90012 User Access Authorization Form

OMB No. 2502-0204

Expires MM/DD/YYYY

E nterprise Income Verification (EIV) System

User Access Authorization Form

Paperwork Reduction Notice: The information collection requirements contained in this notice have been approved by the Office of Management and Budget (OMB under the Paperwork Reduction Act of 1995 (44 U.S.C. 3520) and assigned OMB control number(s) 2502-0204 (pending). In accordance with the Paperwork Reduction Act, HUD may not conduct or sponsor, and a person is not required to respond to, a collection of information unless the collection displays a currently valid OMB control number.

Public reporting burden for this collection of information is estimated to average .50 hours for initial and periodic responses, respectively. This includes the time for collecting, reviewing, and reporting the data. The information is being collected for the authorization and accountability of all individuals that will access HUD’s EIV system. Response to this request for information is required in order for HUD to comply with the Federal Privacy Act’s (5 USC 552a) requirement that HUD account for all individuals who will have access to a system containing personal identifying information of individuals assisted by the Federal government. HUD may not collect this information, and you are not required to complete this form unless it displays a currently valid OMB number. Limited confidentiality is assured.

Purpose of this form: To request initial access, modify or terminate existing access to the Multifamily EIV system. To review and acknowledge Rules of Behavior and signify compliance with the User Agreement.

Date of Request:

PART I. ACCESS AUTHORIZATION

* All required information must be provided in order to be granted EIV access authorization rights. Please type or print legibly.

*A. Authorized User Details
Name (last, first, and middle initial):			WASS User ID (M-ID):
Position Title:			Phone Number:
Email Address:			Fax Number:
Type of work which involves use of upfront income verification (UIV) data that is contained in the EIV system. Example, tenant recertifications, corrections to Identity Verification reports, etc.
* B. Site Location (Complete the one that applies to you)
Name of Owner Multifamily Housing Property:					Address:
Company Name of Management Agent:					Address:
Company Name of Contract Administrator (CA):		CAID:			Address:
Name of Service Bureau:					Address:
*C. Type of Action Requested (check the one that applies to you). Access is granted for no more than six months before recertification is required.
Initial Request for EIV Access					Reinstate EIV Access
*D. Multifamily User Role (check the one that applies to you)
Non-HUD User (HSU) Contract Administrator User (CAU)
*E. Portfolio Specify the project numbers and/or contract numbers to which access will be limited. Continue list on a separate sheet, if necessary . Do NOT submit a separate UAAF for each project assigned to you in WASS.
Project Number	Contract Number			Project Name
1)	1)			1)
2)	2)			2)
3)	3)			3)
4)	4)			4)
5)	5)			5)
6)	6)			6)

PART II. RULES OF BEHAVIOR

A. Introduction

The U.S. Department of Housing and Urban Development (HUD) is actively involved in implementing and maintaining Departmental policies and procedures to keep its Systems secure from unauthorized access and inappropriate use. In compliance with various security-related Federal laws and regulations, HUD created these of Rules of Behavior for the EIV system. This document was created to ensure that EIV system users comply with HUD security policies. In addition, this document ensures that system accounts remain secure and are used in the appropriate manner.

HUD may grant limited system access to Users who have a need to utilize the HUD information resources. These include: HUD employees, HUD contractors, public housing agencies (PHAs), private owner and management agent (O/A) staff, and contract administrators (CAs). EIV resources are for official use only. As a condition of receiving access, you are required to understand and abide by the HUD and EIV system security policies and procedures. The purpose of these policies and procedures is to safeguard HUD’s valuable information resources.

All EIV users must adhere to the Rules of Behavior outlined in this document. The rules clearly delineate responsibilities of, and expectations for, all individuals with access to the EIV system. Non-compliance with these rules will be disciplined through sanctions commensurate with the level of infraction. This may include removal of system access for a specific period of time or termination depending on the severity of the violation. See Section B for potential civil and criminal penalties.

B. Responsibilities

HUD, as the system owner, is responsible for ensuring that an adequate level of protection is afforded to the EIV system through an appropriate implementation of technical, operational, and managerial security controls.

EIV system Users are responsible for the protection of passwords, information, equipment, systems, networks, and communication pathways to which they have access. All HUD computer resources including hardware, software, programs, files, paper reports, and data are the sole property of HUD.

