POLICY ON PERSONAL COMPUTERS

• Document Type: CREST
• Collection: General CIA Records
• Document Number (FOIA) /ESDN (CREST): CIA-RDP95-00972R000100190010-0
• Release Decision: RIPPUB
• Original Classification: U
• Document Page Count: 2
• Document Creation Date: December 23, 2016
• Document Release Date: August 23, 2012
• Sequence Number: 10
• Publication Date: March 18, 1983
• Content Type: MEMO

Declassified in Part - Sanitized Copy Approved for Release 2012/08/23: CIA-RDP95-00972R000100190010-0
/11
DATE: March 18, 1983
NOTE TO:
SUBJECT: Policy on Personal Computers
Fred:
I'm not really sure that I fully understand the purpose of the policy.
If it is intended to block the use of non-tempested equipment in the Agency,
then I think the policy should be broadened to include all electronic
devices.
If however, the intent is to prevent the unauthorized removal of magnetic
media from the building or to remind people that they should handle and store
the magnetic media properly. Then I strongly object, this problem is not
unique to personal computers.
If the policy is intended as a restraint to prevent the removal of the
device itself from the building, I also object to that, the material stored
on magnetic media is the problem not the device. Security doesn't check
people going in and out of the building to see if they are carrying pens
and pencils when its the written word that you want to protect.
I hope that you don't get the wrong impression from my note. I do not have
a negative attitude on the subject of security, my intent is to try and
point out that the items and areas addressed by this policy are not unique to
the personal computer and are certainly not new. If we are going to address
these issues lets talk about all magnetic media, all computer listings and
the removal of all recording equipment from the building. My final
observation is that all such devices, storage media and procedures should
be subject to a security audit and that should be understood by all Agency
employees.
STAT
Declassified in Part - Sanitized Copy Approved for Release 2012/08/23: CIA-RDP95-00972R000100190010-0
 Declassified in Part - Sanitized Copy Approved for Release 2012/08/23: CIA-RDP95-00972R000100190010-0
Admieistrai Internal Ilse Ong.
Policy Number 14 Personal Computers* for Headquarters**
Applications
Information Systems Security Group policy is to restrict
the use of personal microcomputers to only those applications
which can be solidly justified for reasons such as efficiency
and substantial cost savings, and where demonstrably robust
security controls exist.
The Information Systems Security Group recognizes that
some personal microcomputers will be required for unclassified
applications. Our experience to date, however, clearly
indicates that the presence of unclassified word and data
processing equipment in classified program/project areas
creates the very real danger of contamination of the
unclassified system in spite of conscientious efforts on the
part of well intentioned individuals to prevent such
occurrences. For this reason, all processing which occurs in
classified program/project areas will be presumed to be
classified and must be controlled accordingly.
In those selected cases where sufficient management
justification exists, the use of personal microcomputers for
the processing of Agency official information in a work-related
capacity in a classified program/project area may be approved
providing:
a. The use of personal microcomputer equipment, in
each case, is approved by the Information Systems
Security Group, Office of Security and the
program/project Manager.
b. The personal microcomputer equipment is TEMPEST
approved, or otherwise controlled, in accordance with
standards published by the Office of Communications.
c. The program/project manager creates, publishes and
promulgates written procedures designed to securely
control the use of personal computers, and all
associated magnetic storage media and printed output.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
* A personal computer is defined as one which (a) is easily
transportable, (b) possesses limited software capabilities, and
(c) costs less than $5,000.00.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
** The headquarters building, the Agency training centers and
Agency owned or leased facilities located in the Washington
D.C. metropolitan area.
Declassified in Part - Sanitized Copy Approved for Release 2012/08/23: CIA-RDP95-00972R000100190010-0