Home  ::  Procedures  ::  Administrative procedure #20

Administrative procedure #20 : Electronic Mail/Internet Usage/SACWIS Search Function

• 20.1 Purpose
• 20.2 Definitions
• 20.3 Permissible Uses of Electronic Mail, Internet and Data Distribution
• 20.4 Transmission of Confidential Information
• 20.5 Prohibited Uses of Electronic Mail or Internet
• 20.6 Prohibited Uses of the SACWIS and Any Other Search Function
• 20.7 Statewide Business-Related Announcements
• 20.8 Department Monitoring, Access and Disclosure
• 20.9 Security
• 20.10 Maintenance of Electronic Mail
• 20.11 Policy Enforcement
• 20.12 Policy Acknowledgement
• APPENDIX A
• APPENDIX B

20.1 Purpose

The purpose of this Administrative Procedure is to establish the Department's policy regarding the access, use, maintenance and disclosure of electronic communication, and data distribution, which includes, but is not limited to, electronic mail and Internet usage. Electronic mail or E-mail has become an essential method of communication that is accessible to all Department of Children and Family Services (DCFS) staff. The Department encourages and supports the use of E-mail to facilitate timely and efficient business-related communications; however, there are some basic principles that govern the use of electronic communication and data distribution.

· The Department's electronic mail and Internet systems should be used only for business-related communications and research.

· Department employees and other authorized users should have no expectation of privacy in anything they access, create, store, send or receive when using the Department's electronic mail and Internet systems.

· All users of the Department's electronic mail and Internet systems are required to use these resources in a responsible, professional, ethical and lawful manner.

· E-mail or Internet, used inappropriately, could result in lawsuits, costly litigation and/or employee discipline.

· The sending of E-mail does not absolve the sender from communicating orally with the recipient on critical job-related matters or tasks.

· E-mail encryption and security is solely to be provided via the CMS Public Key system implemented, no other variants are allowed.

· All department web-based or Internet accessible applications must use Secure Sockets Layer, at a minimum of 128-bit key strength, to secure the communications channel between the connecting client and the server.

o Only department web-based applications that are not available via the Internet may use a self signed certificate.

o All Internet available applications must use a certificate provided by a certified third party (GTE Cyber Trust, Verisign,, Entrust, etc.), and may not be a self-signed certificate.

· All department email must include the following disclaimer and statement of confidentiality.

o "PRIVILEGED AND CONFIDENTIALITY NOTICE: This email (and/or the documents accompanying such) may contain privileged/confidential information. Such information is intended only for the use of the individual or entity above. If you are not the named or intended recipient, you are hereby notified that any disclosure, copying, distribution, or the taking of any action in reliance on the contents of such information is strictly prohibited. If you have received this transmission in error, please immediately notify the sender by telephone to arrange for the secure return of the document."

Electronic Data Distribution

· All data distribution shall be implemented or approved by the Office of Information Technology Services (OITS).

· Data distribution standards and methodologies will be observed at all times to ensure the quality and security during delivery.

· Data movement via physical devices such as flash, removable hard drives, tape, etc. shall meet with OITS approval.

VPN/Remote Access

· VPN tunnel encryption must meet a minimum of utilizing 3DES or AES encryption for the secure tunnel.

· Usage should be approved by OITS and user's business manager/supervisor.

· Usage is restricted to DCFS employee's or contracted business partners, to utilize for access to DCFS applications and services only.

· Any and all VPN connectivity constitutes an acceptance of the "acceptable use policies" of DCFS and it's information and computing systems. All VPN connections are subject to investigation, monitoring.

This Administrative Procedure should be considered an extension and further clarification of the information contained in the Department's Internet User's Guide (see Appendix B).