Fam software

An SOE supports development of strong configuration management plans for the computing environments commonly used throughout the Department. The Department authorizes only IT CCB-approved development, implementation, configuration, deployment, and upgrade methods. Only current Department-supported or approved vendor versions of SOE components can exist within the Department;. Updated annually, the specifications reflect the current, deployed systems both by the GITM program and by Desktop Support.

The oldest hardware that can be on the network must meet the GITM minimum hardware specifications. Thereafter, the local IT CCB must repeat this review and condition process on a recurring basis, supplemented with data on actual configurations from vulnerability and compliance scanning as technically feasible and justified by the level of acceptable risk.

Implement application software change controls for major and developed applications installed on Department systems:. Each system owner must ensure the integrity of major applications and operating system software by implementing documented and effective configuration management procedures, including procedures to:.

See 5 FAM Description Fam is a live video calling Social Network to connect with friends and new friends in a way that mimics socializing IRL. Jan 12, Version General improvements and bug fixes. Ratings and Reviews. App Privacy. Information Seller SpotMap, Inc. Size Category Social Networking. Compatibility iPhone Requires iOS Languages English.

Price Free. Services for Older Adults. State and Local-Level Drivers and Trends. State and Local Fiscal Projections. Federal Borrowing. Managing the Debt. Auditing the Government's Books. Unpacking the Financial Report. Action Tracker. About This Work. Why It's High Risk. What Remains To Be Done. Key Reports. Flood Insurance. Past Pandemic-Related Reports. Report Suspected Fraud. Personnel officers must notify the data center manager, system manager, RSO, and ISSO promptly of any employee or contractor with system access who is terminated for cause.

Revocation of user access privileges is immediate. The purpose of these reviews is to ensure that the users require such privileges to perform their official duties. The program manager must report the findings of the review to the appropriate ISSO. The system administrator must ensure that accounts are temporarily disabled after 90 days of inactivity. System managers must configure systems to require user identification and authentication.

System managers must configure networked systems to require a Smart Card and passphrase for user authentication. This includes networked devices, e.

Personnel with elevated system privileges must have separate privileged and user accounts, and the privileged account must not be used to perform user activities, e. System managers must immediately delete user IDs under the following conditions:. Users must create a unique passphrase for each account, in accordance with these specifications:. Passphrases will be valid for the life of the certificate on the Smart Card, i. System managers must not keep permanent user IDs and Smart Cards for visitors, training, demonstrations, or other purposes.

If necessary, issue a temporary user ID and password not to exceed three days, and immediately delete the temporary user account when no longer needed, i.

The system manager must configure systems to lock the Smart Card after 10 failed login attempts. Passphrases are classified at the highest level of classified information for which the system is authorized, and must not be used to provide access on different classification level systems.

Users must protect written passphrases for classified systems as follows:. If the Smart Card is left unlocked, logged onto the system, and unattended after normal business hours, this may be considered a security violation see 12 FAM See 12 FAM Users who forget their Smart Card e.

Users assigned temporary duty overseas may put in a request to the IT Service Center prior to departure to have the requirement for them to use a Smart Card for ClassNet access lifted during the TDY dates. Users must surrender revoked or expired smart cards to the system manager who will return them to the PKI office for re-use or destruction. System managers must initially assign each new user a unique user ID and a minimum 12 character, alphanumeric, randomly-generated password.

System managers must not assign group user IDs and passwords. The system must force the user to immediately change this issued password when the new user accesses the system for the first time. A newly-created password must comply with the following specifications:. If the system that the user is accessing does not accommodate 12 characters, the user must use the maximum number of character spaces available;.

The user must also report any potential or actual compromise to the ISSO. System managers may issue machine-generated passwords to users for AISs that cannot be configured to filter user-created passwords. System managers must construct and issue passwords to network devices e. This applies to all network devices regardless of the transport mechanism e. System managers must not keep permanent user IDs and passwords on AISs for visitors, training, demonstrations, or other purposes.

System managers must act in a manner that prevents unauthorized disclosure when distributing passwords to users and must advise users of the password's classification. Users must inform the ISSO if they suspect or know of a compromise of their passwords. System managers must ensure that users change their passwords under the following conditions:. To ensure that users change passwords every 60 days, system managers must configure the system to automatically prompt users to change their passwords at least 14 days prior to the expiration date.

System managers must ensure the following are the minimum required settings:. The director, Diplomatic Security Service, may authorize access to special agents of the Department of State and other Federal law enforcement agencies in the conduct of investigations concerning employee misconduct or the violation of any Federal law. All activity occurring when the workstation is functioning is the responsibility of the logged-on user. The data center manager and the system manager must instruct users to protect all media used on, and all hard copy material generated by, classified AISs according to 12 FAM which defines requirements for marking, classifying and declassifying, accountability, transportation, transmission, storage, and destruction of national security information.

The data center manager and the system manager must limit access to the operating system and application software designated for use on the classified AIS to U. The data center manager and the system manager must store all operating system and application software in an approved security container. Abroad, the RSO or PSO must review and approve all locally established procedures for transportation and control of classified media.

Media shipped between posts must be sent by classified pouch. See 12 FAM for domestic transportation requirements. AIS users must review all hard copy output prior to relaxing the controls relating to processing classified information. All output must be handled as if classified at the highest classification processed on the AIS.

Classification will remain unchanged until reviewed by an individual cleared to the same level. AIS users must mark all removable magnetic media to indicate the highest classification level of information authorized to be processed on the AIS. All media will be handled as required by the labels. Only media which has been shipped via classified pouch and under the continuous control of cleared U. The data center manager and the system manager document, in the operations log, all security-related abnormal system operations such as unexplained changes in user or program access privileges, improper system responses to access control processes, or other hardware or software failures that may result in unauthorized disclosure, loss, or modification of system programs or data.

The data center manager and the system manager must immediately notify the following of any security-related abnormal system operation:. Any AIS user discovering or suspecting incidents of fraud, misuse, unauthorized disclosure of information, destruction or unauthorized modification of data, or unauthorized access attempts must immediately report the incident to the ISSO or RSO or PSO. If an incident indicates unauthorized disclosure, modification, destruction, or misuse of AIS resources, the data center manager and the system manager must immediately make a full backup copy of the AIS for review.

Individuals who do not comply with AIS policies and procedures will be subject to the violations and infractions regulations contained in 12 FAM The ISSO reviews randomly selected user libraries and PC hard disk drives and floppies to ensure that users are not processing information classified above the level that is authorized for the AIS. AIS users must destroy classified hardcopy output when no longer needed by incineration or shredding.

Government-controlled premises for any reason, including maintenance, credit, or sale. Media which has been used on a classified AIS may not be returned to the vendor for credit.

Such media may only be used on another AIS authorized to process classified information. The data center manager and the system manager must destroy soft types of damaged, obsolete, or excess classified magnetic media i.

Abroad, only Top Secret-cleared personnel who are authorized access to the equipment may perform system maintenance. Domestically, only authorized maintenance personnel who are cleared to the highest level of information processed or stored on the AIS may perform maintenance on that system. AISs connected to a communications processor must be maintained by Top Secret-cleared maintenance personnel.

The data center manager and the system manager must ensure that maintenance personnel do not remove any magnetic media ever mounted onto a classified AIS. The data center manager and the system manager will ensure that a maintenance log documents all maintenance or service performed on the AIS.

The ISSO will generate and review audit logs at least once a month. The ISSO may select additional activities for review based on type of information processed. Department organizations developing software and systems for use abroad must include AIS security awareness training and familiarization with Department policies and procedures for personnel involved in the process.