Form HUD Form XXXX HUD Form XXXX EIV User Access Authorization

O ffice of Public and Indian Housing (PIH)

Enterprise Income Verification (EIV) System

User Access Authorization Form and

Rules of Behavior and User Agreement

OMB No. XXXX-XXXX

Expires MM/DD/YYY

Paperwork Reduction Notice: The information collection requirements contained in this notice have been approved by the Office of Management and Budget (OMB under the Paperwork Reduction Act of 1995 (44 U.S.C. 3520) and assigned OMB control number(s) 2577-XXXX. In accordance with the Paperwork Reduction Act, HUD may not conduct or sponsor, and a person is not required to respond to, a collection of information unless the collection displays a currently valid OMB control number.

Public reporting burden for this collection of information is estimated to average xx hours. This includes the time for collecting, reviewing, and reporting the data. The information is being collected for the authorization and accountability of all individuals that will access HUD’s EIV system. Response to this request for information is required in order for HUD to comply with the Federal Privacy Act’s (5 USC 552a) requirement that HUD account for all individuals who will have access to a system containing personally identifying information of individuals assisted by the Federal government. HUD may not collect this information, and you are not required to complete this form unless it displays a currently valid OMB number. Limited confidentiality is assured.

Purpose of this form: To request initial access, modify or terminate existing access to the PIH EIV system.

Send completed forms: To your designated EIV Coordinator as listed in the instructions.

PART I. ACCESS AUTHORIZATION

A. Authorized User Details
1. PHA Code: (e.g. DC451)	2. HUD Office/PHA or Management Agent Name:		3. Address:
4. Name (first name, middle initial, last name):				5. WASS User ID (C/H/M-ID):
6. Position Title:				7. Phone Number:
8. Email Address:				9. Fax Number:
10. Type of work which involves use of the EIV system: 1 – Initial eligibility only 2 – Annual/interim reexams 3 – Security Administrator 4 – Request EIV access 5 – Certify EIV users 6 – Modify/terminate EIV access roles 7 – HUD Administrator 8 – Auditor 9 – Investigator/Program Compliance 10 – Enter/update/delete debts owed to PHAs & adverse termination information of former tenants

B. Type of Action Requested (See instructions)

1 – Add Access (Initial access request for new users)

2 – Reinstatement (Due to automatic system or other termination)

3 – Modify Access (Add/remove access roles for existing users)

4 – Terminate Access

C. PHA User Access Roles – External Users (See instructions)
1 – PHA Occupancy – Public Housing	5 – Program Administrator – Voucher (Section 8)
2 – PHA Occupancy – Voucher (Section 8)	6 – PHA User Administrator
3 – PHA Occupancy – Applications Processor	7 – PHA Security Administrator
4 – Program Administrator – Public Housing	8 – Other Prescribed by HUD

D. Public Housing Portfolio Specify the development numbers to which access will be limited.
Check here to grant access to all public housing developments
Development Number	Development Number		Development Number
1)	4)		7)
2)	5)		8)
3)	6)		9)
E. HUD User Access Roles – Internal Users (See instructions)
Select Region (Check only one region) HHQ HUB FO TARC
1 – Occupancy Specialist		5 – HQ PIH DHAP
2 – Security Administrator		6 – HQ System Administrator
3 – User Administrator		7 – HQ PIH Help Desk/TAC
4 – HUD OIG		8 – Other Prescribed by HUD

PART II. RULES OF BEHAVIOR

A. Introduction

The U.S. Department of Housing and Urban Development (HUD) is actively involved in implementing and maintaining Departmental policies and procedures to keep its Systems secure from unauthorized access and inappropriate use. In compliance with various security-related Federal laws and regulations, HUD’s Office of Public and Indian Housing (PIH) created these Rules of Behavior for the Enterprise Income Verification (EIV) system. This document was created to ensure that EIV system users comply with HUD security policies. In addition, this document ensures that system accounts remain secure and are used in the appropriate manner.

