Exhibit B - Data Security Policy 2026~1.pdf

PHILIP D. MURPHY

Governor

TAHESHA L. WAY

Lt. Governor

DEPARTMENT OF HUMAN SERVICES

DIVISION OF FAMILY DEVELOPMENT

PO BOX 716

TRENTON, NJ 08625-0716

SARAH ADELMAN

Commissioner

NATASHA JOHNSON

Assistant Commissioner

January 6, 2026

Action Transmittal Number: 26-01

IV-D Policy and Procedures

TO: County Social Service Agency Directors County Social Service Agency Child Support Supervisors County Social Service Agency Attorneys Chief Probation Officers Probation Division IV-D Supervisors Family Practice Division Managers Finance Division Managers County Sheriffs’ Departments All Child Support Data Users

SUBJECT: Child Support Data Security Policy 2026

The Office of Child Support Services’ (OCSS) Data Security Policy shall be issued on an annual basis to provide staff with the most current procedures and materials to ensure compliance with federal and state safeguarding requirements.

A. Data User and Confidentiality Agreement The Data User and Confidentiality Agreement (“Agreement”) is renewed on an annual basis and subject to review by OCSS, the Federal Office of Child Support Enforcement (OCSE) auditors and the IRS. Please read the Agreement closely before signing to ensure that you understand all the terms and conditions. By signing the Agreement, you are certifying that you understand what you must do and must not do with respect to all child support information.

• Any individual (excluding Judiciary staff and Office of Information Technology (OIT) staff) who works with child support information and/or personally identifying information (PII) via NJKiDS, Title IV-D Locate software, web portal or other comparable method must electronically sign the State of New Jersey IV-D Agency Child Support Data User and Confidentiality Agreement on the NJCSI Learning Management System (LMS) before April 10, 2026.

• Staff from OIT located at the HUB must electronically sign the Acknowledgment of Rules of Behavior Regarding Child Support Program Data for Office of Information Technology on the LMS before April 10, 2026.

26DPP01287 T2314 NJKiDS Application Maintenance and Support for NJ ACSES

• Any Judiciary employee who works with child support information and/or PII via NJKiDS, Title IV-D Locate software, web portal or other comparable method must sign the New Jersey Judiciary Title IV-D Child Support Data User and Confidentiality Agreement on the LMS before April 10, 2026.

o Please note that Judiciary staff do not have to sign the Agreement on the JLMS and may meet this requirement by signing on the LMS only.

B. Data Security Training Course Annual completion of Data Security training is a requirement for all staff. All child support staff with direct access to NJKiDS must attend the virtual classroom training (3 hours) once every three years unless exempted as directed below. Staff required to complete classroom training in 2026 must attend the virtual course (not the WBT) by October 2, 2026.

After successful completion of the virtual classroom training, staff may fulfill this requirement the following two years by viewing the web-based training (WBT) in lieu of the classroom course. The subsequent year will once again require the virtual classroom training, followed by two years of the WBT to be continued on an ongoing basis.

Staff may register for the virtual course, in accordance with their office’s training request process, by logging into the staff portal at www.njchildsupport.org, clicking the “NJCSI/LMS” icon, going to the “Training Calendar” under the Training tab, selecting the Data Security in Child Support course and requesting enrollment accordingly.

The following users are exempt from classroom attendance and may fulfill the training requirement solely by viewing the Data Security WBT on an annual basis:

• Contracted vendor staff (with direct NJKiDS access)

• State Disbursement Unit (SDU) (including Call Center) staff (with direct NJKiDS access)

• Judiciary Law Clerks (with direct NJKiDS access)

• Judge’s Secretary (with direct NJKiDS access)

• Agency Web Portal users (without direct NJKiDS access)

• Probation Case Management (PCM) Users (without direct NJKiDS access)

• Contracted Social Service Agency Attorneys (without direct NJKiDS access)

• Information Technology and Data Center staff (without direct NJKiDS access)

• Sheriff’s Office staff (with direct NJKiDS access)

C. Data Security Web Based Training Child support users who have completed the classroom course within the previous two calendar years or are exempt from attending the course must satisfy the annual data security training by viewing the appropriate WBT on the LMS before April 10, 2026. Viewing the WBT does not satisfy the annual data security requirement for child support users who have not completed the classroom training at NJCSI within the last two years.

Agency web portal users and Information Technology staff must also view the appropriate WBT on the LMS before April 10, 2026, as referenced below.

