NPCR att_06_DataSecu_2008.pdf

Attachment 6-1

November 2007

NPCR-CSS 2008 Data Submission

The NPCR-CSS project data reside on a dedicated server at Macro International. To ensure the security and confidentiality of project data, the following provisions have been incorporated into the Macro International NPCR-CSS Security Plan in accordance with the requirements of the

Assurance of Confidentiality.

The NPCR-CSS server is housed in a secure facility at Macro International’s Bethesda office with a guard on duty in the lobby 24 hours a day. Elevator and stairwell access is controlled by card key. The server resides on its own local area network (LAN) behind Macro International’s firewall.

Access to the NPCR-CSS server is limited to authorized Macro International project staff

(see below). It is password protected on its own security domain. No one, including nonproject staff at Macro International, is allowed access to the NPCR-CSS data.

All Macro International project staff must sign a confidentiality agreement before passwords and keys are assigned. All staff must pass background checks appropriate to their responsibilities for a public trust position.

NPCR-CSS data that are submitted electronically are encrypted during transmission from the

States. They arrive on a document server behind Macro International’s firewall. Each state has its own directory location so that no state has access to another state’s data. The data are moved automatically from the document server to the NPCR-CSS server.

Receipt and processing logs are maintained to document data receipt, file processing, and report production. All reports and electronic storage media containing NPCR-CSS data are stored under lock and key when not in use and will be destroyed when no longer needed.

A comprehensive security plan has been developed by Macro International’s security team.

The security team consists of Donald McMaster, Business Steward; Kevin Zhang, Project

Director; Leo Shen, Data Manager and Security Officer; David Radune, Database

Administrator; and Gretchen Stanton, LAN and WAN Security Steward. All project staff receive annual security awareness training covering security procedures. The Macro

International project security team oversees operations to prevent unauthorized disclosure of the NPCR-CSS data.

Periodic (currently quarterly, but no less than once a year) review and update of Macro

Attachment 6

Overview of Data Security

Attachment 6-2

November 2007

NPCR-CSS 2008 Data Submission

International security processes will be conducted to adjust for rapid changes in computer technology and to incorporate advances in security approaches. The security plan will be amended as needed to maintain the continued security and confidentiality of NPCR-CSS data.

Macro International

Authorized Project Staff

Staff Member Position

Donald McMaster, M.B.A., M.S. Business Steward

Kevin Zhang, Ph.D. Project Director

Leo Shen, M.B.A. Deputy Director/Security Officer

David Radune, B.S. Lead Developer/Database

Administrator

Gretchen Stanton, M.S. LAN and WAN Security Steward

Qiming He, Ph.D. QA Manager/Sr. Programmer Analyst

Yuan Ren, Ph.D. Data and Statistical Manager/Sr.

Statistical Programmer

Jonathan Stanger, M.P.A. SQL Programmer

Phllips Schaeffer, M.S. Sr. SAS Programmer

Jagruti Rana, M.S. Sr. Developer

Shaobin Xu, M.S. Programmer Analyst

Shirley Zhou, M.S. Statistical Programmer