Attachment_4_-_ISSO_Stolen_Device-Media_Handling_Procedures.pdf

Procedures for Lost or Stolen Computing Device and Media

Purpose: To provide procedures on the handling of a stolen or lost computing device and storage media that contains sensitive or Personally Identifiable Information (PII)1.

Introduction:

OMB M-06-016 requires that Federal agencies report incidents of stolen Personally Identifiable Information (PII) to US-CERT. This procedure describes how computing devices (e.g., laptops, desktop, digital notepads, blackberries, etc.) and media (disks, thumb drive, CD-ROMs, DVDs, hardcopy report, etc.) at NIH are to be handled. If it was determined that the lost or stolen device or media contain PII it must be reported by the IRT to Secure One HHS within one hour of discovery. Note that the Secure One HHS reporting requirement applies only if there was PII.

Procedures:

1. User discovers that a computing device or media are lost or stolen.

2. User reports theft to appropriate law enforcement personnel (e.g., NIH Police) immediately. [Case number and officer assigned are obtained at this time.]

3. Supervisor or user reports immediately theft to the IC ISSO.

4. IC ISSO immediately informs the IRT by phone (301-881-9726) and/or e-mail

(IRT@mail.nih.gov).

5. If the IRT finds out about the theft from the NIH Police, the IRT informs the IC ISSO.

6. IC ISSO completes the ‘NIH Lost or Stolen Assets Report’.

7. IC ISSO e-mails completed report to the IRT.

8. IRT notifies Secure One HHS within one hour of discovery of PII involved.

9. IRT records information into tracking database.

10. IRT retains the ‘NIH Lost or Stolen Assets Report’.

1 Personally Identifiable Information (PII) means any information about an individual maintained by an agency, including, but not limited to, education, financial transactions, medical history, and criminal or employment history and information which can be used to distinguish or trace an individual's identity, such as their name, social security number, date and place of birth, mother’s maiden name, biometric records, etc., including any other personal information which is linked or linkable to an individual.

User discovers device or media is lost or stolen

User reports theft or loss to Law Enforcement

Supervisor/User reports theft to IC

ISSO

ISSO reports theft to IRT

ISSO completes ‘Lost or Stolen Asset Report’

If PII involved IRT reports theft/loss to Secure One

HHS

ISSO e-mails completed form to

IRT

IRT retains report

IRT records theft into tracking system