Program for Security of FOMC Information As amended effective January 27, 2015 I. INTRODUCTION. stricted Controlled (FR)" and "Class II FOMC - Restricted (FR)"—apply to very sensitive FOMC information. Class I FOMC infor­ mation must be handled at least as securely as material classified by the Federal Reserve Board as "Restricted Controlled (FR)." Ac­ cess to Class II information is somewhat less restrictive than access to Class I. It must be treated at least as securely as material classi­ fied by the Federal Reserve Board as "Re­ stricted (FR)." The classification "Class III FOMC - Internal (FR)" applies to less sensi­ tive information that still requires confidential treatment. It must be handled at least as se­ curely as material classified by the Federal Reserve Board as "Internal (FR)." (See Sec­ tion VI below for handling requirements.) Information in these classifications must be kept confidential until it is released to the pub­ lic by the Chairman or by the Committee sec­ retary pursuant to Committee instructions. All questions related to the classification, distribu­ tion, or handling of documents should be di­ rected to the FOMC Secretariat. A. "Class I FOMC - Restricted Con­ trolled (FR)." This classification is generally applied to information that includes policymaker in­ put, e.g., information related to monetary policy decisions at meetings, nonpublic views expressed by policymakers on likely future policy, and identification of meeting participants who express particular views. Class I information includes, but is not lim­ ited to: 1. Monetary Policy: Strategies and Al­ ternatives ("Tealbook, Book B"). 2. Minutes of Committee meetings, in­ cluding drafts. 3. Committee meeting recordings and transcripts. 4. Portions of Committee meeting par­ ticipants' prepared remarks that include material from Class I documents such as Tealbook, Book B; and other monetary policy alternatives under consideration. 5. Submissions by, or on behalf of, policymakers in the Summary of Eco­ nomic Projections process. The Program for Security of FOMC Infor­ mation ("the Program") describes what confi­ dential FOMC information is, how it is classi­ fied, who has access to it, how it should be handled, and who is responsible for ensuring that it is protected. Everyone with access to confidential FOMC information is required to review and abide by the rules described be­ low. These security procedures are not intended to preclude discussions within the Federal Reserve of important FOMC-related issues, including the general reasons for the Federal Open Market Committee's (the "Committee") decisions. Such discussions may be conduct­ ed for research purposes or for preparing briefings and other information for Committee members, but care should be taken that all discussion participants have the appropriate level of authorization if confidential infor­ mation is being shared. II. DEFINITION OF FOMC INFORMATION. CONFIDENTIAL Confidential FOMC information includes all privileged information that comes into the possession of the governors, Federal Reserve Bank presidents, or Federal Reserve System staff in the performance of their duties for, or pursuant to the direction of, the Committee. Such information covers, but is not limited to, expressions of policy views at Committee meetings, reasons for those views, votes of the Committee, and staff forecasts. The infor­ mation that must be kept confidential may be in any form. It includes not only paper docu­ ments, but also electronic messages and files, recordings, notes, oral briefings, and discus­ sions relating to confidential FOMC matters. III. CLASSIFICATION OF CONFIDEN­ TIAL FOMC INFORMATION. There are three security classifications for confidential FOMC information. The first two classifications—"Class I FOMC - Re­ 1 § III Program for Security of FOMC Information vant Committee meeting, and from Class II to Class III one year after the relevant meet­ ing. 6. Special memoranda or reports deemed particularly sensitive, including materials that might otherwise carry a Class II designation (e.g., a report from the manager containing information on sensitive foreign exchange operations). B. "Class II FOMC - Restricted (FR)." This classification is generally applied to Board staff forecasts prepared for the Committee and to information about open market operations. Class II information in­ cludes, but is not limited to: 1. Economic and Financial Condi­ tions: Current Situation and Outlook ("Tealbook, Book A"), and Board staff projections or assumptions relating to in­ terest rates. 2. Reports of the manager on domestic and foreign open market operations. 