Form 4621 - Informational Only.pdf

What is an Incident?

An incident is any event threatening some aspects of physical or financial security, when financial resources or items valued at $100 or more are missing or misused, any event violating confidentiality or privacy of information, where data is manipulated or missing, or any event involving unauthorized or unlawful activity.

Examples of Incidents:

Examples of Material Incidents:

• Missing laptop computer, other mobile device, or paper records that do not contain Treasury personal information but do contain confidential or sensitive information

• Missing check stock.

What makes an incident a Security Breach?

An incident becomes a security breach when an unauthorized person gains access to or acquires:

1. Unencrypted or unredacted (data not altered or truncated) personal information, or

2. The encryption key to an area storing personal information.

Beware: If personal information is discovered during the investigative process, an incident will become a potential security breach.

Examples of a Potential/Actual Security Breach:

• Missing laptop computer, other mobile device, or portable media that contains Treasury personal information

for it

• Using another individual’s User ID and Password to access personal information

proper authorization to access the information

• Unauthorized and unescorted persons entering secure areas that house personal information

• Theft of a server.

What is Personal Information?

The Identify Theft Protection Act, Public Act 452 of 2004, as amended, defines personal information as information containing the first name or initial of the first name and the last name along with one of the following:

1. Social Security number

2. Driver’s License number or State Personal Identification card number

3. Account number; Credit or Debit Card number in combination with any required security code, access code or password that would permit access to a person’s financial account.

Personal information may be in written or printed form or may reside electronically on devices or media such as mainframes, servers, personal computers (desktops and laptops), CDs, DVDs, Michigan Department of Treasury 4621 (Rev. 03-19) tapes, flash drives, memory sticks, USB keys, microfiche, PDAs, cell phones, or may exist on other state-of-the-art devices that have been or may be developed.

What should I do if my laptop is missing or if an incident is suspected?

Employee must:

1. File a report with local police immediately if asset valued at $100 or more is missing.

2. Notify immediate supervisor no later than beginning of the next business day.

3. Complete Parts 1 and 2 of Form 4000, Incident Report (available on Treasury’s Intranet).

4. Forward the Incident Report (with attached police report, if applicable) to immediate supervisor and a copy to the Department of Treasury, Office of Privacy and Security.

Management Staff must:

1. Report the incident immediately through the chain of command to the Treasury Division/Office Administrator and the Office of Privacy and Security. If personal information is involved, follow the guidelines for Security Breach.

Exception: If another state agency/governmental entity, report incident to Treasury Disclosure Officer, Office of Privacy and Security. If contractor or vendor, report incident to Program Manager and the Office of Privacy and Security.

2. The Administrator must notify the Bureau Director if it is a material incident or involves non-Treasury information.

3. The Bureau Director must notify the other entity immediately.

4. The Office Administrator/Bureau Director must inform the Department of Technology, Management and Budget (DTMB) Agency Services (Treasury) Director immediately if incident involves information technology resources.

5. Notify other Treasury divisions/offices that may be affected or should be involved with investigation.

6. The Disclosure Officer must notify the IRS Office of Safeguards if federal tax information is involved.

7. Investigate and resolve the incident.

8. Finalize Form 4000* and submit it to the Department of Treasury, Office of Privacy and Security.

*Another entity may substitute its internal form for Form 4000 if all pertinent information is included.

What should I do if I witness, discover, or am informed of a potential security breach?

Employee must:

1. Report the security breach immediately (no later than beginning of the next business day) to immediate supervisor.

2. Complete Parts 1 and 2 of Form 4000.

3. Forward Form 4000 (with attached police report if applicable) to immediate supervisor and a copy to the Department of Treasury, Office of Privacy and Security.

4. Office of Privacy and Security contacts Michigan Cyber Security (MCS) within 24 hours, if the suspected breach involves electronic data.

What is an Incident? What is a Security Breach?

Management Staff must:

1. If the breach is ongoing, CONTAIN IT.

2. Report the potential breach immediately, through the chain of command, to the Bureau Director or Deputy Treasurer, whichever is applicable.

3. The Bureau Director or the Deputy Treasurer, whichever is applicable, must notify the Chief Deputy Treasurer/Treasurer immediately if a breach involves a database of personal information.

