Click on the link below to view, save, or print out the document.

To preserve the formatting of this document, it has been converted to PDF (Portable Document Format) to retain its original layout.

Click on the link below to view, save, or print out the document.

References: a. ETA Handbook No. 376, Guidelines for Internal Security in UI Operations. b. Unemployment Insurance Program Letter (UIPL) No. 08-97, Risk Analysis Training. c. UIPL No. 12-95, Risk Analysis Project. d. UIPL No. 34-87, Unemployment Insurance (UI) Internal Security Risk Analysis (Vulnerability Assessment). Background: Since fiscal year 1982, the Department of Labor (DOL) has allocated resources for the Internal Security (IS) program. In concert with the IS program, the Employment and Training Administration (ETA) required through UIPLs that State Employment Security Agencies (SESAs) complete a risk analysis of the UI program covering the vulnerability of all UI program operations whenever major system changes occur but not less than once every three years. Risk Analysis is a specific activity to be performed by the Internal Security Unit(ISU). Along with its other IS activities, the ISU is required to perform a risk analysis to determine an economic balance between the impact of risks and the costs of protective measures. In performing a risk analysis, the ISU must identify assets, threats to the system (both program and computer related), vulnerabilities, and cost effective safeguards. Risk Analysis Training: Six UI Risk Analysis training classes have been held. These training classes were attended by National Office and Regional Office personnel, and SESA staff including, internal auditors, information security officers, investigators, and other internal security personnel responsible for risk analysis. User Group Forums: Four two-day risk analysis forums have been scheduled to follow-up and continue the discussions of the risk analysis process, methodology, and RiskWatch software training that began during the fundamental, intermediate and advanced Risk Analysis Training courses. Personnel from SESAs and DOL, who have knowledge of and/or experience conducting risk analyses will participate in round table discussions regarding SESA specific risk analysis issues and concerns. Forum participants will establish the agenda for each forum. Possible discussion topics include: Getting Started -- Development of a Risk Analysis Team -- Risk analysis process and methodology -- RiskWatch software problems and questions -- SESAs who have conducted a risk analysis Forum participants will establish the specific agenda for each forum. -- San Diego, CA - August 17-18, 1998 -- Denver, CO - August 20-21, 1998 -- Atlanta, GA - August 24-25, 1998 -- Boston, MA - August 27-28, 1998 Action Required: All SESA Administrators are requested to: -- a. Consider who will be attending the usergroup forums based on their understanding of the risk analysis process and methodology and participation in completing a risk analysis (full and or partial). -- b. Provide the names, addresses and telephone numbers and which forum the nominee (first and second choice) wishes to attend to: Elaine Shock, 800 Capitol Mall, MIC 78, PO BOX 826880, Sacramento, California 94280, by COB July 10, 1998. -- c. Provide copies of this UIPL to appropriate IS staff and other appropriate personnel.

Click on the link below to view, save, or print out the document.

To preserve the formatting of this document, it has been converted to PDF (Portable Document Format) to retain its original layout.

To preserve the formatting of this document, it has been converted to PDF (Portable Document Format) to retain its original layout.

To preserve the formatting of this document, it has been converted to PDF (Portable Document Format) to retain its original layout.

Click on the link below to view, save, or print out the document.

To preserve the formatting of this document, it has been converted to PDF (Portable Document Format) to retain its original layout.