US Dept of Housing and Urban Development 7/19/2021

2. Understanding of the IDIS Online Rules of Behavior(IDIS RoB)security requirements. 3. Acknowledgement that disciplinary action may be taken based on violation of the IDIS RoB. The IDIS Online System Security Administrator(SSA)verifies that the users who require access to IDIS Online have read and accepted(via signature on the acceptance form)this IDIS RoB. Other Policies and Procedures This IDIS RoB is intended to enhance and further define the specific rules each user must follow while accessing IDIS Online.The rules are consistent with the policy and procedures described in the following directives: Revision of OMB Circular No.A-130,Transmittal No.3,Appendix https://www.whitehouse.gov/omb/circulars a130 a130pre Ill, "Security of Federal Automated Information Resources." Privacy Act of 1974,as amended,5 U.S.C. §552a http://www.lustice.gov/opcl/privacy-act-1974 18 USC 1030(a)4, "Accessing to Defraud and Obtain Value http://www.gpo.gov/fdsys/granule/USCODE-2010-titlel8/USCODE- 2010-titlel8-partl-chap47-sec1030/content-detail.html NIST Special Publication 800-18-Revision 1,Guide for http://csrc.nist.gov/publications/nistpubs/800-18-Rev1/sp800-18- Developing Security Plans for Information Technology Systems, Rev1-final.pdf February 2006 HUD Information Technology Security Policy Handbook http://portal.hud.gov/hudportal/HUD?src=/program offices/admin istration/hudclips/handbooks/cio/2400.25 Application Rules Because written guidance cannot cover every contingency,you are asked to go beyond the stated rules, using your best judgment and highest ethical standards to guide your actions. These rules are based on Federal laws and regulations and HUD policies. As such there are consequences for non-compliance. The following IDIS RoB is the minimum rules for users who are requesting an IDIS Online user account: 1. You are aware of the existence of and penalty for violating 18 USC 1030 and abide by: a. The elements of 18 USC 1030(a)4, "Accessing to Defraud and Obtain Value"are: i. Knowingly accessing a protected computer without or in excess of authorization; ii. With intent to defraud; iii. Access furthered the intended fraud;and iv. Obtain anything of value b. The penalty for violating this statute includes a fine and imprisonment of not more than ten years,or both. 2. You must adhere to HUD's policy requiring a separation of duties between the requestor and approver for financial transactions: a. Effective December 14,2001,the same person can no longer both request and approve a given draw down in IDIS Online. b. While individual persons may have the power to both request and approve draws,this rule prevents an individual from approving a draw that he or she created.IDIS Online requires two people to be involved in every draw down of funds. 3. Currently,the IDIS Online Local Administrator initially defines what a person can do in IDIS Online,carrying out the wishes of each grantee's authorizing official — mayor,grant holder,CEO,CFO,etc.Some users have full rights,while others have limited rights of various kinds. You understand that you are given access only to IDIS Online to which you require access in the performance of your official duties and that you will not attempt to access systems that you are not authorized to access. 4. You are prohibited from misusing IDIS Online,i.e.,exceeding your authority.Your level of access to IDIS Online is limited to ensure your access is not more than necessary to perform your legitimate tasks or assigned duties. If you believe you are being granted access that you should not have,you must immediately notify the IDIS Online SSA via email at IdisUseridRequests@hud.gov. 5. You must immediately notify your Supervisor, CPD Field Office Administrator, and/or your Local Grantee Administrator if your access/privilege are no longer required,termination, promotion,and transferred. 6. You must maintain the confidentiality of your authentication credentials such as your password. Do not reveal your authentication credentials to anyone and do not record passwords on paper or in electronic form. 7. You must report all security incidents or suspected incidents(e.g., lost passwords, improper or suspicious acts)related to IDIS Online to the HUD Computer Incident Response Team at CIRTPhud.gov. 8. Your IDIS Online password expires every 90 days,so ensure you access IDIS at least once a month. Users who do not use IDIS within a 90 day period will find their accounts are de-activated. ALL PREVIOUS VERISONS OF THIS FORM WILL NOT BE ACCEPTED OR PROCESSED. HUD FORM 27055(10/2020) Page 2 of3