4. The Bureau Director must notify the other entity if the potential breach involves non-Treasury information.

5. The Office Administrator/Bureau Director must inform the DTMB Agency Services (Treasury) Director right away if incident involves information technology resources and personal information.

6. The Disclosure Officer must notify the IRS Office of Safeguards if federal tax information is involved.

7. Convene appropriate personnel, so the scope of the breach can be determined, and a plan for appropriate action can be agreed upon.

Note: If a database of personal information is involved, the Chief Deputy Treasurer/Treasurer must approve the Plan of Action.

8. If appropriate, issue breach notifications by telephone, in writing, on the Web or by e-mail.

9. Notify the three major credit bureaus of the breach if more than 1,000 residents of the State of Michigan will receive or have received breach notifications.

10. Finalize Form 4000* and submit it to the Department of Treasury, Office of Privacy and Security.

11. Office of Privacy and Security contacts the Social Security Administration (SSA), if the data involves SSA provided personally identifiable information (PII) and Treasury Inspector General for Tax Administration (TIGTA) if Federal Tax Information (FTI) is involved.

*Another entity may substitute its internal form for Form 4000 if all pertinent information is included.

Treasury must protect personal information against risks such as unauthorized access, modification or loss with reasonable security safeguards. Some safeguards are:

• Do not store confidential, personal, or sensitive Treasury information on mobile devices or portable media (including laptops, notebooks, memory sticks, CDs, DVDs, floppies) unencrypted.

ENCRYPT files or the full disk. (Refer to DTMB Standard 1340.00.110.03, Storage of Sensitive Information on Mobile Devices and Portable Media; also refer to Treasury Policy ET-03169 Data Security).

• Avoid sending or receiving unencrypted confidential, personal, or sensitive information via e-mail.

• Avoid sending confidential, personal, or sensitive information via fax.

• Secure confidential, personal, or sensitive papers on the fax, printer, or copy machines.

• Keep conversations at a volume level and/or in a location that will protect information.

• Back-up data on a regular basis; make sure data files from an approved portable device are stored on the network server.

• Store data on a “need to know” basis.

• Shred documents with confidential, personal, or sensitive information (see Treasury Policy ET-03115 Confidential Information, Handle and Discard).

• Have computers and hard drives properly wiped or overwritten when discarding or transferring (see DTMB Procedure 1340.00.110.04, Secure Disposal of Installed and Removable Digital Media and Treasury Policy ET-03169).

• Use a log-in password that complies with DTMB’s 1340.00.080.01 Identification and Authentication Standard.

• Never set any log-in dialog box to remember your password (see Treasury Policy ET-03175 Passwords).

• Use a password-protected screen saver that comes on after a few minutes of inactivity. Initiate screen lock system (if a Treasury employee, press the key with Microsoft Windows logo and “L” on the keyboard) when you leave your office, even for a short period.

• Limit access to confidential, personal, or sensitive information to those who need to use it to perform their job duties (see DTMB Policy 1340.00.020.01, Information Technology Access Control, and Treasury Policy ET-03164 Access Control).

For additional information, see the following guidelines in the Security Guide:

ET-03180, Incident Reporting BT-03084, Security Breach Involving Personal Information PT-03253, Incident Reporting and Handling CT-03070, Incident/Security Breach Examples DTMB Operating Procedure, How to Handle a Breach of Personal Identifiable / Sensitive Information Incidents

Other References:

ET-03204, Employee Conduct, General Guidelines BT-03049, Employee Conduct, General Guidelines ET-03140 Workplace Safety PT-03246, Potential Dangerous Taxpayer/Debtor, Report PT-03095, Theft or Irregularities in Public Funds/Property or Violations of Departmental Policies and Procedures, Report and Investigate

Contact Information:

If questions, please contact Office/Division/Bureau Security Liaison or the Office of Privacy and Security at 517 636-4081.

Individuals Media

Law Enforcement

Agencies

Other Incident

Response Teams

Employee Detected/

Discovered Incident

Incident Reporthing

Organizations

DTMB

Discovered/ Detected Incidents

Credit Bureaus