PWS Appendix 5_NARA 1608 NARAs Privacy Program Tranmittal Memo and Supplement.pdf

National Archives and Records Administration

S1-1

Supplement to NARA 1608

Draft

Supplement to NARA 1608, NARA’s Privacy Program

Part 1 – Protecting Personally Identifiable Information (PII)

Minimum Safeguards and Rules of Behavior

If NARA users collect, maintain, handle, access, or disseminate PII in the course of performing their official duties, they must ensure that the information is properly protected. This applies to

NARA users wherever they are working, whether in a NARA facility or a remote location, including one’s home, and to NARA users in travel and local travel status.

1. Physical and technical safeguards that NARA users must have in place to protect sensitive PII from unauthorized disclosure.

a. Limit the collection and use of PII. New information collections must follow

NARA guidance.

b. Only access or use sensitive PII when there is a business need to know that information.

(1) The use of sensitive PII must be compatible with notices, such as a system of records notices (SORN), Privacy Impact Assessment, or Privacy Act Statement provided to the individuals from whom the information was collected. If unsure about whether a specific use is appropriate, NARA users should confirm with their supervisor. NARA contractors must have a nondisclosure agreement on file with NARA prior to handling sensitive

PII, and complete the mandatory online privacy awareness training course.

(2) Never browse files containing sensitive PII out of curiosity or for personal reasons.

(3) Refer requests for sensitive PII in NARA operational records from members of the media, the public and other outside entities, including requests from members of Congress to NARA’s Freedom of Information

Act (FOIA) and Privacy Act Officer (NGC).

(4) Do not create unnecessary or duplicative collections of sensitive PII, such as duplicate, ancillary, “shadow,” or “under the radar” files. In some instances, it may be appropriate to create new spreadsheets or databases that contain sensitive PII from a larger file or database, but these new files should be kept only as long as necessary and access should be limited.

When there is a need to print, copy, or extract sensitive PII from a larger data set, limit the new data set to include only the specific data elements

NARA 1608-S1

S1-2 needed to perform the task at hand. If there is a need to create duplicate copies of sensitive PII to perform a particular task or project, delete or destroy them when they are no longer needed.

c. During normal business hours, maintain information containing PII in areas accessible only to authorized individuals. After business hours:

(1) Close any electronic file or application that is open;

(2) Secure computers by logging off, locking it or shutting down as appropriate;

(3) Put paper materials in a locked drawer or cabinet and/or a locked office or file room; and

(4) Consistent with office protocols, return accessioned records, including electronic media to their appropriate storage location.

d. Do not leave records containing PII open and unattended, or in any manner that would allow the data to be seen by an unauthorized individual.

(1) “Lock” computers by pressing the Ctrl-Alt-Delete keys and choosing

“lock computer”; and

(2) Put paper materials in a locked drawer or cabinet; or

(3) Close and lock your office door.

e. Store documents containing PII in locked cabinets when not in use. Personnel information includes supervisors’ copies of personnel documentation, such as:

(1) Correspondence, forms and other records relating to an employee’s personnel records;

(2) Pending actions;

(3) Requests for personnel actions;

(4) Performance appraisals; and,

(5) Other records on individual employees.

f. Password protect electronic files containing PII when maintained within the boundaries of the agency network. Sensitive PII may be stored on shared drives, Google

Drive, or on the ICN but NARA users must ensure only individuals with a business need to access the information may do so. For example, never share a file in Google Drive

S1-3 containing sensitive PII with anyone who has the link; identify specific people who may access the file instead.

g. When sending sensitive electronic PII data, ensure it is encrypted.

h. When mailing material containing PII or preparing it for courier delivery, securely seal the envelope and take care to ensure that the envelope is addressed to the appropriate recipient.

i. Properly destroy materials containing PII, as authorized by the NARA Records

Schedule, by shredding, burning, deleting or other authorized destruction methods that ensures the data or record is unreadable or unrecoverable.

(1) NARA users who work at a facility that engages in burn runs:

(a) Dispose of paper documents containing PII in a burn bag, and keep the burn bag in locked offices. There is no need to place the burn bag in a locked cabinet.

(b) Seal all burn bags sent for burn bag pickup.

(c) When a burn bag contains PII, have it picked up at the next designated burn bag pick up, if possible, rather than waiting to fill the burn bag.