HUD may grant limited system access to users who have a need to utilize HUD information resources. These include: HUD employees, HUD contractors, Public Housing Agencies (PHAs), and PHA-hired management agents. EIV resources are for official use only. As a condition of receiving access, you are required to understand and abide by the HUD and EIV system security policies and procedures. The purpose of these policies and procedures is to safeguard HUD’s valuable information resources.

All EIV users must adhere to the Rules of Behavior outlined in this document. The rules clearly delineate responsibilities of, and expectations for, all individuals with access to the EIV system. Non-compliance with these rules will be disciplined through sanctions. This may include removal of system access for a specific period of time or termination depending on the severity of the violation. Also, see Part III for potential civil and criminal penalties, which may apply as a result of misuse of the EIV system and/or its data.

B. Responsibilities

HUD-PIH, as the System Owner, is responsible for ensuring that an adequate level of protection is afforded to the EIV system through an appropriate implementation of technical, operational, and managerial security controls.

EIV system users are responsible for the protection of passwords, information, equipment, systems, networks, and communication pathways to which they have access. All HUD computer resources including hardware, software, programs, files, paper reports, and data are the sole property of HUD.

C. Other Policies and Procedures

The Rules of Behavior do not replace existing HUD policies, rather they are intended to enhance and further define the specific rules each user must follow while accessing the EIV system. The rules are consistent with the policy and procedures described in the following security documents:

HUD Information Technology Security Policy. HUD Handbook 2400.25, Rev. 2, dated October 1, 2008, establishes responsibilities, practices, and conditions that directly or indirectly promote security in the development, operation, maintenance, and support of all HUD information technology (IT) resources. This handbook is available online at: http://www.hud.gov/offices/adm/hudclips/handbooks/admh/2400.25/index.cfm. The HUD information security policies are based on recent federal laws, regulations, and guidance on information security (from National Institute of Standards and Technology (NIST)). In areas where federal guidelines are lacking or still evolving, the policy reflects established best security practices within the security community.

D. Application Rules

The Web Access Security System (WASS) user identification (user ID) and password issued to you is to be used solely in connection with the performance of your responsibilities in support of HUD’s mission and administration of HUD rental assistance program, and may not be used for personal or private gain. You agree to be responsible for the confidentiality of the assigned information and accountable for all activity with your user ID. Furthermore, you agree that you will not provide this confidential user ID and password to another user during employment nor upon leaving the employment of the agency. Additional rules of the EIV system are as follows:

Required Training – Users are required to participate in annual Security Awareness Training and HUD-sponsored initial and updated PIH-EIV System training. Free HUD-sponsored Security Awareness and EIV training is available online at http://www.hud.gov/webcasts/archives/iv.cfm. PIH-sponsored EIV training materials are located at http://www.hud.gov/offices/pih/programs/ph/rhiip/training.cfm. Users will not be permitted to access the EIV system if the user has not obtained EIV System and Security Awareness training.

System Access (on-site only) – Users are required to use only approved HUD software, software settings, and comply with vendor software license agreements. Users are allowed to access the system only using the mechanisms specified by HUD.

Unofficial use of government information – Users must be aware that personal use of information resources is prohibited. EIV data is personal information covered by the Federal Privacy Act (5 USC 552a), as amended, and penalties apply to the misuse of that data. State and local laws may also prohibit misuse of personal information and impose penalties for misuse of the data.

Information protection – Users must avoid leaving system output records or reports unattended or unsecured. Users should lock the computer or log out of the system when leaving work areas unattended. Users shall not violate Public Law 93-579, Privacy Act of 1974, as amended, which requires confidentiality of personal data contained in government and contractor data files. Users should back up their data, test the data backups, and securely store the data in accordance with HUD policy.

