, 2. How is access to the data by access to travel documents is controlled based A user’s a user determined? Are criteria, on a concept of based and The “role group access.” procedures, controls, and agency determines what the policies and procedures are responsibilities regarding access for determining a access based on their person’s documented? User controls restrict access. Users with access to E2 Solutions will follow their policies, agency’s procedures, and guidance for data access. The System Administrator sets user access levels based on agency sensitivity requirements. Criteria, procedures, controls, and responsibilities regarding access are outline in the System Guide. Administrator’s Federal travelers, managers, and System Administrators will access the on-line system through a FIPS-compliant encrypted connection. System safeguards include forced logout, system time-out, password expiration, and lockout after a specified number of failed login attempts. The System Administrator can control and enable these safeguards which are configurable at the agency level and can be customized to meet the Federal needs. agency’s Ref: The System Security Plan 3. Will users have access to all Access controls within E2 Solutions limit the functions and data in the system or will the data available to a given user based on need-to-know and user's access be restricted? job responsibilities. The potential for sensitive data to be Explain. viewed, modified, or deleted by unauthorized personnel is minimized. Traveler access is restricted to that individuals own TAVS, profile, and reservation data, as well as general reservation and system-use information. A traveler designated travel arranger also has access to the TAVS, profile, and/or reservation data, when traveler’s given the proper permissions. In general, access to data is given on a need-to-know basis. The agency will determine the access level based on this need-to-know. The approver will have access to some data but not all data, and this right to use/see specific data will be determined by the policies agency’s and procedures and the access control permission granted to see the appropriate information. Designated Agency-wide System Administrators will have access for the purpose of adding or deleting users,
, 2. How is access to the data by a user determined? Are criteria, procedures, controls, and responsibilities regarding access documented? A user’s access to travel documents is controlled based on a concept of “role based and group access.” The agency determines what the policies and procedures are for determining a person’s access based on their User controls restrict access. Users with access to E2 Solutions will follow their agency’s policies, procedures, and guidance for data access. The System Administrator sets user access levels based on agency sensitivity requirements. Criteria, procedures, controls, and responsibilities regarding access are outline in the System Administrator’s Guide. Federal travelers, managers, and System Administrators will access the on-line system through a FIPS-compliant encrypted connection. System safeguards include forced logout, system time-out, password expiration, and lockout after a specified number of failed login attempts. The System Administrator can control and enable these safeguards which are configurable at the agency level and can be customized to meet the Federal agency’s needs. Ref: The System Security Plan 3. Will users have access to all data in the system or will the user's access be restricted? Explain. Access controls within E2 Solutions limit the functions and data available to a given user based on need-to-know and job responsibilities. The potential for sensitive data to be viewed, modified, or deleted by unauthorized personnel is minimized. Traveler access is restricted to that individuals own TAVS, profile, and reservation data, as well as general reservation and system-use information. A traveler designated travel arranger also has access to the traveler’s TAVS, profile, and/or reservation data, when given the proper permissions. In general, access to data is given on a need-to-know basis. The agency will determine the access level based on this need-to-know. The approver will have access to some data but not all data, and this right to use/see specific data will be determined by the agency’s policies and procedures and the access control permission granted to see the appropriate information. Designated Agency-wide System Administrators will have access for the purpose of adding or deleting users,
ETS_E2Solutions_PIA_2012.docx