(d) In lieu of using a burn bag NARA users may wish to shred reference copies of documents containing PII that are no longer needed for business purposes.

(2) At Archives I and Archives II, PII may be destroyed in the Datastroyer.

For more information please see guidance issued by facilities on use of the

Datastroyer.

j. When these procedures are followed no extra steps are necessary to safeguard PII when janitorial and other maintenance staff need to enter an area where PII is kept, including after hours.

2. Rules of behavior that NARA users must follow when sensitive PII is physically transported outside of NARA.

a. NARA users who have a business need to transport sensitive PII from NARA’s secured, physical perimeter must have written authorization from his or her supervisor.

Signed telework agreements that document the users’ need to use sensitive PII is appropriate. In other circumstances requiring the use of PII, NARA users must email their supervisor with the date, a brief description of the information, and the reason for its removal. This email, in combination with the supervisor’s response, is sufficient as written permission.

S1-4

b. The authorization must describe the work assignment that requires the use of PII and the type of PII data needed to complete the assignment.

c. NARA users who create or maintain documents or data containing sensitive PII must know where the information is at all times.

d. NARA users who frequently transport PII outside of NARA may apply for a NA

Form 6063A, Holdings Steward Permit, following the procedures outlined in NARA 211, Exit Inspections of Property at NARA.

e. When travelling, either on official travel for an extended period of time, to and from off-site meetings, or to and from work locations including telework locations, secure sensitive PII.

(1) Avoid leaving a mobile device, laptop (regardless of whether it contains

PII), portable storage media, or paper documents containing PII in an unattended vehicle. In extraordinary circumstances, if it is not possible to carry them when leaving the car, lock the car, placing the laptop and other materials in the trunk so that they are not visible (prior to arrival at the destination if practical). Treat laptops as one would treat their wallet or purse.

(2) When traveling by airplane keep laptops (regardless of whether it contains

PII) and any portable storage media or paper documents containing PII in carry-on luggage. Never place these items in checked luggage. If there is a large amount of paper files that cannot be carries on the plane, ship them to the destination via UPS, FedEx or U.S. Postal Service (“certified, return receipt”) so that the files can be tracked. Occasionally, airlines may require that laptops be included in checked luggage for security reasons.

NARA users must comply with airline requirements.

f. Removal of accessioned records requires separate approval under NARA 211, Exit Inspections of Property at NARA.

3. Rules of behavior that NARA users must follow when remotely accessing sensitive PII from a non-NARA device.

a. NARA users who have a business need to remotely access electronic sensitive PII data must have written authorization from his or her supervisor.

b. The authorization must describe the work assignment that requires the use of sensitive PII and the type of PII data needed to complete the assignment.

c. NARA users may not download data containing sensitive PII to their personal devices, including home computers.

S1-5

d. NARA users may not open or save files containing sensitive PII on their personal devices, including home computer or any public computer.

e. Refer to NARA 802, Use and Monitoring of NARA Office and Information

Technology (IT) Equipment and Resources for more information, especially for appropriate use of Google Apps for Government.

4. Rules of behavior that NARA users must follow when they use removable media

[including, but not limited to CD’s, DVD’s, USB Flash Drives (UFD, also known as thumb drives)] containing sensitive PII.

a. Removable media that contain sensitive PII data may only be accessed and stored on NARA-issued and controlled devices. These devices must be encrypted.

b. NARA users must not:

(1) Leave removable media containing PII unattended.

(2) Share removable media containing PII with unauthorized individuals.

(3) Check removable media containing PII with luggage when traveling.

(4) Leave a USB flash drive containing PII in an unattended computer.

(5) Attach a USB flash drive containing PII to a key ring.

c. NARA users must:

(1) Encrypt PII contained on removable media.

(2) Immediately report any loss or theft of equipment containing PII to their immediate supervisor to initiate the breach notification process.

(3) Report any suspicious activity, suspected loss or theft of PII to the OIG.

5. Rules of behavior that NARA users must follow when sending an email or fax containing PII.

NARA users must:

a. Consider the sensitivity of the information and the impact of the loss of the PII before choosing to send PII via email or fax.

b. Properly mark emails or faxes containing sensitive PII so that the recipient will be alerted to the need to protect the information.

