Data+Breach+Questionnaire_22nd+Century.docx
DOCX document 46 KB Posted
- Attached to
- Data Breach & Credit Monitoring (NASPO)
- Contract number
- 166
- Issued by
- North Dakota
About this file
This document is a Data Breach Services Questionnaire designed to collect critical information about a potential data breach incident. While no specific state, agency, or consortium is definitively named, the document indicates a comprehensive approach to data breach notification that considers multi-state legal requirements, with contact points including Reddy Bollineni and Tom Fragala from what appears to be a data breach response organization.
The questionnaire outlines key services and considerations for managing a data breach, including required services such as credit monitoring, ID protection, call center support, and notifications. The document emphasizes the complexity of data breach response, highlighting the need to determine statutory notification deadlines, prepare notification content, consider state-specific legal mandates, and potentially coordinate with law enforcement. Critical elements include identifying the number of affected individuals, determining notification methods (mailing addresses, email), preparing FAQs, and understanding whether the breach originated through a third-party vendor or business associate.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| Category+3+Data+Breach+Services.pdf | ||
| 166_State+Contract+Summary+New.pdf | ||
| Signed+-+Information+Security+Services.pdf | ||
| Signed+PA+22nd+Century+Credit+Monitoring.pdf | ||
| Attachment+9+-+Amd+1+-+Cost+Proposal.docx | DOCX document | |
| 1646806749_MGT_Cost+Proposal+(2).pdf | ||
| Scope+of+Work+-+MGT+of+America.docx | DOCX document |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
DATA BREACH SERVICES
Questions for affected organization
| 1 |
| Full name of organization and primary location. |
| 2 |
| Incident lead (primary contact) name, title, email, phone. |
| 3 |
| Data of breach (if known) and date of discovery (if known). |
| 4 |
| Statutory deadline date(s) for notifications to be sent. |
| 5 |
| Preferred date for notifications to be sent. |
| 6 |
| The state(s) that affected individuals are located in. |
| 7 |
| Number affected individuals requiring notification and monitoring. |
| 8 |
| Services desired: |
a. Credit monitoring/ID protection (required), 1B or 3B (preferred).
b. Call center for breach related questions.
c. Notifications (letters, email).
Do you have mailing addresses for all affected individuals?
| 10 |
| Do you have email addresses for all affected individuals? |
| 11 |
| Is legal counsel ready to prepare notification letter content? |
| 12 |
| Have you prepared a FAQ to answer questions from affected individuals? |
| 13 |
| Did the breach happen through a 3rd party organization (vendor/business associates etc)? |
It is your responsibility to (1) determine the deadlines for notification according to state and other laws, and (2) prepare the notification content. The following factors that may impact your process:
· Some state laws federal regulations (i.e. CCPA) and may reduce timeline to 30 or 45 days.
· Some states mandate specific content for you to include in your notification letter.
· Law enforcement may require you to delay notification if they believe it would interfere with an ongoing investigation.
· Multiple state laws may apply to a data breach depending on where the affected individuals reside, as opposed to the location of the business.
· If some affected individuals live in a state or country that mandates notification and others live in a state or country that doesn’t, you should notify everyone.
Point of Contact(s):
Reddy Bollineni 502-488-0162 | 703-721-8373 databreach@tscti.com Tom Fragala 805-570-5285 | 951-514-2683 databreach@tscti.com image1.png
File details come from the government source that posted it. Updated .