Page 4

West Virginia WIC Policy & Procedure 1.26 Effective Date: 3/20/2018 1.26 Security Policy

4 of 12 the menu will be faded and not accessible for that function.

d. A file is also available to track logon error and violations.

4. Configuration Management

The Crossroads System Manager, SA Equipment Coordinator and MIS Project Leader must approve every change made to documentation, hardware and software. As new equipment is added to sites, a ghost image is made which is copied to all new PC equipment ensuring that all new PCs will set up exactly the same including all files needs to run the Crossroads application.

Computer Equipment Purchases

All computer equipment purchases will be handled through the WV WIC program state office. Any purchase of automated data processing equipment and software must have prior SA approval. See WV Policy & Procedure 6.11. State Requirements

a. Any purchase exceeding $500.00 and being less than $5000.00 requires that three verbal bids be obtained. Documentation verifying the bids must be provided.

b. Any purchase exceeding $5000.00 and being less than $10,000.00 requires the use of state approved vendors and a minimum of three written bid quotes.

c. Any purchase exceeding $10,000.00 must be placed on the State’s Purchasing Bulletin Board and requires a signed bid summary from WV Office of Technology and WV DHHR MIS.

d. Any invoices not meeting the above criteria will be rejected by the WV State Auditors Office.

Federal Requirements

a. The SA will provide a five-year plan which lists ADP equipment at both the SA and LA level which will give purchase date and anticipated replacement date. The five-year plan will also include anticipated costs associated with the replacements.

b. Purchases not listed on the five-year plan and greater than $100,000

will need prior USDA approval. See FNS Handbook 901.

C. Communication Controls

1. Physical Security

a. Clinic Sites: All sensitive networking equipment, to include servers, routers, and switches, will be located in the most secure area of the clinic. If it is necessary that the equipment be located in a room used to serve clients, the