S1-6

c. Provide a point of contact should the email or fax be received by someone other than an authorized recipient. Contact instructions such as “If you have received this email or fax in error, please notify the sender immediately by reply email or fax and permanently delete this email or destroy this fax and any attachments without reading, forwarding, saving or disclosing them” may be appropriate.

d. Check to ensure that the email address is correct before sending the email.

e. Not send PII material to a personal email account for ease of access to the information when working remotely.

f. Remember that NARA email is encrypted in transit and at rest.

g. Not email sensitive PII in the body of an email.

h. Place sensitive PII in an attachment and encrypt the attachment using SecureZip, available to all employees via the software request form, when emailing PII to a non-

NARA account. SecureZip is FIPS 140-2 compliant which means it meets the NIST standards for encryption. Provide the password separately (e.g. by phone, another email or in person). Emailing PII to a NARA account does not require encryption.

i. If exchanging files or email with another federal agency, NARA users may use the Army’s SAFE system, available at https://safe.amrdec.army.mil/SAFE/.

6. Rules of behavior that NARA users must follow when extracting sensitive NARA-owned data from an IT system containing PII.

Each system owner be aware of whether data extracts or printouts of PII are made from their system and ensure these are for a necessary business purpose and are destroyed when no longer needed, in accordance with an applicable records schedules.

7. Rules of behavior that NARA users must follow when digitizing paper documents containing sensitive PII.

Use caution when digitizing a document that is automatically saved on a shared network drive assigned to the scanner. Take steps to save the digitized document in a location that can be accessed by only those who need the file to do their job.

8. Rules of behavior that NARA users must follow shipping paper files containing sensitive PII to a third party.

a. Pallet shipments with sensitive PII.

(1) Exclusive use trailers. FRC boxes containing sensitive PII on paper can be palletized, shrink wrapped, and shipped. Trucks or containers loaded with these records should be securely locked and sealed, so it may be https://safe.amrdec.army.mil/SAFE/

S1-7 immediately determined if the shipment has been compromised. Seals which can be easily cut with pliers are not acceptable.

(2) One or two pallets going via UPS or FedEx freight. FRC boxes containing sensitive PII on paper can be palletized, covered with a cardboard top, shrink wrapped with opaque shrink wrap, and shipped.

b. Shipping sensitive PII on paper in FRC boxes (no pallet). The outside of the box should be checked for identifying information, such as names, SSN, etc. Where identifying information is on the outside of the box, a new box should be used or the old box wrapped securely to make this identifying information not visible. If the contents of the box are visible through hand holds, the end folders should be turn to obscure visibility of any PII. The boxes must be shipped with tracking and signature on delivery required.

c. Shipping sensitive PII on electronic media. The information should be encrypted either at the hardware or file level as appropriate. Encryption must be done using a FIPS

140-2 compliant algorithm. Passwords must be sent separately.

9. Rules of behavior that NARA users must follow when sending small amounts sensitive PII via mail:

Small amounts of sensitive PII may be sent via USPS first class mail, UPS, or FedEx. It is preferable to track the package to ensure it is delivered. The sensitive PII should be sealed in an opaque envelope and placed inside of another envelope (double wrapped). The outside envelope should not be marked with any special markings.

10. Rules of behavior that NARA users must follow when sending sensitive PII via interoffice mail:

In general, it is best to hand deliver paper documents or electronic media containing PII to another NARA employee or office, but NARA users may send small amounts of PII in paper form through interoffice mail. Do not send a large volume of PII through interoffice mail. For example, send one employee’s personnel action form to that person via interoffice mail, but do not send a stack of personnel action forms for an entire division or organization through interoffice mail. Never send a disk or other portable media containing PII through interoffice mail unless the files or the hardware are encrypted.

S1-8

Part 2 – Breach Response Plan

A breach of personally identifiable information (PII) is the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, unauthorized access, or any similar term referring to situations where individuals gain access or potential access to PII, whether physical or electronic for an unauthorized purpose.