D. IRS Safeguards Security Awareness Training for Child Support Video (30 minutes) All child support staff with direct access to NJKiDS, including contracted vendor staff, contracted County Social Service Agency (CSSA) attorneys, Sheriff’s Office or Department staff, SDU (including call center) staff, Judiciary Law Clerks, and Information Technology and Data Center staff http://www.njchildsupport.org/

(HUB) is required to view the IRS Safeguards Security Awareness Training for Child Support video on the LMS before April 10, 2026. Agency web portal users are not required to view the IRS video.

Please note, if you exit the video prior to receiving a confirmation that you have completed the video, you will not receive credit on your training transcript.

The Agreement/Acknowledgment, Data Security WBT, and IRS Safeguards Security Awareness Training video are available for viewing on the LMS through the staff portal at www.staff.njchildsupport.org. After logging in and navigating to the LMS, click on “Training” then “Training Media.” Under Data Security, staff will see applicable training requirements as referenced below based on the user’s access type. If the appropriate training below is not displayed, please email DFD.CSstaffsiteadmin@dhs.nj.gov to have your profile updated.

• Staff (non-Judiciary) with access to NJKiDS who must attend the Data Security Training course (have not attended within the previous two years) shall select “Safeguards Security Awareness Training for Child Support Staff + Confidentiality Agreement.”

• Staff (non-Judiciary) with access to NJKiDS who must view the full Data Security WBT (30 minutes) (have attended the course within the previous two years or are exempt from classroom course) shall select “Data Security WBT for Child Support Staff” and “Safeguards Security Awareness Training for Child Support Staff + Confidentiality Agreement.”

• Staff (non-Judiciary) with access to Title IV-D Locate software and/or an Agency Web Portal must view the abbreviated Data Security WBT (15 minutes) and shall select “Data Security WBT + Confidentiality Agreement for Portal Users.”

• Staff at the HUB from the Office of Information Technology shall select “Safeguards Security

Awareness Training for Child Support Staff + Acknowledgment for IT Staff” and “Data Security WBT for IT Staff.” (15 minutes)

• Judiciary staff with access to NJKiDS who must attend the Data Security Training Course (have not attended within the previous two years) shall select “Safeguards Security Awareness Training for Child Support Staff + Judiciary Confidentiality Agreement.”

• Judiciary staff with access to NJKiDS who must view the full Data Security WBT (30 minutes) (have attended the course within the previous two years) shall select “Data Security WBT for Child Support Staff” and “Safeguards Security Awareness Training for Child Support Staff + Judiciary Confidentiality Agreement.”

• Judiciary staff with access to child support data through PCM or an Agency Web Portal who must view the abbreviated Data Security WBT (15 minutes) shall select “Data Security WBT for Judiciary Portal Users + Judiciary Confidentiality Agreement.”

Please note that the Data Security Manual Appendix contains an IRS Data Security Training Reference Guide that provides a quick view of all training requirements.

Staff who do not meet the deadlines outlined above may have their NJKiDS access terminated, with all tasks and any alpha split reassigned to their immediate supervisor. To reinstate access, a supervisor or manager will be required to submit a NJKiDS helpdesk ticket including a NJKiDS Access Request Form and the staff member’s transcript verifying that the requirement has been met.

26DPP01287 T2314 NJKiDS Application Maintenance and Support for NJ ACSES http://www.staff.njchildsupport.org/ mailto:DFD.CSstaffsiteadmin@dhs.nj.gov

E. LMS Coordinators LMS coordinators shall ensure that all IV-D staff have completed the required trainings.

Responsibilities include:

• Running reports and monitoring current IV-D staff training requirement status for completion.

• Enrolling staff who are missing any of the required trainings.

• Emailing CS.DataSecurityTraining@dhs.nj.gov with any staffing changes such as terminations, transfers, or staff out on leave.

F. Data Security Manual The Child Support Data Security Manual: Confidential, Classified, Federal Tax Information and Family Violence Safeguards, Protocols and Exceptions (formerly the Privacy, Confidentiality, and Disclosure Procedures) is attached for reference. The Data Security Manual was created to familiarize all workers accessing child support program information with the required procedures based on current rules and regulations. All workers accessing child support information are bound by the Manual and must review its contents, including the Clean Desk Protocol, on an ongoing basis.

G. Criminal History Background Screening Per IRS Publication 1075, agencies receiving Federal Tax Information (FTI) must restrict access to that information to persons who undergo a background investigation (once every five years) that meets the State’s “suitability policy” and whose duties require access. New Jersey Public Law 2017, Chapter 179 requires certain State and local government agency employees with access to FTI to undergo criminal history background checks.

