2. Attachment 3.19 Safeguarding PII.pdf

M-1150 rev. 10/15

• When sending PII via interoffice mail, it must be sent as accountable mail (USCIS Official envelopes) furnished by your USCIS mailroom or by USCIS courier and receipt must be verified with the recipient.

• When sending PII via Postal Service to recipient in U.S. and its territories—seal PII materials in an opaque envelope or container using U.S. Postal Service First Class Mail, Priority Mail, or an accountable commercial delivery service (e.g., UPS).

• When using a window envelope, make sure the content is folded in a way that PII/SPII cannot be seen through the window.

• When sending PII to overseas offices, serviced by a military postal facility, send PII materials directly to the office via U.S. Postal Service First Class Mail or an accountable commercial delivery service (e.g., UPS). Where the overseas office is not serviced by a military postal facility, send PII materials through the Department of State diplomatic courier.

• When mailing USCIS official documents, no

PII should be placed on the outside of the package.

Except for the standard address. For example, do not include: Alien Registration Numbers, Receipt Numbers, Social Security Numbers, etc.

• When mailing PII make sure the label is address correctly, you should always double check the mailing address prior to mailing.

DISPOSING Of PII

• Destruction of PII, including archived emails containing PII, should be destroyed when retention of the data is no longer required.

Note: This does not include source documents, such as A-files.

• PII can be destroyed using an approved shredder, “burn bags,” or equivalent destruction means.

• PII on diskettes or mobile devices must be permanently erased or destroyed according to ISSM’s standards.

• Always secure PII that has been discarded in burn bags that are awaiting removal, shredding, or destruction.

• Never dispose of PII in unsecured recycling bins or trash cans.

PRIVACY INCIDENTS

• A privacy incident is the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, unauthorized access, or any similar term referring to situations where persons, other than authorized users and for an unauthorized purpose, have access or potential access to PII in usable form, whether physical or electronic.

• Report a Privacy Incident that is Suspected or

Confirmed to:

- Supervisor

- Local Information Security Officer

- USCIS Service Desk

• All privacy incidents must be reported to the

USCIS Service Desk at 1-888-220-5228 within one hour of suspecting or confirming an incident, which then will be reported to the USCIS Command Center. A Significant Incident Report (SIR) will be required within one hour of reporting an incident.

• Examples of Privacy Incidents:

- An unencrypted email sent with the full Social Security Number

- Storing PII on a shared drives, without it being encrypted or password protected

- Storing PII on an unapproved ECN site

- Loss of USCIS Credentials

- Printing PII on the outside of a package (i.e.

A-number; SSN; etc.)

- Sharing PII with individual who does not have a need-to-know

Privacy! It’s our job!

Safeguard Personally Identifiable Information (PII)

USCIS Office of Privacy 20 Massachusetts Ave., NW, 5th Floor

Washington, DC 20529 202-272-8030 Office 202-272-8115 Fax http://connect.uscis.dhs.gov/org/PVY/Pages/default.aspx

Safeguarding Personally Identifiable Information (PII)

Every employee and contractor is obligated to safeguard personally identifiable information (PII) maintained by USCIS, by using appropriate safeguards.

Personally Identifiable Information (PII) is any information that permits the identity of an individual to be directly or indirectly inferred, including any other information that is linked or linkable to that individual.

Sensitive Personally Identifiable Information (SPII) is PII, which if lost, compromised, or disclosed without authorization, could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual.

Examples of PII:

- Name - Mailing Address

- Social Security Number - Telephone Number

- A-Number - Email Address

- Date and Place of Birth - Zip Code

- Mother’s Maiden Name - License Number

- Biometric Identifiers - License Plate

Following is general safeguards for protecting PII, regardless of its format (physical or electronic).

Employees and contractors with access to PII in the performance of their duties are required to comply with these safeguards.

WHAT YOU SHOULD KNOW

• Do not inspect, search, or browse official records in files or databases unless you are authorized to do so in the performance of your official duties and have a need-to-know.

• Do not disclose PII to others, including other authorized users, in any manner (electronically, verbally, etc.) unless there is a need-to-know in the performance of your official duties.

• Take special precautions to protect your computer passwords and other credentials that give access to PII.

- Use a complex password.

- Do not reveal your passwords to others.

- Do not use your password when/where someone might see and remember it.

• Do not store PII in shared electronic folders or shared network files without password protection or limited permission settings.

• Do not store PII on an unapproved ECN

(Enterprise Collaboration Network) Site. All approved ECN sites, must have:

- An approved PTA (Privacy Threshold

Analysis)

- Privacy Training

- Permission settings – only individuals with a need-to-know can access the site.

• Regularly check documents/files stored on shared electronic folders, network files or ECN sites to ensure the documents/files are still needed. Do not maintain documents containing PII longer than required.

• Storing PII on any electronic devices that are not owned by the government is prohibited.

• Storing PII on mobile government-furnished equipment is permitted if the data is encrypted in an approved way.

• Do not remove PII from your USCIS workplace unless it is for an approved purpose such as performing your duties under an official Telework agreement, to support the needs of temporary official travel, or other official worksites. Any PII removed should be the minimum amount reasonably necessary to accomplish your work and should be returned promptly. Consult a supervisor before removing any significant number of PII records.

