Approved Date – 02/22/2021
Published Date – 02/22/2021
Revised Date – 05/25/2021

1.  Purpose 

To specify the requirements for securely connecting to the District of Columbia Government (“District”) Network through a Virtual Private Network (“VPN”). 

2.  Authority 

DC Official Code § 1-1401 et seq., provides the Office of the Chief Technology Officer (“OCTO”) with the authority to provide information technology (IT) services, write and enforce IT policies, and secure the network and IT systems for the District government. This document can be found at: https://code.dccouncil.us/dc/council/code/sections/1-1402.html. 

3.  Applicability 

This policy applies to all the District workforce members performing official functions related to the management of the Virtual Private Network tools and processes on behalf of the District government, and/or any District agency/entity that receives enterprise services from OCTO. In addition, this policy applies to any providers and third-party entities with access to the District information, networks, and applications. 

4.  Policy

4.1.  The District network must only be accessed through the District VPN when a device is being used at an offsite location.  
4.2.  Only authorized devices must be able to connect to the District Network through the VPN. 
4.3.  Only devices with the most up-to-date anti-virus must be able to connect to the District network through the VPN. 
4.4.  VPN use must be controlled using multifactor authentication.  
4.5.  When connected to the District network from an offsite location, all traffic from and to the PC must be routed through the District VPN tunnel.  
4.6.  Remote access to the District network through the VPN must be logged and monitored to detect suspicious activities. 
4.7.  VPN sessions must be limited to a maximum of twelve (12) hours of absolute continuous connection time. 
4.8.  Only approved VPN clients must be used. (Please consult with OCTO to verify the current VPN client in use for the District). 

5.  Exemption 

Exceptions to this policy shall be requested in writing to the Agency’s CIO and the request will be escalated to the OCTO Chief Information Security Officer (“CISO”) for approval.

6.  Definitions

The definition of the terms used in this document can be found in the Policy Definitions website.