US Dept of Homeland Security FEMA 8/28/2020

FOR OFFICIAL USE ONLY//CONTROLLED UNCLASSIFIED INFORMATION Appendix C IPAWS-OPEN Rules of Behavior 1.0 INTRODUCTION The following rules of behavior apply to all persons with application access to City of Everett Interoperable System(s)and/or who have been issued a COGID with associated credentials for IPAWS-OPEN. These individuals shall be held accountable for their actions related to the information resources entrusted to them and must comply with the following rules or risk losing their access privileges.The Rules of Behavior apply to users on official travel as well as at their primary workplace(e.g.,Emergency Operations Center—EOC)and at any alternative workplace (e.g.,telecommuting from a remote or satellite site)using any electronic device including laptop computers and portable electronic devices(PED's). PED's include personal digital assistants(PDA's)(e.g.Palm Pilots),cell phones, text messaging systems(e.g.,Blackberry),and plug-in and wireless peripherals that employ removable media(e.g. CDs,DVDs,etc.).PEDs also encompass USB flash memory(thumb)drives,external drives,and diskettes. These Rules of Behavior are consistent with existing DHS policies and DHS Information Technology(IT)Security directives and are intended to enhance the awareness of each user's responsibilities regarding accessing,storing, receiving and/or transmitting information using IPAWS-OPEN. 2.0 APPLICATION RULES 2.1 Official Use • IPAWS-OPEN is a Federal application to be used only in the performance of the user's official duties in support of public safety as described in the National Incident Management System(NIMS). • The use of the IPAWS-OPEN for unauthorized activities is prohibited and could result in verbal or written warning,loss of access rights,and/or criminal or civil prosecution. • By utilizing IPAWS-OPEN,the user of the interoperable system(s)consents to allow system monitoring to ensure appropriate usage for public safety is being observed. • City of Everett will be held accountable for safeguarding all configuration items and information entrusted to them by FEMA. City of Everett is expected to manage the relationship with supporting vendors, consultants and any other entities providing system support on their behalf. In addition,City of Everett will be held accountable in the event of a security breach or disclosure of sensitive configuration information such as digital certificates. City of Everett understands that the use of digital signatures,used on their behalf,is binding and City of Everett will be held accountable accordingly. In the event sensitive information is mishandled,utilization of IPAWS-OPEN may be immediately revoked by FEMA. • If software interoperating with IPAWS-OPEN enables users to geo-target public alert messages by means of geospatial polygons or circles,then the user shall restrict any such geospatial boundaries so as to remain within the geographical limits of their public warning authority(or as near as possible),as determined by applicable state and/or local laws and duly adopted operational plans. 2.2 Access Security • All Email addresses provided in connection with interoperable system(s)user accounts must be associated to an approved email account assigned by the user's emergency management organization.The use of personal email accounts to support emergency messaging through IPAWS-OPEN is prohibited. • Upon approval of the MOA by FEMA,a COG account with COGID and Digital Certificate will be created and issued to the designated technical representative. All individuals with knowledge of these credentials must not share or alter these authentication mechanisms without explicit approval from the FEMA IPAWS Program. 10 V4.2,June 20,2019