PB 22164 - September 29, 2005 - USPS.com® - About

POSTAL BULLETIN 22164 (9-29-05)
HANDBOOK AS-805 REVISION
Information Security
Effective September 29, 2005, Handbook AS-805, Information
Security, is revised as follows to address:
Gaining access to controlled areas.
Updating the facility business continuance management
planning section.
Registering applications in eAccess.
Implementing an acceptance of responsibility letter
for documented vulnerabilities that will not be
mitigated.
Implementing patch management of information
resources.
Updating Appendix A.
Updating Appendix B.
We will incorporate these revisions into the next online
update of Handbook AS-805 available on the Postal Service
PolicyNet Web site:
Go to http://blue.usps.gov.
Under “Essential Links” in the left-hand column, click
on References.
Under “References” in the right-hand column, under
“Policies,” click on PolicyNet.
Then click on HBKs.
(The direct URL for the Postal Service PolicyNet Web
site is http://blue.usps.gov/cpim.)
Handbook AS−805, Information Security
* * * * *
7 Physical and Environmental Security
* * * * *
7-2 Roles and Responsibilities
* * * * *
7-2.6 All Personnel
All personnel are responsible for the following:
* * * * *
[Reletter current items b through e as new items d through
g. Add new items b and c to read as follows:]
b. Always using their physical and technology electromechanical
access control identification badge or
device to gain entrance to a controlled area.
c. Ensuring no one tailgates into a controlled area on
their badge.
* * * * *
93
7-3 Facility Security
* * * * *
7-3.1 Physical Access Controls
* * * * *
7-3.1.3 Access to Controlled Areas
[Revise 7-3.1.3 to read as follows:]
Access to controlled areas is restricted to personnel whose
duties require access to such facilities and who possess
appropriate security clearances. Access to controlled
areas must be authorized and tailgating is not allowed.
Access to controlled areas must be controlled by electromechanical
means. Personnel authorized access to the
controlled areas must always use their physical and
technology electromechanical access control identification
badge or device to gain entrance to the controlled area. It is
their responsibility to ensure no one tailgates on their
badge.
Personnel without an authorized physical and technology
electromechanical access control identification badge or
device must be escorted by authorized personnel while in
the controlled area.
* * * * *
[Revise the title and text of 7-3.4 to read as follows:]
7-3.4 Facility Business Continuance Management
Planning
Physical security requirements must be included in facility
business continuance management (BCM) planning to
ensure the appropriate protection of information resources
following a catastrophic event (see Chapter 12).
* * * * *
8 System, Applications, and Product
Development
* * * * *
8-2 Roles and Responsibilities
* * * * *
8-2.6 Portfolio Managers
Portfolio managers are responsible for the following:
* * * * *
[Reletter current items e through g as new items f through
h. Add new item e to read as follows:]
e. If a documented vulnerability will not be mitigated,
preparing and signing an acceptance of responsibility
letter as part of the ISA process.
* * * * *