IT Security and Privacy

The IT Security Program Policy and Minimum Implementation Standards , as revised June 30, 2005, provides for a scheduled transition period up to 6 months for compliance with many control areas, and up to 3 years for systems with certification and accreditation completed under the prior policy issued in January 2003.

• DOC IT Security Program and Minimum Implementation Standards (2005)
  
• • Update Enclosure to Commerce IT Security Program Policy - Two Factor Authentication and Data Extract Logging (February 2007)
  • Memorandum Regarding Policy Update to Commerce IT Security Program Policy
    Concerning Use of Two-Factor Authentication and Data Extract Logging
• The January 2003 DOC IT Security Program Policy and Minimum Implementation Standards (DOC ITSPP) has been superseded by the June 30, 2005 DOC ITSPP.  If a copy of the January 2003 DOC ITSPP is needed, please send an email to ITSecurity@doc.gov to request a copy.
• IT Privacy Policy
• Data Extract Log and Verify Requirement Memorandum (Word Document) (PDF)