CTR066191__Exhibit_G.pdf

EXHIBIT G: CTR066191 - Amendment 4 - Data Breach Report Form

This document is a Data Breach Report Form issued by the Arizona Department of Economic Security (ADES) for use by contractors under contract CTR066191. The form serves as the required reporting mechanism for contractors to notify ADES of any data breaches involving survivor or client information. Contractors must submit the completed form along with their current Data Breach Policy within 24 hours of discovering a breach incident to their assigned Contract Specialist and Program Specialist. ADES commits to contacting the contractor within one business day of receiving the report to confirm receipt and determine next steps.

The form requires contractors to document four key elements: the agency name, date of the data breach, date ADES was notified, a detailed description of the incident without disclosing any personally identifiable information (PII), the organization's response including notification procedures for affected survivors or clients, and preventive measures the organization will implement to avoid future breaches. Contractors are explicitly prohibited from including survivor or client PII such as names, addresses, email addresses, phone numbers, or any identifying information in their reports. ADES reserves the section titled "ADES Response to organization and date" for departmental use only.