework Eligibility and Participation In certain situations, based on the criteria set forth in the Telework Enhancement Act of 2010, positions or employees may be identified as ineligible for telework. Exceptions to teleworking eligibility can be defined in part as an employee in a position requiring on a daily basis, meaning every standard business day, including the following: • Direct handling of secure materials determined to be inappropriate for telework by the agency. Secure materials are those materials (a) where there exists a written policy (at the government, agency, or organizational level) restricting the use/access outside of a specific government installation or area within a government installation and/or (b) where appropriate mitigating IT security measures do not exist. Secure materials may include Personally Identifiable Information (PII). • On-site work effort activity that cannot be handled remotely or at an appropriate alternative worksite. Employees may not be authorized or allowed to continue to telework if the performance of the employee does not comply with the terms of the written telework agreement between the supervisor and employee. The limitations on eligibility even in emergency or other unforeseen situations set forth above are not intended to constitute an exhaustive listing of all of the possible 5 Refer to the U.S. Department of Labor website for more information: https://www.dol.gov/. 6 Refer to the Office of Personnel Management website for more information: https://www.telework.gov/. 4 Federal Mobile Workplace Security: An ISC White Paper