3. Information on Desk operations posted on confidential portions of the "MarketSource" website of the Federal Reserve Bank of New York. 4. Other materials on economic and fi­ nancial developments (including foreign), special memoranda, tables, and charts less sensitive than those in Class I, including briefing materials containing Class II in­ formation that are produced and circulat­ ed within the Board or individual Federal Reserve Banks. C. "Class III FOMC - Internal (FR)." This classification is generally applied to less-sensitive background information pre­ pared by Board staff to support policy dis­ cussions. Class III information includes, but is not limited to: 1. Tealbook Data Sheets. 2. Committee meeting agendas. D. Security Classification Downgrading of FOMC Information. FOMC information loses its security clas­ sification when the Committee releases it to the public. Class II information is down­ graded to Class III six months after the rel­ evant Committee meeting. Additionally, Tealbook, Book B; and monetary policy al­ ternatives documents are downgraded from Class I to Class II six months after the rele­ IV. ACCESS TO CONFIDENTIAL FOMC INFORMATION WITHIN THE FEDERAL RESERVE SYSTEM. Staff access to confidential FOMC infor­ mation, which includes Class I, Class II, and Class III information, requires prior authoriza­ tion. Before gaining access and annually thereafter, staff members, including office support staff, must receive, review, and agree to abide by the rules for handling confidential information that are referred to in this docu­ ment. At each Federal Reserve Bank, the presi­ dent, or the research director on the presi­ dent's behalf, is responsible for designating those individuals to be given access to each class of information. At the Federal Reserve Bank selected by the Committee to execute open market transactions (the "Selected Bank"), the manager of the System Open Market Account ("SOMA") may also desig­ nate staff on behalf of the president. At the Board, that responsibility is assumed by the Chairman or the Committee secretary on the Chairman's behalf and by Board members for their assistants. Access at the Selected Bank and the Board of Governors is limited on a strict "need-to-know" basis. Access at the other Federal Reserve Banks is also limited on a strict "need-to-know" basis and is subject to the numerical limits noted below. In comply­ ing with these limits, Federal Reserve Banks may designate different individuals to have access to different documents. For example, one slot could be filled by designating an in­ ternational economist as having access to all special memoranda relating to foreign curren­ cy operations, and a domestic economist as having access to other Class I and Class II memoranda. At each institution, access to Class I, Class II, and Class III information should be reviewed carefully at least once every year. A. Access to "Class I FOMC - Restricted Controlled (FR)" materials at Federal Re­ 2 § IV Program for Security of FOMC Information serve Banks other than the Selected Bank (and the Federal Reserve Bank that serves as the backup site for Open Market Opera­ tions) is restricted to the president and first vice president and to seven other Federal Reserve Bank personnel as well as a limited number of office support staff. B. Access to "Class II FOMC - Restrict­ ed (FR)" materials at Federal Reserve Banks other than the Selected Bank (and the Federal Reserve Bank that serves as the backup site for Open Market Operations) is restricted to the president and first vice president and to eleven other Federal Re­ serve Bank personnel as well as a limited number of office support staff. C. Access to "Class III FOMC - Internal (FR)" information is limited on a "need-to­ know" basis, but no specific limit is set on the number of individuals who may have access to such information at each location. D. The lists of all persons, including of­ fice support staff, who are authorized to have access to Class I, Class II, or Class III information are to be generated and trans­ mitted to the FOMC Secretariat annually, after the first regularly scheduled Commit­ tee meeting of the year (at which any changes to the Program would typically be considered). Over the course of the year, changes resulting from new staff assign­ ments should also be transmitted. Records of individuals' agreements to abide by the rules described in the Program should be maintained at each institution. Such records would include individuals' signatures or electronic equivalent. E. To facilitate the preparation of special analyses and briefings within the System, eligible staff may be granted ad-hoc access to Class I and Class II information on a strict "need-to-know" basis for a specific and limited period of time. Such ad-hoc ac­ cess may be granted by the president of a Federal Reserve Bank or a research director on his/her behalf or by the secretary for Board staff. Staff granted ad-hoc access must review and agree to abide by the rules described in the Program before receiving access. The