Exhibit J, HHS Information Security and Privacy Requirements.pdf

HHS0016585 Exhibit J

Exhibit J

Texas Health and Human Services

Information Security and Privacy Requirements

Standards and Regulations:

Contractors are required to comply with HHS Information Security and

Privacy requirements in order to maintain a business relationship with Texas

HHS. Accordingly, contractors are required to adhere to all applicable standards and regulations (and their associated security controls) to include state laws, federal laws, executive orders, policies, regulations, standards, and guidance.

Standards and Regulations that Apply to this Contract:

Based on data types that are accessed, created, disclosed, received, transmitted, maintained, or stored within Information System(s) of this contract the following standards and regulations apply:

Texas HHS Requirements:

The contractor is responsible for implementing the HHS MODERATE (NIST

SP 800-53R5 MODERATE equivalent) security baseline and the HIPAA, CMS-MARS-E, FERPA overlays found in the IS-Controls and the following

Texas HHS standards and regulations:

• Information Security Controls (IS-Controls)

• Information Security Risk Assessment Monitoring Process (IS-RAMP)

• Security and Privacy Inquiry (SPI)

• Information Security Web & Mobile Standard (IS-Web & Mobile)

State and Federal Requirements:

The contractor is additionally responsible for implementing following state and federal standards and regulations:

• Texas Department of Information Resources (DIR) Security Control

Standards Catalog

• Center for Medicaid & Medicare Services Minimum Acceptable Risk

Security and Privacy Controls for Exchanges (CMS-MARS-E)

• Health Insurance Portability and Accountability Act of 1996 (HIPAA)

• NIST SP 800-66, An Introductory Resource Guide for Implementing the HIPAA Security Rule

• US Department of Health and Human Services HIPAA Security Rule

Crosswalk to NIST Cybersecurity Framework

• Family Educational Rights and Privacy Act (FERPA)

Contract Monitoring:

Contractors are required to fulfill HHS monitoring requirements for continuing compliance as outlined in the IS-RAMP.

Required Information Security & Privacy Controls that Apply to this

Contract:

Table 1 below is a list of required security controls mandated by the applicable state and federal regulations listed above. The contractor is required to implement the following list of Information Security and Privacy controls unless there exists a documented agreement that establishes Texas

Health and Human Services as the provider for a specified control(s).

Additionally, the contractor is required to implement any additional controls added or modified in subsequent updates to applicable standards and regulations.

If more than one applicable Standard and/or Regulation requires the same

Information Security and Privacy control, then the contractor must implement the most restrictive requirements for the specified control.

Table 1: Information Security & Privacy Controls Minimum Baseline that apply to this Contract

