Information and Communication Technology Security Policies

November 9, 2004 REVENUE MEMORANDUM ORDER NO. 50-04 SUBJECT : Information and Communication Technology Security Policies TO : All Internal Revenue Officials and Employees Concerned I. Objectives This Order is being issued to: establish policies/guidelines on Information and Communication (ICT) security infrastructure; establish procedures and requirements to ensure the appropriate protection of Bureau's ICT systems and resources; delineate responsibilities of offices concerned create and maintain awareness of the need for information security to be an integral part of the day-to-day operation of business systems. II. Coverage This document covers all information that is stored, processed, transmitted, or printed by any computer system or network, and on any storage medium including printed output. This document applies to all BIR employees and all others who directly or indirectly use or support BIR computing service or information. III. Policies and Procedures 1. Any act which has adverse effects to the following areas are considered as security breach/violation (refer to the Security Policies Manual prepared by Security Management Division, Information Planning & Quality Service for details): 1.1 Hardware 1.2 Software 1.3 Information 1.4 Network 1.5 Operating System 1.6 Printed Data 1.7 Computer Media 2. All Heads of Offices are required to monitor strict implementation of the set security guidelines. 3. Non-compliance to the set policies and guidelines as embodied in the Security Policies Manual constitutes a security violation which shall be reported immediately to the Security Management Division, IPQS who upon receipt of reported violation(s) shall: 3.1 Require a written explanation. 3.2 Initiate an investigation in order to determine the gravity and the nature of said violation committed. 4. Groups to be involved in the investigation of security violation(s)/breach(es) shall include the following: 4.1 Security Management Division, IPQS 4.2 Systems Support Division: 4.2.1 Network Administrator 4.2.2 Systems Administrator 4.2.3 Database Administrator 5. Depending on the nature/severity of security violation, the following actions shall be taken 5.1 Issuance of warning letter. 5.2 Elevation of issue with corresponding details of investigation to the office of the Assistant Commissioner, Inspection Service for appropriate administrative sanction. IV. Repealing Clause All other revenue issuances and/or portion(s) thereof that are inconsistent herewith are hereby revoked and/or amended accordingly. EcIaTA V. Effectivity This Order shall take effect immediately. (SGD.) GUILLERMO L. PARAYNO, JR. Commissioner of Internal Revenue