FOMC Secretariat should be advised that such access has been given, and records of the access and related agreement should be maintained at each Federal Reserve Bank. F. The Chairman may make ad-hoc ex­ ceptions to this section that are either more or less restrictive for particular documents being circulated or for other confidential in­ formation. G. In order to provide secure and rapid document delivery, access to selected con­ fidential FOMC information is given elec­ tronically through the Secure Document System ("SDS"). SDS access is restricted at each Federal Reserve Bank to the presi­ dent and first vice president and up to seven other Federal Reserve Bank personnel. The Desk at the Selected Bank has access for four additional users at that Federal Reserve Bank. The president of each Federal Re­ serve Bank may delegate to the research di­ rector the responsibility for selecting users, monitoring compliance with SDS guide­ lines, and communicating with the FOMC Secretariat when changes in usage or other issues occur. Access to SDS for Board staff is authorized by the secretary on behalf of the Chairman and monitored by the FOMC Secretariat. H. Eligibility for access to confidential FOMC information for non-US citizens is, in all cases (including under IV.E), gov­ erned by 12 CFR 268.205 and by this Pro­ gram. (A summary of this rule, as it per­ tains to FOMC information, is appended to this document as "Attachment 1.") Eligibil­ ity is determined based on a number of fac­ tors (including, but not limited to, country of origin, immigration status, length of resi­ dency, and employment history) and in many cases may require a background check. I. Individuals who are not employees may not be given confidential FOMC in­ formation unless all the requirement of this section IV, including citizenship require­ ments, are met and the secretary gives prior approval. 3 §V Program for Security of FOMC Information V. ACCESS TO CONFIDENTIAL FOMC INFORMATION OUTSIDE THE FEDERAL RESERVE SYSTEM. To assure the necessary confidentiality, it is important that special care be exercised in handling FOMC materials. The minimum requirements for handling confidential FOMC and Federal Reserve information are described in the Federal Reserve Board's "Information Classification & Handling Specifications" document (copies of summary appendices of this document, labeled "Attachment 2-A" and "Attachment 2-B," are attached for conven­ ience and are also available as pages 25-27 at: (spweb.frb.gov/sites/IT/Content/Pages/FISM A/documents/Appendix J_Information Classi­ fication and Handling Standard.pdf). As not­ ed in Section III above, confidential FOMC information must be treated at least as secure­ ly as information in the corresponding Federal Reserve Board category. The following re­ quirements are highlighted here: Access to classified FOMC information outside the Federal Reserve System is limited as follows: A. Confidential FOMC documents gen­ erally are made available to the public after a lag of about five years. Such availability is subject to staff review (including consul­ tation with the Chairman or the Committee where appropriate) for the purpose of re­ dacting any materials that are still deemed to be sensitive after five years. For exam­ ple, confidential information obtained from or about particular individuals or business­ es, foreign governments and central banks, and international institutions that is deemed sensitive after the five-year lag will be pro­ tected. In addition, national security classi­ fied information that may be contained in FOMC documents remains confidential un­ til it is declassified. The principal objec­ tives of the Committee's policy of with­ holding sensitive information after the fiveyear lag are to preserve the Committee's ability to collect needed information, to al­ low its representatives to participate in sen­ sitive discussions and report on them to the Committee, to avoid disclosures that would adversely affect U.S. international relations, and to comply with the applicable laws governing the disclosure of confidential in­ formation. A. In addition to ensuring that the materi­ als themselves are made available only to staff members who have been given access to them, the information they contain should be discussed with such persons only. B. Persons who no longer have access to confidential FOMC information, whether because of a job change within the Federal Reserve, employment outside the Federal Reserve, or retirement, must release custody of all confidential materials in their posses­ sion and remain subject to all the prohibi­ tions relating to the disclosure of FOMC in­ formation that is still confidential. C. The distribution to the Committee of all documents, other than the manager's re­ ports, should be handled through the FOMC Secretariat. D. In addition, to