C. Other Policies and Procedures

The Rules of Behavior do not replace existing HUD policies, rather they are intended to enhance and further define the specific rules each user must follow while accessing the EIV system. The rules are consistent with the policy and procedures described in the following security documents:

HUD Security Program Policy. The policy, HUD Handbook 2400.25, Rev. 1 dated May 2005, prescribes responsibilities, practices, and conditions that directly or indirectly promote security in the development, operation, maintenance, and support of all HUD IT resources.

D. Application Rules

The Web Access Secure System (WASS) user identification (User ID) and password issued to you are to be used solely in connection with the performance of your responsibilities in support of HUD’s mission and may not be used for personal or private gain. You agree to be responsible for the confidentiality of the assigned information and accountable for all activity with your User ID. Furthermore, you agree that you will not provide this confidential User ID/password to another user during employment and upon leaving your place of employment. Additional rules of the EIV system are as follows:

System Access (on-site only) – Users are required to use only approved HUD software, software settings, and comply with vendor software license agreements. Users are allowed to access the system only using the mechanisms specified by HUD.

Unofficial use of government information – Users must be aware that personal use of information resources is prohibited. EIV data is personal information covered by the Privacy Act and penalties apply to the misuse of that data.

Information protection – Users must avoid leaving system output records or reports unattended or unsecured. Users should lock the computer or log-out of the system when leaving work areas unattended. Users shall not violate Public Law 93-579, Privacy Act of 1974, which requires confidentiality of personal data contained in government and contractor data files. Users should back up their data, test the data backups, and securely store the data in accordance with HUD policy.

Use of passwords – User passwords and User IDs are for your individual use only and are confidential HUD information. Users are required to change passwords every 30 days. Users are encouraged to avoid creating passwords that can be easily associated with.

System privileges – Users are given access to the system based on a need to perform specific work. Users shall only access the information for which they are authorized.

Individual accountability – Users shall be held accountable for their actions while accessing the system. Be aware that all computer resources are monitored and audited.

Incident Response – Users should contact their supervisor and the HUD HITS Helpdesk at (888) 297-8689 immediately regarding any suspected violation or breach of system security.

PART III. USER AGREEMENT AND CERTIFICATION

I have read the above policy regarding system security awareness and practices when accessing HUD’s information technology resources. I understand the policies and procedures as set forth above, and I agree to comply with these requirements as a condition of being granted limited access to the EIV system and its data.

As an authorized user of the EIV system, I understand the information obtained may only be used for official HUD business. I understand that authorized HUD employees and contractors may access, disclose, inspect and use these data only within the scope of their official duties. HUD employees are held to the highest level of responsibility/accountability for the protection of HUD data. HUD contractor firms will be expected to apply similar standards to their employees. Anyone who abuses access privileges may be stripped of that and other access rights. Employees may be subject to personnel discipline consistent with applicable personnel rules. Contractor firms that do not assure that the Rules of Behavior are observed may be subject to remedies under the terms of their contract. I also understand that willful disclosure or inspection or disclosure of EIV data can result in civil and criminal penalties. The penalties are as follows:

• Unauthorized disclosure can result in a felony conviction and a fine of up to $5,000 and/or imprisonment up to five (5) years, as well as civil penalties.

• Unauthorized inspection of UIV data can result in a misdemeanor penalty of up to $1,000 and/or one (1)-year imprisonment, as well as civil damages.

I understand that my user ID and password are to be used only by me. Under no circumstances will I reveal or allow use of my password by another person. Nor will I use another person’s password and user ID. I will protect EIV system data within my control, whether online, printed or stored in media, from unauthorized access.

I understand and agree to follow all HUD standards, policies and procedures.

____________________________ ____________________________ _____________

EIV System User’s Name EIV System User’s Name Date

(Signature) (Print)

TO BE COMPLETED BY THE EIV COORDINATOR

I, as an EIV Coordinator, authorize the above person to have access to the EIV system, as indicated by my signature below.