9. Types of incidents which may result in a breach.

a. Actual or suspected loss, theft, or improper disclosure of PII data in electronic or paper form.

b. Lost or stolen equipment, especially removable media [electronic devices capable of storing and retaining data, such as laptops, personal digital assistants (PDA’s), UFD’s, external hard drives or other electronic storage devices] that are known or suspected to contain PII.

c. Inadvertent loss or unauthorized access to employee information consisting of names and social security numbers (including a temporary loss of control).

d. Inadvertent loss or unauthorized access to information relating to the public

(including the names and addresses of NARA researchers or credit card information).

e. Incorrect delivery of PII information.

f. Using NARA’s IT resources in violation of NARA’s security policies, causing a compromise, breach or loss of control of PII.

g. Any other action that evades or bypasses NARA’s security controls.

10. Action that must be taken when a NARA user suspects that a breach has occurred.

a. When a NARA user suspects that a breach of any kind has occurred, they must call or email the designated system owner (for electronic systems) and/or the supervisor

(for records in any media, including those among NARA’s accessioned holdings) within one hour of discovery. The user must provide the following information concerning the breach:

(1) A brief description of the occurrence and the type of information that may have been breached.

(2) The name of the user who discovered the suspected breach and what action, if any, may have caused the breach.

S1-9

b. When a system owner or supervisor has been informed of a suspected breach, they must immediately inform the Senior Agency Official for Privacy (SAOP) and/or the

Chief Information Security Officer (CISO), in the case of breach involving electronic PII.

c. The Senior Agency Official for Privacy (SAOP) and/or the Chief Information

Security Officer (CISO) must

(1) Consult with the system owner or supervisor to determine the nature of the incident.

(2) Report the incident to the US Computer Emergency Readiness Team (US

CERT) within one hour if required by US CERT guidelines (CISO).

(3) Report the incident to the NARA Inspector General (OIG) if the suspected breach involves theft, loss or unauthorized use of NARA equipment.

(4) Provide technical remediation and forensic analysis capabilities (CISO).

(5) Identify all the applicable privacy compliance documentation for the potentially impacted information and information systems (SAOP).

(6) Consider the implications of combining information maintained in different information systems within the agency, sharing information between agencies, or sharing information with a non-Federal entity to reconcile or de-duplicate records, identify potentially affected individuals, or obtain contact information in order to provide notice (SAOP).

(7) Consult with the other members of the NARA Breach Response Team

(BRT) to determine if a breach notification is required.

11. NARA’s Breach Response Team (BRT).

a. The NARA BRT is composed of officials responsible for addressing potential breaches of PII at NARA. For membership, see NARA 1608, paragraph 3e.

b. The SAOP is responsible for determining when it is appropriate to convene a meeting of the NARA BRT. At a minimum, the SAOP shall convene the Breach

Response Team when a breach meets the criteria for reporting a breach to Congress (44

U.S.C. §3554(b)(7)(C)(iii)(III); Pub. L. 113–283, §2(d)). If the SAOP is unavailable, the

CIO makes the determination to convene a meeting of the NARA BRT.

12. Factors the BRT must consider before making recommendations to the Archivist regarding whether or when to provide notice or services to individuals potentially affected by a breach.

S1-10

a. When assessing the risk of harm to individuals potentially affected by a suspected or confirmed breach, the SAOP must consider a number of possible harms associated with the loss or compromise of information, including

(1) The effect of a breach of confidentiality or fiduciary responsibility.

(2) The potential for blackmail.

(3) The disclosure of private facts.

(4) Mental pain and emotional distress.

(5) Financial harm.

(6) The disclosure of contact information for victims of abuse.

(7) The potential for secondary uses of the information which could result in fear or uncertainty, or the unwarranted exposure leading to humiliation or loss of self-esteem.

(8) Anticipated threats or hazards to the security or integrity of records which could result in “substantial harm, embarrassment, inconvenience, or unfairness to any individual on whom information is maintained” (5

U.S.C. § 552a(e)(10)).

(9) Risks to the agency, agency information systems, agency programs and operations, the Federal Government, or national security.

b. The NARA Breach Response Team must consider the following factors:

(1) The nature and sensitivity of the PII compromised by the breach, including the potential harms that an individual could experience from that type of PII.

(2) The likelihood of access and use of PII, including whether PII was properly encrypted.

(3) The type of breach, including the circumstances of the breach, as well as actors involved and their intent.

c. If the BRT determines that there is minimal risk for the potential misuse of the PII involved in the breach, they should recommend to the Archivist that NARA should not provide notice or services to individuals potentially affected by a breach.

d. If the BRT determines that there is a medium or high risk of misuse of breached data, they should recommend to the Archivist that NARA should provide notice or services to individuals potentially affected by a breach.