facilitate the identifica­ tion of Class I and Class II FOMC infor­ mation, the appropriate coversheet should be placed on all such documents that are to be circulated. (The Tealbook is distinctive in appearance and meets this requirement without an additional cover page.) The most up-to-date coversheets are available on the FOMC Secretariat's web site: (fweb.rsma.frb.gov/dma/fomc/). B. Staff officers of the Committee, and those designated by the Chairman, are au­ thorized to transmit pertinent information on System foreign currency operations to appropriate officials of the Treasury De­ partment. C. The Chairman may make ad-hoc ex­ ceptions to this section that are either more or less restrictive for particular documents or for other confidential information. VI. HANDLING OF FOMC MATERIALS. CONFIDENTIAL 4 Program for Security of FOMC Information VII. ONGOING RESPONSIBILITY FOR MAINTAINING CONFIDENTIALITY. will determine the consequences for that indi­ vidual and will inform the Chairman of that determination. If a Committee participant has been found to be responsible for a breach of FOMC information security, the Committee will determine the consequences for that par­ ticipant. The Inspector General will contact law enforcement agencies whenever an inves­ tigation indicates that criminal statutes may have been violated. A. The president of each Federal Reserve Bank is responsible for ensuring the confiden­ tiality of FOMC information at that Federal Reserve Bank and for the conduct and discre­ tion of that Federal Reserve Bank's staff with regard to the use of the information. The Chairman fulfills this role at the Board. No confidential FOMC information may be re­ leased except pursuant to Committee instruc­ tions or with written authorization from the Chairman and prompt notification to the Committee. B. At each institution (Board or Federal Reserve Bank), the basic principles and rules of confidentiality shall be reviewed at least once a year with every individual who has access to confidential FOMC information. In addition to annual circulation of the Program for Security of FOMC Information, institu­ tions may implement further procedures in support of information security. C. If any Committee participant or Federal Reserve System staff person becomes aware of an incident in which FOMC information security rules may have been breached, that individual should promptly alert the FOMC Secretariat. The secretary and the Committee's general counsel will perform a review of the incident, with appropriate consultation with the Chairman and with the president of the relevant Federal Reserve Bank. The re­ sults of such reviews will be reported to the Chairman, who will inform the Committee about those results as appropriate. In light of review results, the general counsel will deter­ mine whether to request the Board's inspector general to perform an investigation of the in­ cident. D. If a staff person at the Federal Reserve Board has been found to be responsible for a breach of FOMC information security, the Chairman will determine the consequences for that individual. If a staff person at a Federal Reserve Bank has been found to be responsi­ ble for a breach of FOMC information securi­ ty, the president of that Federal Reserve Bank VIII. COMMITTEE MEETING ATTEND­ ANCE. A. Except by approval of the Committee, attendance at Committee meetings, including conference calls, is limited to: 1. Governors and Federal Reserve Bank presidents and any other alternate members. In the absence of a president, a substitute Federal Reserve Bank officer designated by the president or the Federal Reserve Bank's board of directors. 2. Committee officers. In the absence of an associate economist from a Federal Re­ serve Bank, one substitute designated in ad­ vance by the president, with notice to the FOMC Secretariat. 3. The manager of the SOMA. In the manager's absence, a substitute designated by the manager or the president of the Se­ lected Bank, with notice to the FOMC Sec­ retariat. 4. One adviser or one substitute desig­ nated in advance, with notice to the FOMC Secretariat, by each president who is not currently a member of the Committee. 5. One first vice president of a Federal Reserve Bank. This designee would be in addition to those listed above. The FOMC Secretariat maintains a rotational schedule based on nominations from Federal Reserve Banks. 