The NJ Department of Human Services and NJ Judiciary subsequently issued their respective policies regarding implementation of exchanging fingerprint data with the FBI and State Police for background check purposes. The Judiciary’s Policy was issued via Memorandum and applies to all Judiciary employees with access to FTI. DHS’ Policy was issued in Administrative Order 4:33 and is applicable to all DHS and social service agency employees. Division of Family Development (DFD) and CSSA staff must refer to DFD’s Data Security Policy issued on an annual basis for the applicable fingerprinting policies, procedures and protocols to ensure that they are in compliance with the background screening requirement.

Employers of state and county child support staff must complete USCIS Form I-9 to document verification of their employees’ identity and employment authorization to work in the United States.

Within three (3) days of completion, child support staff must also be processed through E-Verify to assist with verification of their status and the documents provided with Form I-9.

H. OCSS Incident Reporting Protocol The revised reporting form attached to this Policy is to be used by staff. All users and entities subject to the Agreement must adhere to the Incident Reporting Protocol below.

A data breach means any improper or unauthorized inspection, exposure, access, use, misuse, duplication, reproduction, modification, equipment loss/damage, disclosure or release of FTI, classified or confidential information by any person. A violator’s access (or termination thereof) to NJKiDS, Title IV-D Locate software, etc. is at the sole discretion of OCSS and shall depend on the totality of the circumstances surrounding the breach.

If a data breach is suspected, the following steps must be taken:

1. Complete and submit the OCSS Security Incident Report form via email immediately upon mailto:CS.DataSecurityTraining@dhs.nj.gov identification of a suspected or observed breach. Include as much information as possible.

2. Email the Security Incident Report form to DFD.CSIncidentReport@dhs.nj.gov. Judiciary employees must simultaneously email the Security Incident Report form to DFD per above and the AOC to DFDCSIncidentRep.Mailbox@njcourts.gov.

i. The e-mail message should contain the following subject heading:

Urgent: Security Incident Report

ii. The e-mail message should be marked as “High Importance”

3. OCSS shall review the report and determine which state and federal agencies, if any, should be contacted.

i. With regards to classified program information, the Federal Parent Locator Service

(FPLS) Information Systems Security Office must be contacted no later than one hour after discovery of the incident.

ii. With regards to FTI, the IRS Office of Safeguards and the Office of Child Support Services (OCSS) must be contacted within 24 hours of receiving the incident report.

4. Cooperate with any subsequent OCSS/Other Agency investigation such as providing data and access as needed to determine the facts and circumstances of the incident.

i. OCSS will investigate by looking at the category of data involved and the extent that data was compromised to determine if a breach occurred.

ii. Pending the OCSS (and/or Other Agency) investigation, the alleged violator’s access to all child support systems, including NJKiDS, may be suspended.

5. The Assistant Director or designee will communicate with management at the alleged violator’s office to discuss next steps such as the need for an on-site visit and/or coordinating an investigation with other agencies.

i. OCSS’ findings of the review and/or investigation will be provided in writing.

ii. If any customer’s personal information is determined to have been accessed by an unauthorized person, then the agency of the party responsible for the breach shall notify the customer(s) whose information was breached. If it is determined that there has been a breach involving a customer’s FTI data, the customer must be notified in writing with the date of the unauthorized disclosure and informed that they may bring a civil action for damages within 2 years after the date of the breach.

OCSS will determine when this notification must take place and work with the appropriate entities to advise how it should be done.

iii. Employers may set internal policies regarding the type of disciplinary action to be taken depending on the nature of the incident and the type of information involved.

Any disciplinary or remedial action will be carried out based on those findings.

This information must be shared with appropriate staff. Questions concerning this Transmittal should be directed to DFD.Transmittals@dhs.nj.gov.

Sincerely, Digitally signed by Natasha

Natasha Johnson Johnson Date: 2026.01.06 08:31:09 -05'00'

Natasha Johnson Assistant Commissioner

NJ:KVB:LA

cc: Steven Bonville, Chief of Staff, Administrative Office of the Courts Jason Corter, Director, Trial Court Services Todd McManus, Director, Management and Administrative Services Larry Ashbridge, Director, Office of Probation Services

26DPP01287 T2314 NJKiDS Application Maintenance and Support for NJ ACSES mailto:DFD.CSIncidentReport@dhs.nj.gov mailto:DFDCSIncidentRep.Mailbox@njcourts.gov mailto:DFD.Transmittals@dhs.nj.gov

Lakshminarayanan Kattalai, Chief Information Officer Joanne M. Dietrich, Assistant Director, Family Practice Division Valerie Frage, Assistant Director, Finance Services Harriett D. Dickerson, Assistant Director, Office of Probation Services Jeannette Murray, CSE Program Manager, Office of Probation Services Nancy L. Manuele, Chief, Family Practice Division Kim Dixon, Assistant Chief, Finance Services