S1-11

13. Mitigating the risk of harm to individuals potentially affected by a breach.

Once the BRT assesses the risk of harm to individuals potentially affected by a breach, they will consider how best to mitigate the identified risks. The SAOP will recommend to the Archivist the actions the agency should take to mitigate the risk of harm. These actions include, but are not limited to countermeasures, guidance, and services.

14. Countermeasures.

Countermeasures that NARA can take include, but are not limited to the following.

a. If the breach involves government-issued travel or purchase cards, NARA will immediately notify the issuing bank. If the breach involves an individual’s bank account numbers to be used for direct deposit of credit card reimbursements, government employee salary, or any benefit payment, NARA will notify the bank and other entities that handle that particular transaction immediately.

b. If NARA users’ passwords are potentially compromised in a breach, NARA will require those users to change their passwords.

15. Guidance.

a. NARA will tailor the guidance it provides to individuals potentially affected by a breach based on the type of information that was compromised, using the information available at IdentityTheft.gov/databreach as the baseline.

b. In addition, NARA may advise individuals of other guidance including, but not limited to:

(1) Changing passwords and using two-factor authentication.

(2) Active Duty Alerts.

(3) Credit freeze for self and dependents.

(4) Closing or changing accounts.

(5) Practicing good cyber hygiene.

(6) Deceased alerts.

(7) Fraud alerts.

(8) Tax fraud alerts.

S1-12

16. Services.

Services that NARA may provide to individuals potentially affected by a breach include, but are not limited to the following.

a. If the breach involves social security numbers or other highly sensitive information (e.g. a date of birth, home address, or mother maiden’s name coupled with a social security number) NARA may offer credit monitoring services to the affected parties at NARA’s expense. If credit-monitoring services are required, they will be immediately acquired through service providers on the GSA schedule. The service provider will issue notice and instructions to the affected individual, using language prepared by NARA.

b. Other services that NARA may provide include, but are not limited to:

(1) Identity monitoring.

(2) Full-service identity counseling and remediation services.

(3) Identity Theft insurance.

17. Notifying individuals potentially affected by a breach.

Once the BRT determines that there has been a medium or high risk of misuse of breached data the BRT will recommend to the Archivist how NARA should notify individuals potentially affected by a breach. Once the decision to notify individuals has been made, the BRT will consider aspects of the notification including, but not limited to the source, timeliness, contents, and method of the notification as well as certain special considerations.

18. Notification source.

a. For breaches that involve fewer than 50 individuals, the breach notification must be issued jointly by the SAOP and the Executive or Staff Director that maintains the breached information.

b. For breaches that involve 50 or more individuals, the breach notification must be issued by the Archivist or his designee.

19. Notification timeliness.

a. NARA must provide notification as soon as the BRT that there is a medium or high risk of misuse of the breached information and the Archivist authorizes a notification.

b. If a criminal investigation is initiated, the BRT must coordinate all notices with the IG to ensure that the investigation is not compromised by the notice.

S1-13

c. NARA may provide notice to individuals affected by a breach or offer them credit protection services before the completion of a risk analysis by the BRT if it is determined that there is an immediate, substantial risk of identity theft or other harm as a result of the breach.

d. In some instances, law enforcement or national security considerations may require NARA to delay notification in order to protect data or computer resources from further compromise or to prevent interference with the conduct of a lawful investigation or efforts to recover the data. Any lawful request for delay in notification must include an estimated date after which the requesting entity believes that notification will not adversely affect the conduct of the investigation or efforts to recover the data.

e. When NARA is unable to identify, with specificity, the affected individuals, NARA may seek the assistance of a computer mining contractor or other professionals to assist in the retrieval of identifying information from a database, removable storage devise, or other media. These efforts may delay the notification process.

f. The Archivist makes the final decision to accelerate or delay notifications in consultation with the BRT.

