Skip to main content

17. Security rules everyone must follow

These rules apply to every staff member, every administrator, and every support person. Breaking them can put public money at risk.

  1. Use your own account only. Never share your password, your authenticator, your passkey or your sign-in with anyone, including colleagues and DFFMS staff.
  2. Never send your password, verification code or recovery code to anyone. DFFMS support will never ask for these. The security page says so directly. If someone asks you, stop and report it.
  3. Keep recovery codes safe. Store them in an approved secure location, offline. Never store them in email, chat, a shared drive or a photo on your phone.
  4. Turn on two-step security. Set up an authenticator app from Account security as soon as you can. Use a passkey on your own device if offered.
  5. Use a fresh sign-in for money. If DFFMS asks you to sign in again before approving, decide, or pay, do it. Do not try to get around it.
  6. Keep the maker and checker apart. Do not approve your own work, and do not ask a colleague to approve your work on your behalf.
  7. Invite only people who need access. Give the smallest scope that does the job. Remove or suspend access as soon as a person leaves.
  8. Never forward invitation links. Each link works once and expires after 72 hours. Send it only to the person named.
  9. Sign out on shared devices. Use Sign out from the profile menu. Do not leave a session open on a public computer.
  10. Use work email only for staff accounts. Do not use personal email addresses.
  11. Keep exports private. Downloads are signed links that expire quickly. Do not send exports to personal email, and do not post them in public channels.
  12. Do not paste card or bank secrets into DFFMS. Payments run through the provider's own pages. DFFMS never receives full card numbers or security codes.
  13. Report anything strange at once. Examples: a password reset you did not ask for, an unknown session, a message asking for a code, or a record you cannot explain. Tell the Platform Super Administrator.
  14. Do not change records to hide a mistake. Records and the audit trail cannot be edited. Record a correction instead, and explain it.
  15. Keep data inside the portal. Do not copy personal data of beneficiaries into personal notes, chat tools or spreadsheets on your own device.