6. One assistant to the manager (such as the deputy manager), FOMC Secretariat as­ sistance, and a limited number of additional 5 Program for Security of FOMC Information members of System staff designated by the Chairman. B. Attendance may be limited further by the Chairman if a meeting, or portion of a meeting, gives rise to unusual sensitivity prob­ lems. 6 Attachment 1 Program for Security of FOMC Information Protected Individuals3 A "Protected Individual" is a person who is a lawful permanent resident (that is, holds a "green card") and who has taken certain steps toward becoming a U.S. citizen. Those steps require that the person either: A. Sign a declaration of intent to be­ come a U.S. citizen and file for U.S. citi­ zenship within six months of becoming eligible to do so, 1. Attachment 1 NON-CITIZEN ELIGIBILITY FOR AC­ CESS TO FOMC INFORMATION Summary of 12 C.F.R. 268.205 Access to all FOMC information is gov­ erned under the Program for the Security of FOMC Information. Under these rules, U.S. citizens are eligible for access to all levels of FOMC information (Class I, II, and III).1 As explained below, eligibility for access to FOMC information for non-citizens depends on the individual's job, citizenship status, res­ idency and other requirements. The Commit­ tee applies the same requirements for access to its information that the Board applies when granting access to sensitive information of the Board.2 or A. Be an employee of the Federal Re­ serve System (FRS) since January 1, 2006; B. File for citizenship before requesting access to FOMC information; and C. Pass a background check acceptable to the Board. A green card holder who does not qualify under one of these criteria is not a Protected Individual, and therefore is eligible for ac­ cess only if he or she is an Eligible Employ­ ee (see below). 2. Eligible Employees To be an Eligible Employee, the noncitizen must be employed in a position at the Board or Federal Reserve Bank that re­ quires a Ph.D. in economics or finance. If the non-citizen is employed in such a posi­ tion, his or her eligibility for access is granted in two stages. A. Initial Eligibility: Eligibility in the initial stage depends on whether the non­ As a general matter, a non-citizen is eligible for access to FOMC information in only one of two ways—as a Protected Individual or as an Eligible Employee. Protected Individuals, defined below, are treated similarly to citi­ zens, and are eligible for all levels of FOMC information. Eligible Employees, defined below, are initially eligible for access based on their country of origin, but may subse­ quently be eligible for a higher level of access if they meet certain criteria. Non-citizens who are neither Protected Individuals nor Eligible Employees may not be granted access to FOMC information. 1 In all cases, whether an individual is a citizen or not, access to information of the FOMC is con­ tingent on both the eligibility discussed here and a "need to know," which involves a determination by the FOMC Secretariat or the Committee Chair­ man that the individual must be permitted access at the proposed level in order to perform his or her job. Individuals who are granted access to FOMC information must abide by all rules that apply to the handling of that information. 2 The Board's rule for access to sensitive infor­ mation by non-citizens is set forth in 12 C.F.R. 268.205. 3 Under the Board's rule, the term "Protected Individual" also includes U.S. citizens and U.S. nationals (persons who are born in American Sa­ moa, certain former citizens of the former Trust Territory of the Pacific Islands, and certain children of non-citizen nationals born abroad). The term "Protected Individuals" also covers three additional categories of individuals (those admitted for tempo­ rary residence under certain immigration provisions and those granted asylum or refugee status). How­ ever, requests for access by persons in these later categories are unlikely to arise and are thus not described here. 7 Attachment 1 Program for Security of FOMC Information citizen's country of origin is on the cur­ rent "country list," which is a list of coun­ tries whose citizens may be hired by ap­ propriated federal agencies under federal legislation (see the current country list be­ low).4 i. If the non-citizen is from a coun­ try on the country list, he or she is eli­ gible initially for Class II access. ii. If the non-citizen is not from a country on the country list, he or she is eligible initially only for Class III ac­ cess. B. Higher Eligibility: In the second stage of eligibility, a non-citizen can be­ come eligible for access to information one level higher (i.e., a non-citizen from a country list country can become eligible for Class I access and a non-citizen who is not from a country list country can be­ come eligible for Class II access). A noncitizen is eligible for this next level of ac­ cess if he or she has: i. Resided in the United States for six years; ii. Been employed with the FRS for two years; iii. Been recommended for a higher level of access by his or her division di­ rector; and iv. Passed a background check ac­ ceptable to the Board. Colombia Costa Rica Croatia Cuba Czech Republic Denmark Dominican Republic Ecuador El Salvador Estonia France Germany Greece Guatemala Haiti Honduras Hungary Iceland Ireland Israel Italy Japan Latvia Lithuania Luxembourg Netherlands New Zealand Nicaragua Norway Panama Paraguay Peru Philippines Poland Portugal Romania Slovakia Slovak Republic Slovenia Spain South Korea Thailand Trinidad & Tobago Turkey United Kingdom Uruguay Venezuela COUNTRY LIST Albania Argentina Australia Bahamas Belgium Bolivia Brazil Bulgaria Canada Chile 4 The list of eligible countries and persons is subject to legislative and other changes. The last change to the list was in 2004. 