20. Notification contents.

The breach notification must be provided in writing (and in the appropriate language if affected individuals are not English speaking) and must contain at least the following elements:

a. A brief description of what happened, including the date(s) of the breach and of its discovery.

b. To the extent possible, a description of the types of personal information compromised by the breach (e.g., full name, SSN, date of birth, home address, account number, disability code, etc.).

c. A statement of whether the information was encrypted or protected by other means, when determined that disclosing such information would be beneficial and would not compromise the security of the system.

d. Guidance to potentially affected individuals on how they might mitigate their risk of harm, countermeasures the agency is taking, and services the agency is providing to potentially affected individuals, if any.

e. What the agency is doing, if anything, to investigate the breach, to mitigate losses, and to protect against a future breach.

f. Whom potentially affected individuals should contact at the agency for more information, including a telephone number (preferably toll-free), email address, and postal address.

S1-14

21. Notification method.

a. The best means for providing notification depends on:

(1) The number of individuals affected.

(2) Whether the breach concerns NARA employees or the public.

(3) What contact information is available about the affected individuals.

(4) The urgency with which the individual(s) affected need to receive notice.

b. The following types of notifications may be considered by the BRT:

(1) First class mail is the primary means of informing an individual of a breach of PII.

(a) When NARA has reason to believe that the address is no longer current, NARA must take reasonable steps to update the address by consulting with other agencies or private entities to facilitate notice by mail.

(b) The notice must be sent separately from other mailings so that it is obvious to the recipient.

(2) Telephone notification may be used to contact individuals in cases where urgency dictates immediate and personal notification or where a limited number of individuals are affected. Telephone notification must be followed with a written notification by postal mail.

(3) Email notification may be used to contact individuals when no known mailing address is available and the individual has provided NARA with an email address and has expressly given consent to email as an acceptable means of communication with NARA.

c. If all methods to locate a current mailing address for an individual affected by a breach of PII have been unsuccessful, the BRT may recommend to the Archivist that

NARA provide notice by posting the relevant information on the National Archives website, archives.gov, providing notification to major print and broadcast media, or through emergency Federal Register notice.

d. The BRT may also recommend to the Archivist that NARA provide notice concerning a breach of PII to the media when such notice assists the public in understanding the nature of the information breached or when the BRT determines that a breach has affected a substantial number of people. NARA may provide notice by posting the relevant information on the National Archives website, archives.gov, http://www.archives.gov/ http://www.archives.gov/

S1-15 providing notification to major print and broadcast media, or through emergency Federal

Register notice.

22. The Archivist will notify other agencies or public sector entities of a breach of PII under the following circumstances.

a. Public and private sector agencies are notified of a breach when that agency is affected by the breach or will play a role in mitigating the potential harms stemming from the breach.

b. Congress is notified

(1) Within seven days of the date of discovery if the breach is a major incident

(defined by OMB M-17-05 as “unauthorized modification of, unauthorized deletion of, unauthorized exfiltration of, or unauthorized access to 100,000 or more individuals' PII) (44 U.S.C.

§3554(b)(7)(C)(iii)(III)); or

(2) Within 30 days of the date of discovery if a breach meets the following criteria (Pub. L. 113–283, §2(d)):

(a) Involves the exfiltration, modification, deletion, or unauthorized access of 10,000 or more individuals’ PII; or

(b) Involves PII that, if exfiltrated, modified, deleted, or otherwise comprised is likely to result in a significant or demonstrable impact on agency mission, public health or safety, national security, economic security, or foreign relations.

(3) If the PII potentially compromised by a breach was properly encrypted, Congress does not have to be notified.

c. NARA responds to inquiries related to data breaches from such governmental agencies as the Government Accountability Office and Congress in conjunction with the

BRT.

23. Post-breach actions.

a. The SAOP must document NARA’s response to a breach in an after-action report.

A report is unnecessary if less than 100 individuals are potentially affected by the Breach unless:

(1) There is evidence that the PII was used for an unauthorized purpose.

(2) A series of breaches involving the records of under 100 individuals suggests a suspicious pattern or trend or if there is evidence to suggest the incidents are related or linked.

S1-16

(3) There is evidence that the breach involved potential criminal activity or a potential violation of law.

(4) After conducting an assessment of the potential risk of harm, the agency provides notice to the individuals potentially affected by the breach.

b. At a minimum, the after-action report must include the following information.

(1) A description of the PII impacted by the breach, including the number of individuals potentially affected, as well as the assessed risk of harm to individuals potentially affected by the breach.

(2) Did the agency report the breach to US-CERT or Congress?

