Page 2

West Virginia WIC Policy & Procedure 1.26 Effective Date: 3/20/2018 1.26 Security Policy

2 of 12 Controls are to be established by the SA to prevent unauthorized persons from reading from and writing to programs and data files. The SA and the Local Agency (LA) Director will submit to the WIC Security Officer a Network Logon form for all staff that leaves employment immediately. The LA Director will also submit a new form for all new hires. Staff under no circumstances shall share network/Crossroads/MMIS/E- WIC passwords and logon ID’s. Invalid login attempts will lock user out of the network after five (5) attempts. Crossroads will lock out the user after two (2) unsuccessful attempts. For security reasons, all passwords cannot be seen. The network automatically locks the computer after 5 minutes of inactivity. All staff are instructed to lock computer screens whenever leaving their computer unattended. Should a particular PC be used by multiple persons within the clinic site, each person must log out prior to another person’s use of the PC. The WIC Security Officer shall maintain a current list of all system users.

2. Identification and Authentication

Both the WIC network and the Crossroads application use the same network ID and password. Crossroads users are added to the application with their network ID’s and given the appropriate roles to the clinics they need access to. Network IDs are approved and processed by the WIC security as stated above. The WIC Helpdesk adds the roles for the user in Crossroads providing for a separation of duty at the state office.

Wide Area Network a. All sensitive telecommunications equipment will be guarded from unauthorized physical access.

b. All connections from remote systems will be subject to authentication. In addition, all remote connections to WAN equipment will display the following banner: ************************************************************************

WARNING: This system is for the use of authorized clients only. Individuals using the computer network system without authorization, or in excess of their authorization, are subject to having all their activity on this computer network system monitored and recorded by system personnel. To protect the computer network system from unauthorized use and to ensure the computer network system is functioning properly, system administrators monitor this system. Anyone using this computer network system expressly consents to such monitoring and is advised that if such monitoring reveals possible conduct of criminal activity, system personnel may provide the evidence of such activity to law enforcement officers. Access is restricted to authorized users only. Unauthorized access is a violation of state and federal, civil and criminal laws.

Department of Health & Human Resources WIC. ****************************************************************** Local Area Network a. Policies will be in place on all PCs connected to the LAN requiring validation from the network server in order to access Windows.

b. All SA and LA Clinic personnel are required to have a unique network logon ID.