Page 149

148

PY26 WHEAP Manual

Revised: August 2025 Desktops Desktops that are used for collecting, displaying, transferring, analyzing, or storing Tier One or Tier Two sensitive data shall apply the following standards: 1. Desktops shall be locked when left unattended by authorized personnel. Re-entry into the desktop shall require a user login and password. 2. An automated screen saver lock shall be enabled after 15 minutes of inactivity. Re-entry into the desktop shall require a user login and password. 3. Hard drives shall be cleansed using at least a seven-pass overwrite procedure (commonly referred to as the Department of Defense (DOD) standard), where the drive is written over electronically to eliminate all data prior to surplus or re-assignment to another user or work area. Contracted agencies shall make available upon request verification that the device has been sanitized meeting industry standards, seven-pass overwrite, degaussing (sanitation based on magnetism), or complete physical destruction of the hard drive media.

Portable Computing Devices Portable computing devices that are used for collecting, displaying, transferring, analyzing, or storing Tier One or Tier Two sensitive data shall apply the following standards: 1. Personally assigned portable computing devices shall have full disk (hard drive) encryption, requiring a login and password. 2. Portable computing devices shall have the boot-up from external or secondary devices disabled. Boot-up shall only be permitted from the hard drive. 3. An automated screen saver lock shall be enabled after 15 minutes of inactivity. Re-entry into the laptop shall require a user login and password. 4. Portable computing devices that are inactive for 15 minutes shall automatically lock. 5. Do not store Tier One sensitive data on shared pool portable computing devices. 6. Hard drives shall be cleansed using at least a seven-pass overwrite procedure, where the drive is written over electronically to eliminate all data prior to surplus or re-assignment to another user or work area. Contracted agencies shall make available upon request verification that the device has been sanitized meeting industry standards, seven-pass overwrite, degaussing (sanitation based on magnetism), or complete physical destruction of the hard drive media.

Portable Media Portable devices used for collecting, displaying, transferring, analyzing, or storing Tier One or Tier Two sensitive data shall apply the following standards: 1. Files that contain Tier One sensitive data shall require a password to open. 2. Media that may contain sensitive information shall be encrypted and require a login and password to access the media prior to file or folder access. 3. Shall be stored in a restricted access location, surrounded by a durable physical barrier that is not portable.