Site Location (check the one that applies)	Name (print)	Name (Signature)	Date
Owner of Multifamily Housing Property
Management Agent
Contract Administrator
Service Bureau

THIS USER ACCESS AUTHORIZATION FORM (ONCE SIGNED BELOW BY YOUR COORDINATOR) AS WELL AS A COPY OF THE CURRENT ONLINE UAAF MUST BE AVAILABLE UPON REQUEST AND ARE SUBJECT TO AUDIT AT ANYTIME.

Instructions for Completing the Enterprise Income Verification (EIV) System Multifamily Housing User Access Authorization Form (UAAF).

This form must be used by all individuals requesting User access in the Multifamily Housing portion of the EIV system. User applicants must complete this form and submit it to their EIV Coordinators for the following requests:

• Initial Request for EIV Access

• Reinstate EIV Access

All required information, as indicated by an asterisk (*), must be provided by the EIV User applicant on the UAAF in order for the EIV Coordinator to approve the applicant’s UAAF.

A. Authorized User Details

Name. Enter the full Name (last, first, and middle initial) of the EIV User applicant. This is the person who will be accessing the benefits, wage, and other information in the Multifamily Housing Programs portion of the EIV System.

WASS User ID (M-ID). This is the EIV User applicant’s Web Access Secure Systems (WASS) User ID. For external users, the User ID usually starts with an “M.” The User ID entered on the form MUST be the User ID HUD has assigned to the external Coordinator applicant for accessing HUD’s secure systems.

Position Title. This is the User applicant’s official title at his/her place of work. For example, Housing Intake Specialist.

Phone Number. This is the number at which the User may be contacted by HUD or persons acting on behalf of HUD such as contract administrators (CAs). The phone number entered on this form must be a working number. If there is a need to contact the User applicant and the phone number does not work, the UAAF will not be processed.

Email Address. This is the email address that HUD will use to notify the EIV Users for EIV-related informational purpose. The email address entered on this form must be clearly provided on the form and must be an active email address.

Fax Number. This is the fax number HUD will use to fax EIV-related communications to Users.

Type of work which involves use of upfront income verification (UIV) data that is contained in EIV. The type of work described in this section must be directly related to application intake and the performance of tenant income re-certifications.

B. Site Location

EIV User applicants must provide one of the following: the Name of Owner of the Multifamily Housing Property and Address; the Name of Management Agent and Address; the Name of Contract Administrator, Contract Administrator Identification (CAID), and Address; or, the Name of Service Bureau and Address. This is the User applicant’s place of employment – where the EIV User can be reached for mailing purposes.

C. Type of Action Requested

This is the type of action the EIV User applicant is asking of his or her EIV Coordinator.

The Initial Request for EIV Access box should be checked when the User applicant is requesting EIV access for the first time. The EIV User does not currently have access to EIV for any contract(s) and/or property(ies) in his or her portfolio in WASS. The Reinstate EIV Access box should be checked when a User’s EIV access has been expired for 1 year or longer from the date of expiration. The requesting User will need to complete all sections of the UAAF as if applying for Initial EIV access. EIV Users may only submit one UAAF, per Type of Action Request. Once initial access is granted for an EIV User and the HSU or CAU role has been assigned, additional properties may be added by submitting an online UAAF.

D. Multifamily User Role

This is the role the EIV User is requesting be assigned to the User’s User ID (M-ID). EIV Users may only submit one UAAF, per Multifamily User Role. For example, EIV Users may not submit an Initial Request for EIV Access and a Reinstate EIV Access for Contract/Property for both the HSU and CAU role on one UAAF. These must be completed and submitted to EIV Coordinators on separate UAAFs.

E. Portfolio

EIV Users applicants are to list those contracts and/or properties for which they are requesting either initial EIV access or the reinstatement of EIV access. The project/contract numbers and project names listed on the UAAF must currently be under both the EIV Coordinator’s and the User applicant’s portfolio in WASS.

User Agreement

By printing the EIV User’s name and signing the EIV User’s name on the EIV System User’s Name signature line, the EIV User certifies that he/she has read and understands the Rules of Behavior and agrees to the terms and conditions of the User Agreement. This includes, but is not limited to, protecting HUD data from wrongful disclosure, acquiring the appropriate owner and/or CA official approval to access EIV data, and preventing the use of user IDs and passwords. EIV Users are expected to respect a tenant’s privacy in accordance with the Privacy Act of 1974 (Public Law 93-579).

6 Form HUD-90011 (07/10)