Page 3

West Virginia WIC Policy & Procedure 1.26 Effective Date: 3/20/2018 1.26 Security Policy

3 of 12 c. Passwords for logon IDs will expire and must be changed every sixty days.

d. Any network logon account unused for ninety days will be disabled.

CROSSROADS

WIC Clinic and State office staff will have the same USER ID as the network as stated previously.

a. Local Agency Directors or their designee will instruct the WIC Security Officer and WIC Help Desk where the user will be working and what duties they will be performing. After the WIC Security Officer approves the network login and OT has completed the Network Login setup, WIC Help Desk will add the user to the Crossroads application.

b. Local Agency Directors or their designee is also responsible for making sure people are deleted from the system by filling out an OT Network Deprovision form online and assigning it to the WIC Security Officer for approval. This shall be performed within 24-48 hours or less after personnel leave employment.

c. Crossroads passwords are encrypted and cannot be seen on the screen. Passwords also expire every sixty days at the same time that the network passwords expire. Crossroads has a link to the active directory to verify passwords. So the passwords expire and are the same for both systems. Crossroads does have a separate login screen but uses the network login and passwords information. If a user mistypes, the password twice logging into Crossroads, the system automatically also locks the network password.

d. When staff leave their desks for any length of time, they should lock their computer screen.

3. Audits

Audits should be available in the system to track problems and look at security issues within Crossroads

Crossroads has security files, automated error logs, time and date stamps on records.

a. User IDs are assigned to records automatically to record who is doing a particular function in Crossroads. These areas are Income and Residency, Blood Work, Height and Weight, and Food Package Assignment, risk assessment, Benefit Issuance, Care Plans, and Nutrition Education at a minimum.

b. Security files are kept that include when passwords are to expire, number of unsuccessful attempts.

c. The security file also limits what a user can do depending on flags that are set when they are added to the system. If a function is not permitted to the user,