8 Attachment 2-A: Summary for Handling Printed Information 5 PRINTED Restricted-Controlled FR MP-2 Access A list of the specific FR Staff authorized to access the information must be prepared & attached to the document(s) or centrally maintained by an authorized authority MP-2 Duplication Restricted FR Board Personnel (Sensitive PII) Internal FR 7 (including Non-Sensitive PII) Share only as provided in the Board's Policy for Handling Personally Identifiable Information policy and limited to as few people as possible Authorized & need to know for official business purposes. PII may be shared with a FRS employee or Board contractor if authorized by the Board employee's supervisor or the employee's position Limited to need to know Limited to need to know 6 Authorized and need to know for official business purposes and limited to as few people as possible. Not recommended. If necessary, Limited to need to know each copy must have a unique identifier MP-3 Labeling "Restricted-Controlled FR" at the top of every page. Numbered using the "x of y" numbering or consecutively numbered w/ the final page labeled "last page" "Restricted FR" at the top of every page. Numbered "Board Personnel" at the top of using the "x of y" every page. All pages must be numbering or consecutively consecutively numbered numbered w/ the final page labeled "last page" "Internal FR" at the top of the first page. All pages must be consecutively numbered MP-3 Coversheet Restricted-Controlled FR blue coversheet Restricted FR pink coversheet Board Personnel green coversheet No coversheet MP-4 Storage 1 of the following physical controls: locked desk drawer, file cabinet or office 1 of the following physical controls: locked desk drawer, file cabinet or office 1 of the following physical controls: Stored in a secure location locked desk drawer, file cabinet or office MP-5 Transport: Internal Hand-delivered or placed within two sealed envelopes. The Hand-delivered or placed innermost envelope labeled as within a sealed envelope "Restricted-Controlled FR." MP-5 Transport: External Two sealed envelopes and sent via Registered Mail (or equivalent service) providing delivery tracking & confirmation. Sender must maintain a list of specific items containing RestrictedControlled FR that were shipped 2 sealed envelopes & sent via Registered Mail providing delivery Two sealed envelopes and tracking & confirmation. Sender sent via Registered Mail (or must maintain a list of specific Placed within a sealed equivalent service) items containing Sensitive PII that envelope providing delivery tracking were shipped. When tracking is not & confirmation. used, the transmitter must use compensating controls to the extent possible. Sent via encrypted fax machine and confirm receipt Sent via encrypted fax machine and confirm receipt Sent via encrypted fax machine & confirm receipt. When using nonsecure fax, the transmitter must use compensating controls to the extent possible. No special requirements Physically destroyed (e.g., paper shredders or approved secure document receptacles) Physically destroyed (e.g., paper shredders or approved secure document receptacles) Physically destroyed (e.g., paper shredders) MP-5 Transport: Fax Physically destroyed (e.g., MP-6 Sanitization paper shredders or approved & Disposal secure document receptacles) Hand-delivered or placed within a sealed envelope 5 FOMC Documents are labeled FOMC Class 1- Restricted Controlled FR 6 FOMC Documents are labeled FOMC Class 2 - Restricted FR 7 FOMC Documents are labeled FOMC Class 3 - Internal FR Information Classification and Handling Standard 25 9 No special requirements 08/26/13 Version 5.5 Attachment 2-B: Summary for Handling Digital Information Board Personnel (Sensitive PII) Internal FR 1 0 (including Non-sensitive PII) Authorized and need to know for official business purposes and limited to as few people as possible. Share only as provided in the Board's Policy for Handling Personally Identifiable Information policy and limited to as few people as possible Authorized & need to know for official business purposes. PII may be shared with a FRS employee or Board contractor if authorized by the Board employee's supervisor or the employee's position Not recommended. If necessary, each copy must have a unique identifier Limited to need to know Limited to need to know Limited to need to know MP-3 Labeling Restricted-Controlled FR label must be provided when the information is accessed or displayed. Label Removable media "Restricted-Controlled FR" Restricted FR label must be provided when the information is accessed or Removable media labeled "Board displayed. Label Personnel" Removable media "Restricted FR" MP-4 Storage 1 of the following physical controls: locked desk drawer, file cabinet or office. Store only on Board or Trusted Third Party owned media that is encrypted using an encryption module that is FIPS-140-2 certified. 