Citywide Asset and Logistics Management System (CALMS)

Individual User Security and Use Policy

(Effective May 1, 2013)

1. INTRODUCTION

   The New York City Emergency Management Department (NYCEM) has developed the Citywide Asset and Logistics Management System (CALMS) as a secure system for collecting and distributing logistics- related information among NYC Agencies and partner jurisdictions and organizations.

   CALMS is designed to support Citywide Logistics efforts, and endeavors to standardize management of assets during response and recovery operations. CALMS stores and displays data on selected facilities, fleet, heavy equipment, personnel titles, and supplies. It also contains detailed City demographic data and robust GIS mapping capabilities. CALMS is a living system, and continues to be enhanced with input from our Citywide Logistics Committee (CLC) Agencies and planning partners.

   NYCEM is responsible for ensuring the security of data within CALMS, and protecting participating agencies from intrusions originating on or through CALMS. The purpose of the Individual User Security and Use Policy (Policy) is to define a set of minimum requirements that all individuals who access CALMS, (the “CALMS users”), must follow. This Policy highlights the security terms, conditions, and responsibilities that the users of CALMS must agree to in the handling of sensitive data accessed using CALMS assigned accounts.

2. COMPLIANCE

   This Policy will be posted on the CALMS website. Entry into the CALMS database will only be granted by agreeing to comply. NYCEM shall review this Policy at least once every two years to ensure relevancy, and will inform all Agencies that store data in CALMS of any forthcoming changes to this Policy. NYCEM may periodically review compliance by CALMS users to this Policy. Compliance with this Policy is mandatory. Each user must understand his / her responsibilities regarding privacy and protecting data in CALMS.

3. DATA OWNER

   Agencies that submit data for inclusion in CALMS will be the considered the owner of such data. NYCEM is the custodian of the CALMS data and, as such, is responsible for establishing and maintaining appropriate administrative, technical, and physical safeguards to prevent unauthorized access to or use of an Agency’s data stored in CALMS.

4. SECURITY

   CALMS users are assigned access credentials including log-in names and passwords by the NYCEM CALMS Administrator. The log-in names and passwords are used by the NYCEM CALMS Administrator to authenticate a CALMS user’s ability to access the data in CALMS. These log-in names are unique for each user, and must not be shared with others. The NYCEM CALMS Administrator uses these NYCEM to manage and control access to data, including confidential information. The NYCEM CALMS Administrator must be notified immediately if a CALMS user suspects that any of his/ her access credentials have been compromised. Upon termination of employment, CALMS users shall immediately discontinue use of his or her log-in name and password. Passwords and log-in names are not transferrable. Agencies are responsible for notifying the NYCEM CALMS Administrator of the change in employee status of a CALMS user. NYCEM cannot be responsible for any breach or incursion caused by an Agency’s failure to advise the NYCEM CALMS Administrator of a change in staff or CALMS User at their Agency.

   CALMS users are expected to respect the privacy of data on CALMS. While there are routines in place to maintain this privacy, it is expected that users will not try to purposefully circumvent them. CALMS users must only access the data to which they are authorized. Users accessing CALMS shall not intentionally seek information on, obtain copies of, or modify files, data or identification codes belonging to other users, unless explicit written permission has been given by NYCEM. Users shall not seek electronic means to gain unauthorized access to information present on CALMS for which they have not been granted explicit access.

   CALMS users will have the right to download their data from CALMS data servers. However, once that data is downloaded, users must protect the data, and any source documents derived from the data, from subsequent theft or disclosure. CALMS users shall not share data from CALMS, except in the manner set forth below in Section VI, Data Disclosure.

   For both security and performance reasons, logs are kept of all CALMS accesses. Users, therefore, understand and agree to the fact that these logs and monitoring sessions can trace their activities in CALMS. The NYCEM CALMS Administrator monitors CALMS.

5. ACCESS AND USAGE OF DATA

   CALMS contains electronic data maintained by various New York City Agencies and partner organizations. If an Agency requires special permission to allow access to its data by other Agencies, it shall be the sole entity to authorize access to its data. An Agency requiring special permission is also responsible for responding to questions about the data to which they authorize access.

   1. ACCEPTABLE USE OF CALMS

      Acceptable use is use that is authorized by the New York City NYCEM and is consistent with emergency management planning and/or emergency response, as stated by applicable New York City, New York State, or Federal laws. It is the obligation of the CALMS user, to take reasonable steps to ensure his / her authorized access to CALMS is compliant with this and any other applicable City policies and all applicable laws and regulations.

   2. UNACCEPTABLE USE

      Unacceptable use of CALMS includes, but is not limited to:

      • For any illegal purpose including violations of Federal, New York State, or NYC Local Laws.
      • To transmit threatening, obscene, or harassing materials.
      • For activities unrelated to the mission of NYCEM or other Agency.
      • For unauthorized secondary release of NYCEM or Agency data and information.
      • To interfere with or disrupt CALMS users, services, or equipment.
      • Distribution of any advertising material or products.
      • Propagation of computer worms or viruses.
      • Using CALMS to make unauthorized entry to other computers information, or communications devices or resources.
      • Using CALMS to infringe any copyright protections applicable to programs and/or data available on CALMS.
      • To access or edit information or data without confirmation that access or editing is permissible.
      • For commercial purposes such as marketing or business transactions between commercial organizations.
      • For personal profit or gain.
      • To intentionally develop programs that harass and/or damage or alter the software components of a computer or computing system.
      
      
6. DATA DISCLOSURE

   Data originating from CALMS is protected NYCEM policy/procedures. Employees or agents of New York City or partner organizations who have acquired data from CALMS shall not disclose this information to any other person unless that person:

   • Is explicitly authorized to see that information.
   • Requires that information to perform an official task.
   • Requires it in support of an emergency response.
   
   
7. ENFORCEMENT

   The guidelines established with this policy are intended to be illustrative of the range of acceptable and unacceptable uses of CALMS and its facilities, and are not necessarily exhaustive. Questions about specific uses not enumerated in this policy statement and reports of specific unacceptable uses must be reported to the NYCEM CALMS Administrator (CALMS@oem.nyc.gov) at the earliest opportunity.

8. VIOLATIONS

   Clear violations of the policy that are not promptly remedied may result in termination of CALMS access for the person(s) at fault. Unauthorized use, fraudulent use, abuse of computing within CALMS, or unauthorized disclosure of information may lead to suspension of access or loss of privilege for the person(s) at fault. In addition, if the unauthorized use violates a New York City, New York State, or Federal law, the user may face the imposition of monetary penalty or criminal prosecution as provided by such statutes. Any CALMS user who knows or has reason to believe that another person has violated this policy shall report the matter promptly to the NYCEM CALMS Administrator.

Account Requestor Click Button
I have read in its entirety and understand the CALMS Individual User Security and Use Policy. I agree to the terms and conditions for CALMS access and use. I fully understand that non-compliance can result in immediate suspension of CALMS access, investigation, and/or, referral for appropriate legal action. I understand that logging and monitoring of keystrokes and other monitoring activities will occur. I will not share my account’s access information with anyone else. This is my individual account. I understand that I am responsible for any activity attributable to the use of this account.