Implementation of the BIR Webmail

November 21, 2018 REVENUE MEMORANDUM ORDER NO. 055-18 SUBJECT : Implementation of the BIR Webmail TO : All Internal Revenue Officials, Employees and Others Concerned I. OBJECTIVE This Order prescribes the policies, guidelines and procedures on the implementation and use of BIR Webmail by BIR Officials and select revenue personnel. HTcADC II. POLICIES AND GUIDELINES A. The BIR Webmail shall be the new official email system and channel of communication of BIR Officials and select revenue personnel. The BIR webmail shall be accessible either through Microsoft Office Exchange Application or by logging into the web application at the URL: www.portal.office.com. B. The following shall be provided with BIR Webmail account: 1. Commissioner of Internal Revenue 2. Deputy Commissioners 3. Chief of Staff of the OCIR and ODCIRs 4. Assistant Commissioners 5. Head Revenue Executive Assistants 6. Regional Directors 7. Assistant Regional Directors 8. Revenue Data Center (RDC) Heads 9. Revenue District Officers 10. Assistant Revenue District Officers CAIHTE 11. Division Chiefs of the National Office, RDCs and Revenue Regions 12. Assistant Division Chiefs of the Large Taxpayers Service 13. Select Technical Assistants of the Office of the Commissioner and Office of the Deputy Commissioners C. The BIR Webmail shall be accessed only thru the following electronic devices: 1. BIR-issued desktop computer/workstation 2. BIR-issued mobile devices ( e.g. , laptop, tablet and smartphones) 3. Personal device/gadget with authorization from the Deputy Commissioner-Information Systems Group aScITE D. Each webmail user shall be allowed a maximum of three (3) mobile devices ( e.g. , BIR-issued laptop/tablet and smartphone and personal gadget). E. The following forms shall be accomplished by each BIR webmail user per Item II.B: 1. BIR Form No. 0041 Office Automation Request (Annex A) 2. Acceptable Use Policy (AUP) for BIR Webmail (Annex B) 3. Permit to Use Personal Gadget/Device Form to Access BIR Webmail (Annex C), if applicable F. For the select BIR personnel without BIR-issued laptop/mobile phone and those who intend to use personal gadgets/devices, the Permit to Use Personal Gadget/Device to Access BIR Webmail Form (Annex C) shall be accomplished, subject to approval of Deputy Commissioner, Information Systems Group (DCIR-ISG). G. BIR webmail users shall incur mobile data/internet charges whenever using mobile devices/gadgets: 1. For BIR-issued smartphones, data/internet charges in excess of the allowed cellphone plan shall be shouldered by said official/employee. 2. For personal devices/gadgets with authorization from DCIR-ISG, data/internet charges shall be borne by the BIR official/select revenue personnel. DETACa H. The old email account of BIR webmail users (Item II.B) shall be disabled to ensure the usage of the BIR webmail. However, history of email messages prior to disablement of old email account may still be accessed in the users desktop computer/workstation for reference. I. BIR Webmail accounts dormant or inactive for one (1) month shall be automatically de-activated. Concerned webmail users may request for re-activation using BIR Form 41. They shall explain in writing on inactivity/prolonged non-use of their webmail accounts. J. All BIR webmail issues/problems encountered by users shall be reported/logged in the BIR Service Desk. K. BIR webmail users shall adhere to the email acceptable use policy. Violations on the use of BIR Webmail shall be dealt with in accordance with ICT security policies. HEITAD III. ROLES AND RESPONSIBILITIES A. Network Management and Technical Support Division (NMTSD) 1. Ensure continuous service of the BIR webmail. Release of a notification/advice to all BIR webmail users thru Internal Communications Division on BIR webmail service disruptions and provide workaround procedures for continued access to important emails. 2. Regularly monitor authentication and access logs for suspicious events on webmail user's activities. 3. Examine potential risks and ensure that the server and webmail system are patched with the latest updates to prevent vulnerabilities from being exploited. Filtering of messages for possible spam, phishing and other malware attacks must be done and users must be notified for precaution. 4. Monitor and evaluate the BIR Webmail utilization and the system overall performance. The baseline and threshold must be determined and cross-referenced with the profile of the normal operating levels and recommend corrective actions and improvements to ensure continuous availability of the webmail system. 5. Monitor and respond to webmail capacity-related concerns and administer proactive and predictive activities such as estimating future capacity requirements and setting controls on incoming and outgoing mails to ensure sufficient capacity levels. 6. Create and update the master list of employee movements in relation to granting of BIR Webmail access and ensure the necessary modification/revocation of the webmail access granted to BIR Officials and select employees, whenever necessary. aDSIHc B. NMTSD/Computer Operations Network and Engineering Division of Revenue Data Center (CONED-RDC) 1. Install and configure the BIR Webmail Application on BIR-issued Personal Computers (PCs), laptops/tablets and mobile phones. 2. Conduct briefing on the appropriate use of the BIR Webmail. 3. Address webmail system administration problems/issues such as troubleshooting, corrective maintenance and other related concerns. 4. De-activate webmail access/accounts for reported lost computers/mobile devices/gadgets. 5. Coordinate with Security Management Division for any security incident reports relative to the use of BIR webmail. 6. Perform the following in processing webmail account request: ATICcS a. Process/grant the webmail account of authorized webmail user b. Monitor automatic de-activation of dormant/inactive webmail accounts c. Re-activate webmail account based on the justification submitted by the user and approval of DCIR-ISG C. BIR Webmail Users 1. Regularly use the BIR webmail to effectively communicate with colleagues, clients/taxpayers and other BIR stakeholders. 2. Ask assistance from NMTSD/CONED-RDC for troubleshooting and other related concerns. 3. Report/log thru BIR Service Desk within twenty-four (24) hours any of the following: lost mobile device/gadget any suspected webmail data breach 4. Prepare and submit justification/explanation on de-activated webmail account. 5. Request for re-activation of webmail account using BIR Form No. 41 and submit to: NMTSD (National Office) CONED-RDC [Revenue Region/Revenue District Office (RR/RDO)] D. Assistant Commissioner of Information Systems Development and Operations Service Recommend approval of the request for webmail account ETHIDa E. Deputy Commissioner of Information Systems Group Approve the granting and implementation of the webmail account F. Security Management Division 1. Work closely with concerned offices on security breaches relative to the use of BIR webmail 2. Conduct random compliance audit on the use of BIR Webmail IV. PROCEDURES A. BIR Webmail Users 1. Accomplish/fill-up and sign the following forms/required documents: BIR Form 0041 Office Automation Request Acceptable Use Policy (AUP) for BIR Webmail Permit to Use Personal Gadget/Device to Access BIR Webmail, if applicable TIADCc 2. Submit duly accomplished forms/required documents to: NMTSD (National Office) Concerned CONED-RDC (RR/RDO) 3. Log thru BIR service desk all concerns encountered relative to BIR webmail, such as, but not limited to: Problem/issue on the use of webmail and other technical concerns Lost mobile device/gadget configured to receive BIR emails Re-activation of webmail account B. CONED-RDC 1. Validate completeness and accuracy of forms submitted by the users from RRs/RDOs 2. Forward the forms/required documents to NMTSD for processing 3. Perform the following once request is approved: Provide technical support such as configuration of computers/mobile devices and troubleshooting Brief RR/RDO Officials on the use of BIR webmail 4. Coordinate with NMTSD and Security Management Division for webmail system administration and security concerns, respectively C. NMTSD 1. Validate completeness and accuracy of request forms received from: BIR Officials and select employees in National Office cSEDTC RR/RDO Officials submitted thru CONED-RDC 2. Forward to OACIR-ISDOS and ODCIR-ISG for approval/signature of required documents/forms 3. Perform the following once request is approved: Implement/grant webmail account of BIR Officials and select employees Configure computers/mobile devices/gadgets of BIR Officials and select employees in National Office Brief National Office Officials and select employees on the use of BIR webmail Provide the webmail user guide to authorized webmail users 4. Monitor and resolve webmail system administration issues and other troubleshooting concerns AIDSTE 5. Monitor and manage the de-activation/re-activation of webmail accounts 6. Coordinate with Security Management Division on security matters relative to BIR webmail 7. Prepare notification/advisory on the unavailability/availability of BIR webmail V. EFFECTIVITY This Order shall take effect immediately. (SGD.) CAESAR R. DULAY Commissioner of Internal Revenue ANNEX A BIR Form No. 0041 Office Automation Request ANNEX B Acceptable Use Policy for BIR Webmail This Acceptable Use Policy (AUP) covers the security and use of BIR Webmail. This AUP applies to all BIR officials and select revenue personnel authorized to have access to the BIR Webmail (hereafter referred to as 'user/s'). SDAaTC This policy also applies to all information contained in the BIR Webmail, in whatever form, including all related BIR activities and all information handled by BIR relating to other organizations it deals with. By signing this document, the User understands and agrees to abide by the AUP and all applicable information security policies. This confirms that the User understands and accepts responsibilities when accessing and using the BIR Webmail. Users Responsibilities: 1. Users shall ensure the protection of the information sent, received and stored in BIR Webmail. 2. Users shall be fully liable and accountable for any unauthorized disclosure/breach of confidential and sensitive information using the BIR Webmail. 3. Users shall use the BIR Webmail for all official communications, inter-office requests, announcements and data/report submission. AaCTcI 4. Users shall not use BIR Webmail to produce or distribute "chain mails" or "hoax mails," to propagate unlawful activities, to make solicitations for personal gain, political or religious causes, and commercial purposes. 5. Users shall not be allowed to add members to a BIR-created and approved distribution list. 6. Users shall not perform automatic forwarding of webmail messages. 