GSA Information Technology (IT) General Rules of Behavior

Category

Rules of Behavior

Personal Use

1. Minimize the personal use of GSA IT resources.

2. Do not allow your personal use of GSA IT resources to interfere or prevent fulfillment of your official duties.

3. Only access GSA IT systems or information in performance of your official duties.

4. Do not use IT resources for private gain, commercial purposes (including endorsement of products), or profit-making activities.

Privacy

1. Assume no expectations of privacy when using GSA IT resources as all activities are subject to monitoring. 
    

2. Protect Personally Identifiable Information (PII) and other Controlled Unclassified Information (CUI), as described in GSA Orders CIO 2180.2 and CIO 2103.2, to include use of encryption, access controls, data extracts, and physical security.

Bring Your Own Device

These rules only apply to personal devices being used to conduct official business:

1. Do not download sensitive information (e.g., PII, CUI) to personal IT resources (e.g., laptop, mobile device, home computer, removable media.)

2. Keep operating system patches and antivirus software running and updated.

3. Download applications only from trusted sources.

Access

1. Keep your passwords safe; don’t share them.     

2. Lock (e.g., CTRL-ALT-DELETE) your GSA laptop and remove your personal identity verification (PIV) card when stepping away from your shared work area.

3. Logoff and shutdown your GSA workstation at the end of the workday.

Hardware and Software

1. Abide by software copyright laws and do not obtain, install, replicate, or use unlicensed software.

2. Obtain all software through the IT Service Desk unless otherwise directed by them. Do not download untrusted software from the Internet.

3. Do not acquire, possess, or use hardware or software tools that defeat software copy protection, discover passwords, identify security vulnerabilities, or decrypt encrypted files.

4. Promptly respond to patching and reboot requests from GSA IT officials. 
   
    
5. Protect GSA IT resources in your possession from theft, destruction, or misuse.

Remote access

Use approved methods (e.g., Multi-Factor Authentication (MFA), Citrix (via anywhere.gsa.gov), or Virtual Private Network (VPN) to remotely access the GSA network.

Mobile Security

1. Do not use mobile applications that request GSA network credentials unless pre-approved by IT Security.

2. Carry or store your GSA-issued mobile device(s) in a way that prevents theft.

3. When traveling, turn off your phone’s unused radios (i.e., Bluetooth, WiFi, Cellular).

Prohibited Usage

1. Never convey classified data or information over the GSA network.

2. Never convey any material that is sexually explicit, offensive, abusive, discriminatory, or objectionable. Never browse sexually explicit or hate-based websites.

3. Never transmit non-business-related large attachments, chain letters, unauthorized mass mailings, or malware.

4. Never use copyrighted or otherwise legally protected material without permission.

5. Never use GSA IT resources to "snoop" on or invade another person's privacy or break into any computer, whether belonging to GSA or another organization.

6. Never transmit any material that is libelous or defamatory.

Social Media

1. Any GSA social media account must be approved by Office of Strategic Communication (OSC) and must abide by the requirements contained in GSA Order OSC 2106.2, GSA Social Media Policy. Any GSA social media account discovered to be noncompliant with GSA policy, standards, or guidelines will be frozen or terminated.

2. Personal social media account usage also is also governed by GSA’ Social Media Policy, including but not limited to not disseminating non-public information, not using official GSA branding, and adhering to the Hatch Act and the Standards of Ethical Conduct for Employees of the Executive Branch.

3. GSA employees are encouraged to use a disclaimer clarifying that their social media communications reflect only their personal views and do not necessarily represent the views of GSA or the United States.

Use of External Sites

1. Do not re-use GSA identifiers (e.g., email addresses, usernames) or authentication secrets (e.g., passwords, token codes, PINs) for creating accounts on external sites/applications. 

Email

1. Use guidance found in GSA Order CIO 2160.2B CHGE 3, GSA Electronic Messaging and Related Services. 
   
    
2. Use @gsa.gov email accounts for official business; occasional personal use is authorized.
   
    
3. When non-agency email addresses are used for agency business, the email must be copied/forwarded to an agency account within 20 business days per the Federal Records Act (44 U.S.C. 2911 as amended by Pub. L. 113-187).

4. Never automatically forward GSA email to a non-Federal email account.

5. Use GSA-mandated encryption procedures when transmitting sensitive information (e.g., CUI, PII) to non-GSA email addresses.

Security Training

Complete the required GSA IT Security and Awareness Training each year.

Reporting

Promptly report suspected or confirmed breaches of security or PII/CUI to the IT Service Desk (or contact via +1-866-450-5250 or email ITServiceDesk@gsa.gov.)

Recordkeeping

GSA’s directive CIO 1820.2, GSA Records Management Program, provides direction on implementing recordkeeping requirements as both the development and the use of technology may create agency records.