Use of passwords – User passwords and user IDs are for your individual use only and are confidential HUD information. Users are required to change passwords every 30 days. Users are encouraged to avoid creating passwords that can be easily associated with you or your user ID.

System privileges – Users are given access to the system based on a need to perform specific work related only to the administration of the following PIH programs: Public Housing, Housing Choice Voucher (HCV), or Project-based voucher programs. Users shall only access the information for which they are authorized.

Individual accountability – Users shall be held accountable for their actions while accessing the system. Be aware that all computer resources are monitored and audited.

Monitoring of EIV System Use – All users and agencies are subject to monitoring of their EIV system use and compliance with security requirements by HUD, HUD contractors or a 3^rd party. If it is determined that an agency or any of its users are not in compliance with security requirements or any provision of this document, HUD will immediately terminate one or all of an agency’s users’ EIV access. HUD will reinstate access upon the successful implementation of corrective action to cure the deficiency.

Automatic EIV System Terminations – Users’ EIV system access is automatically terminated if the user does not access HUD’s Web Access Security Subsystem at least once every 90 days; or if the user is not certified by the respective EIV User Administrator.

Incident Response – Users should immediately contact their supervisor and the HUD Headquarters Security Officer at [email protected], with a copy to local HUD office, regarding any suspected violation or breach of system security.

PART III. USER AGREEMENT

I have read the above policy regarding system security awareness and practices when accessing HUD’s information technology resources. I understand the policies and procedures as set forth above, and I agree to comply with these requirements as a condition of being granted limited access to the EIV system and its data.

As an authorized user of the EIV system, I understand the information obtained may only be used for official HUD business. I understand that authorized users may access, disclose, inspect and use these data only within the scope of their official duties of administering a HUD rental assistance program. HUD employees are held to the highest level of responsibility/accountability for the protection of HUD data. HUD contractor firms will be expected to apply similar standards to their employees. Anyone who abuses EIV access privileges may be stripped of that and other access rights to HUD secure systems. Employees of an agency may be subject to personnel discipline consistent with applicable personnel rules. Contractor firms that do not assure that the Rules of Behavior are observed may be subject to remedies under the terms of their contract. I also understand that unauthorized disclosure or inspection of EIV data may result in civil and criminal penalties. The penalties are as follows:

• Unauthorized disclosure may result in me being found guilty of a misdemeanor and fined not more than $5,000 and/or imprisoned up to five (5) years.

• Unauthorized inspection of EIV data may result in me being found guilty of a misdemeanor and fined not more than $5,000 and/or imprisoned up to five (5) years.

I understand that my user ID and password are to be used only by me. Under no circumstances will I reveal or allow use of my user ID or password by another person. Nor will I use another person’s password and user ID. I will protect EIV system data within my control, whether online, printed or stored in media, from unauthorized access and disclosure.

I understand and agree to follow all HUD standards, policies and procedures.

Certification of EIV & Security Awareness Training. Authorized user certifies that he/she has obtained live or web-based EIV System and Security Awareness training within the last 12 months and agrees to participate in Security Awareness training annually and PIH-EIV System training when HUD provides updated training. Failure to provide this certification and/or participate in training will result in denied or discontinued EIV Access.

ELECTRONIC SIGNATURE

EIV System User’s Name EIV System User’s Name Date

(Print Full Name) (Signature)

PHA Authorization. As the PHA Authorizing Official, I authorize the above-named person to have access to the EIV system, as indicated by my signature below. I further understand this form for each user must be maintained on-site by the PHA and may be subject to audit at any time.

ELECTRONIC SIGNATURE

Authorizing Official’s Name Authorizing Official’s Name Date

(Print Full Name (Signature)

Part IV. HUD Use Only

For HUD Use Only (Maintain a copy of this completed form in your files)

Date Application Received: Date Application Processed:

HUD User’s Last Name:

Action taken: Approved

Denied Reason:

Rev. September 2, 2009 form HUD-XXXX