Control ID Control Name

AC-01 ACCESS CONTROL POLICY AND PROCEDURES

AC-02 ACCOUNT MANAGEMENT

AC-02(01) AUTOMATED SYSTEM ACCOUNT MANAGEMENT

AC-02(02) REMOVAL OF TEMPORARY / EMERGENCY ACCOUNTS

AC-02(03) DISABLE INACTIVE ACCOUNTS

AC-02(04) AUTOMATED AUDIT ACTIONS

AC-02(07) ROLE-BASED SCHEMES

AC-03 ACCESS ENFORCEMENT

AC-03(09) CONTROLLED RELEASE

AC-04 INFORMATION FLOW ENFORCEMENT

AC-05 SEPARATION OF DUTIES

AC-06 LEAST PRIVILEGE

AC-06(01) AUTHORIZE ACCESS TO SECURITY FUNCTIONS

AC-06(02) NON-PRIVILEGED ACCESS FOR NONSECURITY FUNCTIONS

AC-06(05) PRIVILEGED ACCOUNTS

AC-06(09) AUDITING USE OF PRIVILEGED FUNCTIONS

AC-06(10) PROHIBIT NON-PRIVILEGED USERS FROM EXECUTING PRIVILEGED

FUNCTIONS

AC-07 UNSUCCESSFUL LOGON ATTEMPTS

AC-08 SYSTEM USE NOTIFICATION

AC-10 CONCURRENT SESSION CONTROL

AC-11 SESSION LOCK

AC-11(01) PATTERN-HIDING DISPLAYS

AC-12 SESSION TERMINATION

AC-14 PERMITTED ACTIONS WITHOUT IDENTIFICATION OR AUTHENTICATION

AC-16 SECURITY ATTRIBUTES

AC-17 REMOTE ACCESS

AC-17(01) AUTOMATED MONITORING / CONTROL

AC-17(02) PROTECTION OF CONFIDENTIALITY / INTEGRITY USING ENCRYPTION

AC-17(03) MANAGED ACCESS CONTROL POINTS

AC-17(04) PRIVILEGED COMMANDS / ACCESS

AC-18 WIRELESS ACCESS

AC-18(01) AUTHENTICATION AND ENCRYPTION

AC-19 ACCESS CONTROL FOR MOBILE DEVICES

AC-19(05) FULL DEVICE / CONTAINER-BASED ENCRYPTION

AC-20 USE OF EXTERNAL INFORMATION SYSTEMS

AC-20(01) LIMITS ON AUTHORIZED USE

AC-20(02) PORTABLE STORAGE DEVICES

AC-21 INFORMATION SHARING

AC-22 PUBLICLY ACCESSIBLE CONTENT

AT-01 SECURITY AWARENESS AND TRAINING POLICY AND PROCEDURES

AT-02 SECURITY AWARENESS TRAINING

AT-02(02) INSIDER THREAT

AT-03 ROLE-BASED SECURITY TRAINING

AT-04 SECURITY TRAINING RECORDS

AU-01 AUDIT AND ACCOUNTABILITY POLICY AND PROCEDURES

AU-02 AUDIT EVENTS

AU-02(03) REVIEWS AND UPDATES

AU-03 CONTENT OF AUDIT RECORDS

AU-03(01) ADDITIONAL AUDIT INFORMATION

AU-04 AUDIT STORAGE CAPACITY

AU-05 RESPONSE TO AUDIT PROCESSING FAILURES

AU-05(01) AUDIT STORAGE CAPACITY

AU-06 AUDIT REVIEW, ANALYSIS, AND REPORTING

AU-06(01) PROCESS INTEGRATION

AU-06(03) CORRELATE AUDIT REPOSITORIES

AU-07 AUDIT REDUCTION AND REPORT GENERATION

AU-07(01) AUTOMATIC PROCESSING

AU-08 TIME STAMPS

AU-08(01) SYNCHRONIZATION WITH AUTHORITATIVE TIME SOURCE

AU-09 PROTECTION OF AUDIT INFORMATION

AU-09(04) ACCESS BY SUBSET OF PRIVILEGED USERS

AU-10 NON-REPUDIATION

AU-11 AUDIT RECORD RETENTION

AU-12 AUDIT GENERATION

AU-12(01) SYSTEM-WIDE / TIME-CORRELATED AUDIT TRAIL

AU-13 MONITORING FOR INFORMATION DISCLOSURE

AU-16 CROSS-ORGANIZATIONAL AUDITING

CA-01 SECURITY ASSESSMENT AND AUTHORIZATION POLICY AND

PROCEDURES

CA-02 SECURITY ASSESSMENTS

CA-02(01) INDEPENDENT ASSESSORS

CA-03 SYSTEM INTERCONNECTIONS

CA-03(05) RESTRICTIONS ON EXTERNAL SYSTEM CONNECTIONS

CA-05 PLAN OF ACTION AND MILESTONES

CA-05(01) AUTOMATION SUPPORT FOR ACCURACY / CURRENCY

CA-06 SECURITY AUTHORIZATION

CA-07 CONTINUOUS MONITORING

CA-07(01) INDEPENDENT ASSESSMENT

CA-08 PENETRATION TESTING

CA-09 INTERNAL SYSTEM CONNECTIONS

CM-01 CONFIGURATION MANAGEMENT POLICY AND PROCEDURES

CM-02 BASELINE CONFIGURATION

CM-02(01) REVIEWS AND UPDATES

CM-02(03) RETENTION OF PREVIOUS CONFIGURATIONS

CM-03 CONFIGURATION CHANGE CONTROL

CM-03(02) TEST / VALIDATE / DOCUMENT CHANGES

CM-04 SECURITY IMPACT ANALYSIS

CM-04(01) SEPARATE TEST ENVIRONMENTS

CM-04(02) VERIFICATION OF SECURITY FUNCTIONS

CM-05 ACCESS RESTRICTIONS FOR CHANGE

CM-05(01) AUTOMATED ACCESS ENFORCEMENT / AUDITING

CM-05(05) LIMIT PRODUCTION / OPERATIONAL PRIVILEGES

CM-06 CONFIGURATION SETTINGS

CM-06(01) AUTOMATED CENTRAL MANAGEMENT / APPLICATION / VERIFICATION

CM-07 LEAST FUNCTIONALITY

CM-07(01) PERIODIC REVIEW

CM-07(02) PREVENT PROGRAM EXECUTION

CM-07(04) UNAUTHORIZED SOFTWARE / BLACKLISTING

CM-08 INFORMATION SYSTEM COMPONENT INVENTORY

CM-08(01) UPDATES DURING INSTALLATIONS / REMOVALS

CM-08(03) AUTOMATED UNAUTHORIZED COMPONENT DETECTION

CM-08(05) NO DUPLICATE ACCOUNTING OF COMPONENTS

CM-09 CONFIGURATION MANAGEMENT PLAN

CM-10 SOFTWARE USAGE RESTRICTIONS

CM-10(01) OPEN SOURCE SOFTWARE

CM-11 USER-INSTALLED SOFTWARE

CP-01 CONTINGENCY PLANNING POLICY AND PROCEDURES

CP-02 CONTINGENCY PLAN

CP-02(01) COORDINATE WITH RELATED PLANS

CP-02(02) CAPACITY PLANNING

CP-02(03) RESUME ESSENTIAL MISSIONS / BUSINESS FUNCTIONS

CP-02(05) CONTINUE ESSENTIAL MISSIONS / BUSINESS FUNCTIONS

CP-02(08) IDENTIFY CRITICAL ASSETS

CP-03 CONTINGENCY TRAINING

CP-04 CONTINGENCY PLAN TESTING

CP-04(01) COORDINATE WITH RELATED PLANS

CP-06 ALTERNATE STORAGE SITE

CP-06(01) SEPARATION FROM PRIMARY SITE

CP-06(03) ACCESSIBILITY

CP-07 ALTERNATE PROCESSING SITE

CP-07(01) SEPARATION FROM PRIMARY SITE

CP-07(02) ACCESSIBILITY

CP-07(03) PRIORITY OF SERVICE

CP-08 TELECOMMUNICATIONS SERVICES

CP-08(01) PRIORITY OF SERVICE PROVISIONS

CP-08(02) SINGLE POINTS OF FAILURE

CP-09 INFORMATION SYSTEM BACKUP

CP-09(01) TESTING FOR RELIABILITY / INTEGRITY

CP-10 INFORMATION SYSTEM RECOVERY AND RECONSTITUTION

CP-10(02) TRANSACTION RECOVERY

CP-11 ALTERNATE COMMUNICATIONS PROTOCOLS

IA-01 IDENTIFICATION AND AUTHENTICATION POLICY AND PROCEDURES

IA-02 IDENTIFICATION AND AUTHENTICATION (ORGANIZATIONAL USERS)

IA-02(01) NETWORK ACCESS TO PRIVILEGED ACCOUNTS

IA-02(02) NETWORK ACCESS TO NON-PRIVILEGED ACCOUNTS

IA-02(03) LOCAL ACCESS TO PRIVILEGED ACCOUNTS

IA-02(08) NETWORK ACCESS TO PRIVILEGED ACCOUNTS - REPLAY RESISTANT

IA-02(11) REMOTE ACCESS - SEPARATE DEVICE

IA-03 DEVICE IDENTIFICATION AND AUTHENTICATION

IA-04 IDENTIFIER MANAGEMENT

IA-05 AUTHENTICATOR MANAGEMENT

IA-05(01) PASSWORD-BASED AUTHENTICATION

IA-05(02) PKI-BASED AUTHENTICATION

IA-05(03) IN-PERSON OR TRUSTED THIRD-PARTY REGISTRATION

IA-05(07) NO EMBEDDED UNENCRYPTED STATIC AUTHENTICATORS

IA-05(11) HARDWARE TOKEN-BASED AUTHENTICATION

IA-06 AUTHENTICATOR FEEDBACK

IA-07 CRYPTOGRAPHIC MODULE AUTHENTICATION

IA-08 IDENTIFICATION AND AUTHENTICATION (NON-ORGANIZATIONAL

USERS)

IR-01 INCIDENT RESPONSE POLICY AND PROCEDURES

IR-02 INCIDENT RESPONSE TRAINING

IR-03 INCIDENT RESPONSE TESTING

IR-03(02) COORDINATION WITH RELATED PLANS

IR-04 INCIDENT HANDLING

IR-04(01) AUTOMATED INCIDENT HANDLING PROCESSES

IR-05 INCIDENT MONITORING

IR-06 INCIDENT REPORTING

IR-06(01) AUTOMATED REPORTING

IR-07 INCIDENT RESPONSE ASSISTANCE

IR-07(01) AUTOMATION SUPPORT FOR AVAILABILITY OF INFORMATION /

SUPPORT

IR-08 INCIDENT RESPONSE PLAN

IR-09 INFORMATION SPILLAGE RESPONSE

MA-01 SYSTEM MAINTENANCE POLICY AND PROCEDURES

MA-02 CONTROLLED MAINTENANCE

MA-03 MAINTENANCE TOOLS

MA-03(01) INSPECT TOOLS

MA-03(02) INSPECT MEDIA

MA-03(03) PREVENT UNAUTHORIZED REMOVAL

MA-04 NONLOCAL MAINTENANCE

MA-04(01) AUDITING AND REVIEW

MA-04(02) DOCUMENT NONLOCAL MAINTENANCE

MA-04(03) COMPARABLE SECURITY / SANITIZATION

MA-05 MAINTENANCE PERSONNEL

MA-06 TIMELY MAINTENANCE

MP-01 MEDIA PROTECTION POLICY AND PROCEDURES

MP-02 MEDIA ACCESS

MP-03 MEDIA MARKING

MP-04 MEDIA STORAGE

MP-05 MEDIA TRANSPORT

MP-05(04) CRYPTOGRAPHIC PROTECTION

MP-06 MEDIA SANITIZATION

MP-06(01) REVIEW / APPROVE / TRACK / DOCUMENT / VERIFY

MP-06(02) EQUIPMENT TESTING

MP-07 MEDIA USE

MP-07(01) PROHIBIT USE WITHOUT OWNER

MP-CMS-01 MEDIA RELATED RECORDS

PE-01 PHYSICAL AND ENVIRONMENTAL PROTECTION POLICY AND

PROCEDURES

PE-02 PHYSICAL ACCESS AUTHORIZATIONS

PE-02(01) ACCESS BY POSITION / ROLE

PE-03 PHYSICAL ACCESS CONTROL

PE-04 ACCESS CONTROL FOR TRANSMISSION MEDIUM

PE-05 ACCESS CONTROL FOR OUTPUT DEVICES

PE-06 MONITORING PHYSICAL ACCESS

PE-06(01) INTRUSION ALARMS / SURVEILLANCE EQUIPMENT

PE-08 VISITOR ACCESS RECORDS

PE-09 POWER EQUIPMENT AND CABLING

PE-10 EMERGENCY SHUTOFF

PE-11 EMERGENCY POWER

PE-12 EMERGENCY LIGHTING

PE-13 FIRE PROTECTION

PE-13(01) DETECTION DEVICES / SYSTEMS

PE-13(02) SUPPRESSION DEVICES / SYSTEMS

PE-13(03) AUTOMATIC FIRE SUPPRESSION

PE-14 TEMPERATURE AND HUMIDITY CONTROLS

PE-15 WATER DAMAGE PROTECTION

PE-16 DELIVERY AND REMOVAL

PE-17 ALTERNATE WORK SITE

PE-18 LOCATION OF INFORMATION SYSTEM COMPONENTS

PE-19 INFORMATION LEAKAGE

PE-20 ASSET MONITORING AND TRACKING

PL-01 SECURITY PLANNING POLICY AND PROCEDURES

PL-02 SYSTEM SECURITY PLAN

PL-02(03) PLAN / COORDINATE WITH OTHER ORGANIZATIONAL ENTITIES

PL-04 RULES OF BEHAVIOR

PL-04(01) SOCIAL MEDIA AND NETWORKING RESTRICTIONS

PL-08 INFORMATION SECURITY ARCHITECTURE

PS-01 PERSONNEL SECURITY POLICY AND PROCEDURES

PS-02 POSITION RISK DESIGNATION

PS-03 PERSONNEL SCREENING

PS-04 PERSONNEL TERMINATION

PS-05 PERSONNEL TRANSFER

PS-06 ACCESS AGREEMENTS

PS-07 THIRD-PARTY PERSONNEL SECURITY

PS-08 PERSONNEL SANCTIONS

RA-01 RISK ASSESSMENT POLICY AND PROCEDURES

RA-02 SECURITY CATEGORIZATION

RA-03 RISK ASSESSMENT

RA-05 VULNERABILITY SCANNING

RA-05(01) UPDATE TOOL CAPABILITY

RA-05(02) UPDATE BY FREQUENCY / PRIOR TO NEW SCAN / WHEN IDENTIFIED

RA-05(03) BREADTH / DEPTH OF COVERAGE

RA-05(05) PRIVILEGED ACCESS

SA-01 SYSTEM AND SERVICES ACQUISITION POLICY AND PROCEDURES

SA-02 ALLOCATION OF RESOURCES

SA-03 SYSTEM DEVELOPMENT LIFE CYCLE

SA-04 ACQUISITION PROCESS

SA-04(01) FUNCTIONAL PROPERTIES OF SECURITY CONTROLS

SA-04(02) DESIGN / IMPLEMENTATION INFORMATION FOR SECURITY CONTROLS

SA-04(09) FUNCTIONS / PORTS / PROTOCOLS / SERVICES IN USE

SA-05 INFORMATION SYSTEM DOCUMENTATION

SA-08 SECURITY ENGINEERING PRINCIPLES

SA-09 EXTERNAL INFORMATION SYSTEM SERVICES

SA-09(01) RISK ASSESSMENTS / ORGANIZATIONAL APPROVALS

SA-09(02) IDENTIFICATION OF FUNCTIONS / PORTS / PROTOCOLS / SERVICES

SA-09(05) PROCESSING, STORAGE, AND SERVICE LOCATION

SA-10 DEVELOPER CONFIGURATION MANAGEMENT

SA-11 DEVELOPER SECURITY TESTING AND EVALUATION

SA-11(01) STATIC CODE ANALYSIS

SA-11(02) THREAT AND VULNERABILITY ANALYSES

SA-11(05) PENETRATION TESTING

SA-11(08) DYNAMIC CODE ANALYSIS

SA-12 SUPPLY CHAIN PROTECTION

SA-14 CRITICALITY ANALYSIS

SA-15 DEVELOPMENT PROCESS, STANDARDS, AND TOOLS

SA-17 DEVELOPER SECURITY ARCHITECTURE AND DESIGN

SA-22 UNSUPPORTED SYSTEM COMPONENTS

SC-01 SYSTEM AND COMMUNICATIONS PROTECTION POLICY AND

PROCEDURES

SC-02 APPLICATION PARTITIONING

SC-04 INFORMATION IN SHARED RESOURCES

SC-05 DENIAL OF SERVICE PROTECTION

SC-06 RESOURCE AVAILABILITY

SC-07 BOUNDARY PROTECTION

SC-07(03) ACCESS POINTS

SC-07(04) EXTERNAL TELECOMMUNICATIONS SERVICES

SC-07(05) DENY BY DEFAULT / ALLOW BY EXCEPTION

SC-07(07) PREVENT SPLIT TUNNELING FOR REMOTE DEVICES

SC-07(08) ROUTE TRAFFIC TO AUTHENTICATED PROXY SERVERS

SC-07(12) HOST-BASED PROTECTION

SC-07(13) ISOLATION OF SECURITY TOOLS / MECHANISMS / SUPPORT

COMPONENTS

SC-07(18) FAIL SECURE

SC-08 TRANSMISSION CONFIDENTIALITY AND INTEGRITY

SC-08(01) CRYPTOGRAPHIC OR ALTERNATE PHYSICAL PROTECTION

SC-08(02) PRE / POST TRANSMISSION HANDLING

SC-10 NETWORK DISCONNECT

SC-12 CRYPTOGRAPHIC KEY ESTABLISHMENT AND MANAGEMENT

SC-12(02) SYMMETRIC KEYS

SC-13 CRYPTOGRAPHIC PROTECTION

SC-15 COLLABORATIVE COMPUTING DEVICES

SC-17 PUBLIC KEY INFRASTRUCTURE CERTIFICATES

SC-18 MOBILE CODE

SC-19 VOICE OVER INTERNET PROTOCOL

SC-20 SECURE NAME / ADDRESS RESOLUTION SERVICE (AUTHORITATIVE

SOURCE)

SC-21 SECURE NAME / ADDRESS RESOLUTION SERVICE (RECURSIVE OR

CACHING RESOLVER)

SC-22 ARCHITECTURE AND PROVISIONING FOR NAME / ADDRESS

RESOLUTION SERVICE

SC-23 SESSION AUTHENTICITY

SC-28 PROTECTION OF INFORMATION AT REST

SC-28(01) CRYPTOGRAPHIC PROTECTION

SC-31 COVERT CHANNEL ANALYSIS

SC-32 INFORMATION SYSTEM PARTITIONING

SC-39 PROCESS ISOLATION

SC-44 DETONATION CHAMBERS

SC-ACA-01 ELECTRONIC MAIL

SC-ACA-02 FAX USAGE

SI-01 SYSTEM AND INFORMATION INTEGRITY POLICY AND PROCEDURES

SI-02 FLAW REMEDIATION

SI-02(01) CENTRAL MANAGEMENT

SI-02(02) AUTOMATED FLAW REMEDIATION STATUS

SI-03 MALICIOUS CODE PROTECTION

SI-03(01) CENTRAL MANAGEMENT

SI-03(02) AUTOMATIC UPDATES

SI-04 INFORMATION SYSTEM MONITORING

SI-04(01) SYSTEM-WIDE INTRUSION DETECTION SYSTEM

SI-04(02) AUTOMATED TOOLS FOR REAL-TIME ANALYSIS

SI-04(04) INBOUND AND OUTBOUND COMMUNICATIONS TRAFFIC

SI-04(05) SYSTEM-GENERATED ALERTS

SI-04(14) WIRELESS INTRUSION DETECTION

SI-05 SECURITY ALERTS, ADVISORIES, AND DIRECTIVES

SI-06 SECURITY FUNCTION VERIFICATION

SI-07 SOFTWARE, FIRMWARE, AND INFORMATION INTEGRITY

SI-07(01) INTEGRITY CHECKS

SI-07(07) INTEGRATION OF DETECTION AND RESPONSE

SI-08 SPAM PROTECTION

SI-08(01) CENTRAL MANAGEMENT

SI-08(02) AUTOMATIC UPDATES

SI-10 INFORMATION INPUT VALIDATION

SI-11 ERROR HANDLING

SI-12 INFORMATION HANDLING AND RETENTION

SI-16 MEMORY PROTECTION

PM-01 INFORMATION SECURITY PROGRAM PLAN

PM-02 SENIOR INFORMATION SECURITY OFFICER

PM-03 INFORMATION SECURITY RESOURCES

PM-04 PLAN OF ACTION AND MILESTONES PROCESS

PM-05 INFORMATION SYSTEM INVENTORY

PM-06 INFORMATION SECURITY MEASURES OF PERFORMANCE

PM-07 ENTERPRISE ARCHITECTURE

PM-08 CRITICAL INFRASTRUCTURE PLAN

PM-09 RISK MANAGEMENT STRATEGY

PM-10 SECURITY AUTHORIZATION PROCESS

PM-11 MISSION/BUSINESS PROCESS DEFINITION

PM-12 INSIDER THREAT PROGRAM

PM-13 INFORMATION SECURITY WORKFORCE

PM-14 TESTING, TRAINING, AND MONITORING

PM-15 CONTACTS WITH SECURITY GROUPS AND ASSOCIATIONS

PM-16 THREAT AWARENESS PROGRAM

AP-01 AUTHORITY TO COLLECT

AP-02 PURPOSE SPECIFICATION

AR-01 GOVERNANCE AND PRIVACY PROGRAM

AR-02 PRIVACY IMPACT AND RISK ASSESSMENT

AR-03 PRIVACY REQUIREMENTS FOR CONTRACTORS AND SERVICE

PROVIDERS

AR-04 PRIVACY MONITORING AND AUDITING

AR-05 PRIVACY AWARENESS AND TRAINING

AR-06 PRIVACY REPORTING

AR-07 PRIVACY-ENHANCED SYSTEM DESIGN AND DEVELOPMENT

AR-08 ACCOUNTING OF DISCLOSURES

DI-01 DATA QUALITY

DI-01(01) VALIDATE PII

DI-02 DATA INTEGRITY AND DATA INTEGRITY BOARD

DI-02(01) PUBLISH AGREEMENTS ON WEBSITES

DM-01 MINIMIZATION OF PERSONALLY IDENTIFIABLE INFORMATION

DM-01(01) MINIMIZATION OF PERSONALLY IDENTIFIABLE INFORMATION

DM-02 DATA RETENTION AND DISPOSAL

DM-02(01) SYSTEM CONFIGURATION

DM-03 MINIMIZATION OF PII USED IN TESTING, TRAINING, AND RESEARCH

DM-03(01) RISK MINIMIZATION TECHNIQUES

IP-01 CONSENT

IP-01(01) MECHANISMS SUPPORTING ITEMIZED OR TIERED CONSENT

IP-02 INDIVIDUAL ACCESS

IP-03 REDRESS

IP-04 COMPLAINT MANAGEMENT

IP-04(01) RESPONSE TIMES

SE-01 INVENTORY OF PERSONALLY IDENTIFIABLE INFORMATION

SE-02 PRIVACY INCIDENT RESPONSE

TR-01 PRIVACY NOTICE

TR-01(01) REAL-TIME OR LAYERED NOTICE

TR-02 SYSTEM OF RECORDS NOTICES AND PRIVACY ACT STATEMENTS

TR-02(01) PUBLIC WEBSITE PUBLICATION

TR-03 DISSEMINATION OF PRIVACY PROGRAM INFORMATION

UL-01 INTERNAL USE

UL-02 INFORMATION SHARING WITH THIRD PARTIES