• All email transmissions (internal or external) containing a full Social Security Number must be encrypted using Public Key Infrastructure (PKI) or WinZip.

Note: This include email transmissions to group or shared mailboxes.

• No PII should be included in the “Subject Line” of an email sent externally.

Note: Never put a full SSN in the “Subject Line” of an email.

• All external emails must be encrypted. If PKI is not available, use WinZip or Adobe 9 password protection, and send the password under a separate cover.

• Protect access to all media on which you process PII about others.

- Lock your workstation before leaving your desk.

- Limit physical access to workstations and documents.

- In your office, or while using a portable device in a public place such as an airport, secure or shield your computer screen from view, reposition the computer display, or attach a privacy screen, when appropriate.

• At the office, store hard copy PII in a locked storage compartment, such as, a desk; file cabinet;

credenza; lock office, etc.

• Safeguard hard copy PII if taken to your home, hotels, or other such locations outside your office. For example, store PII in a locked briefcase or desk in a home office. PII should be secured in hotel rooms

(e.g., locked in the room safe) and should not be left unattended in public spaces.

• Protect against eavesdropping on telephones or conversations that involve employees’ or the publics’ PII and only discuss PII with individuals who have a need to know.

• When faxing PII the sender and recipient must ensure that the transmission is not left unattended or subject to unauthorized disclosure.

Should include a fax coversheet and notify the recipient to confirm receipt.

http://images.search.yahoo.com/images/view;_ylt=A0PDoTHYlulRY3wAHcmJzbkF;_ylu=X3oDMTFybWxvMzEyBHNlYwNzcgRzbGsDaW1nBG9pZAMxY2ZiNTJkYmMzN2RkMDUwZjgwNjUzN2U1NjdlMGJkYQRncG9zAzYz?back=http%3A%2F%2Fimages.search.yahoo.com%2Fsearch%2Fimages%3Fp%3Dlocked%2Bstorage%26_adv_prop%3Dimage%26va%3Dlocked%2Bstorage%26fr%3Dyfp-t-794%26tab%3Dorganic%26ri%3D63&w=800&h=600&imgurl=img.weiku.com%2Fa%2F003%2F686%2FSmall_waterproof_plastic_portable_safe_storage_boxes_with_lock_5487_2.jpg&rurl=http%3A%2F%2Fwww.weiku.com%2Fproducts%2F15206548%2FSmall_waterproof_plastic_portable_safe_storage_boxes_with_lock.html&size=33.7KB&name=Small+waterproof+plastic+portable+safe+%3Cb%3Estorage+%3C%2Fb%3Eboxes+with+lock+China+...&p=locked+storage&oid=1cfb52dbc37dd050f806537e567e0bda&fr2=&fr=yfp-t-794&tt=Small+waterproof+plastic+portable+safe+%3Cb%3Estorage+%3C%2Fb%3Eboxes+with+lock+China+...&b=61&ni=30&no=63&ts=&tab=organic&sigr=13a4ug5cm&sigb=13u5hvmc1&sigi=131mormi0&.crumb=Dvf//2juBiO&fr=yfp-t-794� http://images.search.yahoo.com/images/view;_ylt=A0PDoKiemelRo34APrqJzbkF;_ylu=X3oDMTFzY3RzbXRmBHNlYwNzcgRzbGsDaW1nBG9pZAMyYzIyODhiMzk4YmU4MDA4ZDI4MTlkMWY2MzBiYTI5YgRncG9zAzEyNQ--?back=http%3A%2F%2Fimages.search.yahoo.com%2Fsearch%2Fimages%3Fp%3Dpeople%26_adv_prop%3Dimage%26va%3Dpeople%26fr%3Dyfp-t-794%26tab%3Dorganic%26ri%3D125&w=1610&h=1180&imgurl=posgraduacao.blogs.unipar.br%2Ffiles%2F2012%2F02%2FBiz-People-with-coffe-and-laptop.jpg&rurl=http%3A%2F%2Fposgraduacao.blogs.unipar.br%2F2012%2F02%2F15%2Fmba-executivo-em-gestao-empresarial-e-tema-de-pos-graduacao-em-umuarama%2Fbusiness-people%2F&size=408.5KB&name=...+Empresarial+%C3%A9+tema+de+p%C3%B3s-gradua%C3%A7%C3%A3o+em+Umuarama+%C2%BB+Business+%3Cb%3Epeople%3C%2Fb%3E&p=people&oid=2c2288b398be8008d2819d1f630ba29b&fr2=&fr=yfp-t-794&tt=...+Empresarial+%C3%A9+tema+de+p%C3%B3s-gradua%C3%A7%C3%A3o+em+Umuarama+%C2%BB+Business+%3Cb%3Epeople%3C%2Fb%3E&b=121&ni=140&no=125&ts=&tab=organic&sigr=1478dop3n&sigb=13fnov5jv&sigi=12fqdv5s7&.crumb=Dvf//2juBiO&fr=yfp-t-794