016-14-10 Ark. Code R. § 6
Current through Register Vol. 49, No. 6, June, 2024
Rule 016.14.10-006 - Policy 5014: Facility Identification and Protection Policy5014.0Facility Identification and Protection Policy Overview:5014.1 Purpose: This policy establishes requirements that provide a safe work environment for the Department of Human Services (DHS) workforce as well as visitors and contractors while in DHS Facilities.5014.2Applicability: All individuals granted access, as defined below, are covered by this policy. These individuals include all members of the DHS workforce, those employed by others to perform DHS work, and others authorized to access DHS facilities. This policy applies to all DHS facilities as designated by the DHS Chief Information Officer (CIO).5014.3Failure to Comply: Any member of the DHS workforce or volunteer granted access to DHS facilities who violates this policy is subject to sanctions, or disciplinary action as authorized under DHS Policy 1084, DHS Employee Discipline Policy: Conduct/Performance. Contractors and visitors may be subject to termination of contractual agreements, denial of access to DHS facilities, and criminal and civil remedies.5014.4Policy:5014.4.1Proper IdentificationA. All members of the DHS workforce, contractors, and visitors in a DHS facility must wear their issued DHS identification badge in plain view on their outer garments so that both the picture and information on the badge are clearly visible. If a person in a DHS facility is asked to show his or her badge by a member of the DHS workforce, the person must do so. A person's failure to show his or her ID badge must be reported as a security incident on DHS Share at https:/?dhsshare.arkansas.gov and may result in disciplinary action.B. All new employees must obtain a DHS identification badge within 30 days of hired date.5014.42BadgesA.Temporary Badges: Members of the DHS workforce, and DHS contractors assigned to work at the DHS Central Complex who have been issued an identification badge, and who misplace or forget to bring their badges to work, must check out a temporary employee badge at the main lobby reception desk. Loaner identification badges must be returned on a daily basis. Identification badges are the property of DHS and are the responsibility of the owner or borrower to safeguard from unauthorized use.5014.4.3VisitorsA. All visitors to DHS facilities must comply with identification badge procedures pertaining to the specific facility visited. Visitors to the Little Rock Complex must check in to the main lobby reception desk in Donaghey Plaza South (DPS) to be issued a visitor's badge.B. Visitor badges may only be issued for a specific event or meeting or a specific day. All visitor badges must be returned on a daily basis.C. Visitors must present a piece of photo identification in order to obtain a visitor badge. If a visitor does not have acceptable identification, as determined by the badge issuer, the member of the DHS workforce being visited must vouch for the identity of the visitor.D. All visitors must be escorted at all times when in areas where confidential, sensitive, or DHS information systems are present.E. Children of employees or visitors under the age of 12 are not required to obtain a visitor badge. If at any time, children will be unaccompanied by an adult, guardian, or a member of DHS workforce, a visitor badge must be assigned and worn.5014.4.4Extended VisitorsA. A DHS extended visitor badge will only be issued to a person who is on contract or works regularly with the Department of Human Services, and who must be in a DHS facility three or more times a week conducting business.B. Extended visitors must obtain a DHS extended visitor badge by coordinating with the personnel specialist in the division with which they will be working.C. The extended visitor badge will only be issued for a limited time period. At the end of this period, the visitor must return the badge to the issuing personnel specialist.5014.4.5ContractorsPersons who contract with DHS and conduct business in a DHS facility three times a week or more will be issued a DHS identification badge. This badge must be returned at the end of the contract or when the contract employee terminates services to DHS, whichever is sooner.
5014.4.6Temporary StaffA. Persons who are employed by DHS on a temporary basis or through a local business and work in a DHS facility for limited duration, etc., will be issued a DHS identification badge. The supervisor or division personnel specialist must complete or assist the employee in completing the required documentation.B. If at any time the person's employment status changes, his or her supervisor must make the proper notifications in accordance with DHS termination or other policy.5014.4.7Packages and ItemsA. Certain DHS facilities require special handling of packages and items introduced to the facility. Each facility director may develop procedures for the proper handling of packages and items. Facility procedures will be attached to Policy 5014.5014.4.8Facility Evacuation and Disaster PreparationA. Each facility director shall create and maintain procedures for proper evacuation of DHS facilities.B. Each facility director shall create and maintain disaster response plans for facilities as appropriate or required by state regulation.5014.5Definitions:5014.5.1DHS Information Systems: DHS Network services (Network, access, e-mail, Internet, etc.), DHS applications (client-server," web-based, mainframe, etc.), or any third-party software legally acquired and installed on the DHS devices for which it was intended. Also includes any computer file, on any device in use by DHS or its agents that is shared across the DHS network or requires DHS support or that contains DHS-related information, the privacy of which must be safeguarded.5014.5.2Confidential Information: Information that is protected from disclosure by federal or state law or regulation.5014.5.3Sensitive Information: Information or knowledge that might result in loss of an advantage or level of security if revealed (disclosed) to others who might have low or unknown trust ability and/or indeterminable or hostile intentions. Loss, misuse, modification or unauthorized access to sensitive information can adversely affect the privacy of an individual, trade secrets of a business or even the security, internal and foreign affairs of a nation depending on the level of sensitivity and nature of the information.5014.5.4Person: For the purposes of this policy, a person is defined as a uniquely identifiable and distinguishable individual, whose identity has been validated and whose association with DHS has been certified by the division requesting access credentials. A person may or may not be a DHS employee.5014.5.5DHS Facility: A location on the approved site list maintained by the CIO of DHS. This location must be under direct DHS control and supervision and under compliance with the state and department physical and logical security standards.5014.5.6Identification Badge: A DHS issued badge that is used to verify an employee's, visitor's, or contractor's personal identity.5014.5.7Visitor: Persons who are not contractors or DHS employees.5014.5.8Workforce: DHS employees, volunteers, trainees, and other persons under the direct control of DHS, whether or not they are paid by DHS.5014.6 Exceptions to Policy:5014.6.1 Exceptions to this policy and related standards must be requested in writing to the DHS IT Security Officer. Exceptions are granted in writing on a per instance basis and approved by the CIO. Individual exceptions do not extend beyond the party to whom they are issued.5014.7 References:5014.7.1 Arkansas Physical and Logical Security Standard [LESS THAN]http: //www .techarch. state. ar. us/domains/security/standards/S S-70-008 phys log standard.pdf[GREATER THAN]
5014.7.2 Health Insurance Portability and Privacy Act of 1996, United States of America5014.8 Originating Section/Department Contact:5014.8.1 Office of Systems and Technology 1st Floor Donaghey Plaza North POBox 1437, Slot N101 Little Rock, AR 72203-1437 Telephone: 682-0032016.14.10 Ark. Code R. § 006