1 of the following physical controls: locked desk drawer, file cabinet or office. Store only on Board or Trusted Third Party owned media that is encrypted using an encryption module that is FIPS-140-2 certified. 1 of the following physical controls: locked desk drawer, file cabinet or office. Sensitive PII stored on Store in a secure location. portable media must be encrypted. Store only on Board or FRS Store only on Board or Trusted owned media. Third Party owned media that is encrypted using an encryption module that is FIPS-140-2 certified. Transport on Board or Trusted Third Party owned encrypted portable media that is encrypted using an encryption module that is FIPS-140-2 certified and hand-deliver or place in a sealed envelope Transport on Board or Third Party owned encrypted portable media that is encrypted using an encryption module that is FIPS­ 140-2 certified and hand-deliver or place in a sealed envelope Transport only on Board or FRS owned media Transport on Board or Trusted Third Party owned encrypted removable media that is encrypted using an encryption module that is FIPS-140-2 certified in 2 sealed envelopes and sent via Registered Mail (or equivalent service) providing delivery tracking & confirmation. Transport on Board or FRS owned encrypted removable media that is encrypted using an encryption module that is FIPS-140-2 certified in 2 sealed envelopes and sent via Registered Mail providing delivery tracking & confirmation. Sender must maintain a list of specific items that were shipped. When tracking is not used, the transmitter must use compensating controls to the extent possible. Placed within a sealed envelope. Transport only on Board or FRS owned media. DIGITAL Restricted-Controlled FR 8 A list of the specific FR Staff authorized to access the information must be prepared MP-2 Access & attached to the media or centrally maintained by an authorized authority. MP-2 Duplication MP-5 Transport: Internal MP-5 Transport: External Transport on Board or Trusted Third Party owned encrypted portable media that is encrypted using an encryption module that is FIPS-140-2 certified and hand-deliver or place in 2 sealed envelopes. Innermost envelope labeled Restricted-Controlled FR Transport on Board or Trusted Third Party owned encrypted removable media that is encrypted using an encryption module that is FIPS-140-2 certified in 2 sealed envelopes and sent via Registered Mail providing delivery tracking & confirmation. Sender must maintain a list of specific items containing RestrictedControlled FR that were shipped Restricted FR 9 8 FOMC Digital Information, including E-mail is labeled FOMC Class 1- Restricted Controlled FR 9 FOMC Digital Information, including E-mail is labeled FOMC Class 2 - Restricted FR 10 FOMC Digital Information, including E-mail is labeled FOMC Class 3 - Internal FR Information Classification and Handling Standard 26 10 Removable media labeled as "Internal FR" 08/26/13 Version 5.5 MP-5 Transport: Email MP-6 Sanitization & Disposal Internal Recipients: Use "FRS Only" category (Reserve Bank users sending Class I FOMC information use the FOMC Classification) External Recipients: Encrypt using Board approved encryption technologies. Use "Secure External" category. Class I FOMC should not be sent outside the FRS. Follow the Media Sanitation and Disposal Policy & Procedures Internal Recipients: Use "FRS Only" category. (Reserve Bank users sending Class II FOMC information use the FOMC Classification) External Recipients: Encrypt using Board approved encryption technologies Use "Secure External" category. Class II FOMC should not be sent outside the FRS. Follow the Media Sanitation and Disposal Policy & Procedures Information Classification and Handling Standard 27 11 Internal Recipients: Use "FRS Only" category External Recipients: Encrypt using Board approved encryption technologies unless the person the information concerns specifically authorizes the unencrypted email communication. Using unencrypted e-mail requires the transmitter to use compensating controls. Use "Secure External" category Follow the Media Sanitation and Disposal Policy & Procedures Internal Recipients: Use "FRS Only" category External: Use "Unsecured External" category Follow the Media Sanitation and Disposal Policy & Procedures 08/26/13 Version 5.5