Addendum to RMO No. 53-2010 Dated June 11, 2010 by Prescribing the Policies and Guidelines on Information and Communication Technology (ICT) Security Offenses

July 30, 2010 REVENUE MEMORANDUM ORDER NO. 067-10 SUBJECT : Addendum to RM O No. 53-20 10 Dated June 11, 2010 by Prescribing the Policies and Guidelines on Information and Communication Technology (ICT) Security Offenses TO : All Internal Revenue Officials, Employees and Others Concerned This Order is an addendum to RMO No. 53-2010 dated June 11, 2010 by prescribing the policies and guidelines on Information and Communication Technology (ICT) Security Infrastructure System, defining thereat certain offenses as additional grounds for administrative disciplinary action with their corresponding penalties, which shall form part of Chapter II, Section 12 (G) entitled "Create and Maintain awareness of the need for information security to be an integral part of the day-to-day operation of business systems" , and Chapter VII, Section 44 under "Additional Circumstances as Grounds for Administrative Disciplinary Action with their Corresponding Penalties", of the Revised Code of Conduct . This Order shall take effect immediately. (SGD.) KIM S. JACINTO-HENARES Commissioner of Internal Revenue ATTACHMENT CHAPTER II Responsibility to the BIR Section 12. Responsibility of Head of Office and other Revenue Employees. G. Create and Maintain awareness of the need for information security to be an integral part of the day-to-day operation of business systems . Every Revenue Official or Employee shall be responsible in protecting and conserving the Information and Communication Technology (ICT) resources of the bureau. He/She shall be responsible for observing all established policies, procedures and requirements in the ICT environment. He/She shall create and maintain awareness of the need for information security to be an integral part of the day-to-day operation of business systems. AcICHD He/She shall also ensure that Security Policies and all pertinent revenue issuances shall not be violated. Users are responsible for all activities, known or unknown, related to the use of their ID. Security Breach in the ICT environment shall be classified as follows: A. Gross Neglect of Duty Disclosure of sensitive information without prior management approval Unsecured superuser and other powerful accounts Disclosure of user id and password without consent Failure to disclose to proper authorities any event or incident of violations and/or security breaches discovered by and/or made known to him/her Other analogous cases B. Grave Misconduct Unauthorized user access to BIR offices Unauthorized access to the operating system Unauthorized access to the database Unauthorized alterations (addition, modification, deletion) to system objects and files, application, data and logs Unauthorized access to the network Unauthorized access to application systems Unauthorized access to machines (PCs, servers, peripherals, etc.) holding or transmitting applications or data Unauthorized access to printed output (reports, correspondences, etc.) and electronic files Unauthorized copying of BIR software and data Installation of unauthorized software Unauthorized access to external storage media (tape cartridges, flash drives, optical media, floppy disks, etc.) Unauthorized users gaining access to the system via logged-in workstations cAaETS Adding an unauthorized PC or other devices to the network Disclosure of user id and password even with his/her consent Misrepresentation or falsification of his/her identity on the internet or in any BIR system or communications Disruption of the operations of the BIR's information and communication technology systems Unauthorized disabling of hardware, software, monitoring tool installed on any system or network Abuse of access privileges Unauthorized download, installation, storage or transmittal of software not licensed to the BIR Unauthorized probing or cracking of security mechanisms either at BIR or external sites Unauthorized establishment of internet or other external network connections Unauthorized setting-up of proxy servers Other analogous cases C. Falsification of official document Unauthorized alterations (addition, modification, deletion) to printouts (reports, correspondences, etc.) and electronic files Other analogous cases Non-compliance therewith shall constitute as a Grave Offense. CHAPTER VII Removal for Cause, Classification of Offenses as Prescribed Under Existing Civil Service Commission Rules, and Additional Grounds for Administrative Disciplinary Action with Their Corresponding Penalties Section 44. Additional Circumstances as Grounds for Administrative Disciplinary Action with their Corresponding Penalties. Grave Offenses Infractions Penalties Grave Misconduct as Disclosure of sensitive information 1st Offense, Dismissal defined in Section 12 (G) without prior management approval Unsecured superuser and other powerful accounts Disclosure of user id and password without consent Failure to disclose to proper authorities any event or incident of violations and/or security breaches discovered by and/or made known to him/her Other analogous cases Gross Neglect of Duty as Unauthorized user access to BIR 1st Offense, Dismissal defined in Section 12 (G) offices Unauthorized access to the operating system Unauthorized access to the database Unauthorized alterations (addition, modification, deletion) to system objects and files, application, data and logs Unauthorized access to the network Unauthorized access to application systems Unauthorized access to machines (PCs, servers, peripherals, etc.) holding or transmitting applications or data Unauthorized access to printed output (reports, correspondences, etc.) and electronic files Unauthorized copying of BIR software and data Installation of unauthorized software Unauthorized access to external storage media (tape cartridges, flash drives, optical media, floppy disks, etc.) Unauthorized users gaining access to the system via logged-in workstations Adding an unauthorized PC or other devices to the network Disclosure of user id and password even with his/her consent Misrepresentation or falsification of his/her identity on the internet or in any BIR system or communications Disruption of the operations of the BIR's information and communication technology systems Unauthorized disabling of hardware, software, monitoring tool installed on any system or network Abuse of access privileges Unauthorized download, installation, storage or transmittal of software not licensed to the BIR Unauthorized probing or cracking of security mechanisms either at BIR or external sites Unauthorized establishment of internet or other external network connections Unauthorized setting-up of proxy servers Other analogous cases Falsification of Official Unauthorized alterations (addition, 1st Offense, Dismissal Document as defined in modification, deletion) to printouts Section 12 (G) (reports, correspondences, etc.) and electronic files Other analogous cases