7. Users shall not forward BIR official email to personal email accounts ( e.g. , Gmail, Yahoo Mail, Hotmail, etc.). 8. Users shall not make any personal statements or comments made thru BIR Webmail that could in any way be construed as an action of the BIR and must bear a disclaimer such as, "These statements are solely my own opinion, and do not necessarily reflect the views of BIR." Even with this disclaimer, all practices regarding decency and appropriate conduct still apply. 9. Users shall not publish or distribute internal mailing lists to non-BIR employees. 10. Users shall not send emails to all-user distribution list, unless authorized. 11. Users shall not use the Webmail to disable, impair, or overload the performance of any computer system or network, or to circumvent any system intended to protect the privacy or security of another user, whether internal or external. acEHCD 12. Users shall not send email that contains any material that is offensive, defamatory or threatening to others and will discriminate any protected classification including age, race, color, religion, sex, national origin, disability or genetic information, as well as the BIR policy to recognize sexual preference and weight in qualifying for discrimination protection. These may include statements, messages, or images consisting of pornographic material, ethnic slurs, racial epithets, or anything that may be construed as harassing, offensive, or insulting to others based on race, religion, national origin, color, marital status, citizenship status, age, disability, or physical appearance. 13. Users shall not send communication through webmail, any information regarded as confidential and personal sensitive information, including but not limited to legal or contractual agreements, and any technical information related to the BIR operations, unless authorized. 14. Users shall use the classification features provided in the MS Office before attaching the document/s in the webmail; in accordance with the BIR Information Asset Classification Guidelines. 15. Users shall not send webmail including attachment that will exceed the one hundred fifty megabytes (150 MB). EcTCAD 16. Users shall manage file attachments and regularly delete old and unneeded emails to maintain their database size within limit. 17. Users shall not open attachments from unknown or unsecure sources. All BIR Webmail attachments, regardless of the source or content, shall be scanned for viruses and other destructive programs before being opened or stored on any of the BIR information system. 18. Users shall perform a virus scan on all materials transmitted to other users via BIR Webmail prior to sending. If you suspect that a virus has been introduced into the BIR network via Webmail, notify the Service Desk immediately. Service Desk shall act in accordance with prescribed escalation procedures. 19. Users shall not send confidential files thru BIR Webmail unless encrypted. 20. Users shall not use a webmail account assigned to another individual to either send or receive messages. 21. Users shall not modify the security parameters within the BIR Webmail. 22. Users shall have the responsibility to report suspected breaches of security policy without delay to BIR Service Desk. All breaches of information security policies will be investigated. Where investigations reveal misconduct, disciplinary action may follow in line with the BIR Revised Code of Conduct. SDHTEC This acknowledgement also confirms to abide to future circulated updates to this policy. User's Acknowledgement: I, ___________________________, hereby confirm that I have read and understood the Acceptable Use Policy for Webmail. I acknowledge my responsibilities and agree to abide by all other applicable information security policies set by the BIR. Signature ____________________________________ (Printed Name and Signature) Designation/Position ____________________________________ Office ____________________________________ Date ____________________________________ ANNEX C Date ______________________ DCIR LANEE CUI-DAVID Information Systems Group Bureau of Internal Revenue National Office Building BIR Road, Diliman, Quezon City Re : Permit to Use Personal Gadget/Device for BIR Webmail System I, ____________________________, (Name) __________________, (Designation) of ________________________________, (Office) would like to request access to BIR Webmail System for official, work-related purposes using my personal gadget/device (mobile/laptop/tablet), details of which are listed below: HSAcaE GADGET/DEVICE BRAND MODEL SERIAL NUMBER I hereby agree to comply with the following: 1. Protect the security and integrity of BIR data and technology infrastructure. 2. Abide by the Policies and Guidelines on the Use and Maintenance of BIR Email and Internet Browsing Facilities (RMO 29-2000), Revised Information and Communications Technology (ICT) Security Policy (RMO 15-2014), and Republic Act 10173 (Data Privacy Act of 2012). 3. Allow the authorized Information Systems Group personnel to access the abovementioned personal gadget/device in case of suspected breach. AScHCD __________________________________________ (Signature over Printed Name) Recommending Approval: __________________________________________ ACIR Ma. Rosario Charo G. Enriquez-Curiba Information Systems Development and Operations Service Approved/Disapproved: __________________________________________ DCIR Lanee Cui-David Information Systems Group