(3) Did the agency designate the breach as a Major Incident?

(a) Time/Date designated as Major Incident.

(b) Time/Date reported to US-CERT as Major Incident.

(c) Method/Date reported to Congress per Major Incident

Requirements.

(d) Method/Date reported to Congress per breach Requirements.

(4) Were individuals notified?

(a) If yes, how many out of the total potentially affected individuals were notified?

(b) Method of notification

(c) Date of notification

(d) Describe any differences, if applicable, between notices sent to different categories of individuals.

(e) Cost of notification per individual and total.

(5) Were support or remediation services provided?

(a) If yes, how many out of the total individuals were provided services?

(b) Which types of services were provided?

(c) Length of coverage

S1-17

(d) Describe any differences, if applicable, between services provided to different categories of individuals.

(e) Cost of services per individual and total.

(6) List other services provided, such as call centers, digital services, etc.

(7) List any other costs of the breach response in addition to notifications and mitigation services.

c. The BRT must document NARA’s lessons learned and recommend to the

Archivist whether NARA should take any of the following actions. The goal is to identify systematic vulnerabilities or weaknesses in NARA’s information systems in order to establish privacy safeguards and mandate preventative measures to decrease the likelihood of subsequent breaches.

(1) Update the Breach Response Plan.

(2) Develop and implement new policies to protect the agency’s PII holdings.

(3) Revise existing policies to protect the agency’s PII holdings.

(4) Reinforce or improve privacy awareness training.

(4) Develop or revise documentation such as SORNs, PIAs, or privacy policies.

24. Tabletop exercises and annual Breach Response Plan reviews.

a. The SAOP must convene the agency’s Breach Response Team to hold a tabletop exercise at least annually, to test the Breach Response Plan and to help ensure that members of the team are familiar with the plan and understand their specific roles.

b. The SAOP must review the agency’s Breach Response Plan annually to confirm that the plan is current, accurate, and reflects any changes in law, guidance, standards, agency policy, procedures, or technology. The SAOP is responsible for documenting the date of the most recent review and submitting the updated version of the plan to OMB as part of annual Federal Information Security Management Act (FISMA) reporting.

Transmittal Memo

DATE: DRAFT

TO: All Staff

SUBJECT: NARA 1608, NARA’s Privacy Program

Purpose: This policy establishes NARA’s privacy program and provides guidance to staff in order to protect personally identifiable information (PII) from unauthorized disclosure as required under the Freedom of Information and Privacy Acts, and as directed by Office of

Management and Budget (OMB) in OMB Circular A-130 “Managing Information as a Strategic

Resource.”

NARA 1608 emphasizes the role of NARA users in ensuring that the appropriate physical and technical safeguards are in place to protect all NARA systems (both textual and electronic) that contain PII.

Background: Revisions to OMB Circular A-130 “Managing Information as a Strategic

Resource” (July 28, 2016); to the role and designation of the Senior Agency Official for Privacy, communicated by OMB Memorandum M-16-24 “Role and Designation of Senior Agency

Officials for Privacy” (September 15, 2016); and the issuing of OMB Memorandum M-17-12, “Preparing for and Responding to a Breach of Personally Identifiable Information” (January 3, 2017) required NARA to update this policy, which was based in large part on OMB

Memorandum 06-16, “Protection of Sensitive Agency Information.”

Significant changes: The directive and its supplement have been updated to reflect recent guidance from OMB on best practices for handling PII information and the structure and management of agency privacy programs including the following:

Designates NARA’s General Counsel as the Senior Agency Official for Privacy as required by OMB Memorandum M-16-24 “Role and Designation of Senior Agency

Officials for Privacy.”

Incorporates NARA’s Chief Privacy Officer’s role.

Establishes the NARA Breach Response Team and provides procedures for reporting and responding to breaches of PII as directed by OMB Memorandum M-17-12, “Preparing for and Responding to a Breach of Personally Identifiable Information” (January 3, 2017).

Available forms: None.

Cancelled forms: None.

Cancelled policy: NARA 1608, Protection of Personally Identifiable Information (PII), dated

August 6, 2009.

Related policy:

NARA 108, Information Collection.

NARA 205, Forms Management.

NARA 211, Exit Inspections of Property at NARA.

NARA 1603, Access to Records under the Privacy Act.

NARA 1607, