Exhibit N, Breach Disclosure History.pdf

RFP No. HHS0017108 Exhibit N

Exhibit N, Breach and Incident Disclosure History

Breach and Incident Overview and General Context

Respondents are required to provide the following for any breach of information, data breach, or security incident reported to any state or federal regulatory authority within three (3) calendar years immediately preceding the submission of the Solicitation Response as described in Section

5.7 Breach and Security Incident Disclosure.

1. Provide a high-level description of the referenced breach or incident, including the general nature of the issue and contributing factors (e.g., unauthorized access attempt, system anomaly).

2. At a summary level, describe method of compromise and how the breach or incident was identified (e.g., internal monitoring processes, routine review activities, third-party notification).

3. Identify the general categories of data involved, if any, such as:

a. Criminal Justice Information Services (CJIS) data;

b. Centers for Medicare & Medicaid Services (CMS);

c. Financial or transactional data;

d. Internal Revenue Service Federal Tax Information (IRS FTI) data;

e. Personally Identifiable Information (PII);

f. Protected Health Information (PHI);

g. Social Security Administration (SSA) ; or

h. Other confidential or regulated information.

4. Indicate whether the data involved was subject to heightened protection requirements based on contractual, regulatory, or internal classification standards.

5. Provide an approximate scope of impact, (e.g., general scale of records or individuals).

6. Provide a general timeline, including:

a. Approximate discovery timeframe;

b. Remediation timeframe; and

c. Current status (resolved or subject to ongoing monitoring).

7. Identify, at a high level, the systems or environments involved.

8. Identify the standard data-protection measures in place at the time of the event (e.g., encryption).

Impact Considerations and Risk Context

1. Identify the general categories of stakeholders affected (e.g., customers, partners, internal users). Include number of impacted and scale of event.

2. Describe any compliance or reporting considerations that were evaluated as part of the response.

a. Individual breach notification requirements — whether notification was required and, if so, whether it occurred within applicable regulatory timeframes.

b. Regulatory or enforcement reporting requirements — which authorities were notified (if required) and whether reporting occurred within required time frames

RFP No. HHS0017108 Exhibit N

c. Regulatory investigation status — whether the incident was investigated by a regulator.

3. Summarize any operational impacts, such as temporary service disruptions, access restrictions, or enhanced monitoring activities, if applicable.

Response Approach and Ongoing Risk Management

1. Describe the general steps taken to address the issue and reduce the likelihood of recurrence.

2. Confirm whether post-event review or assessment activities were conducted (e.g., internal review, independent assessment, control evaluation).

3. Summarize any enhancements or refinements made to security practices, processes, or controls as a result of the event.

4. Confirm that appropriate internal stakeholders were engaged as part of the response and communication process.

5. Confirm whether there are any known external matters directly related to the event that may be relevant to the respondent’s ongoing operations or risk-management posture.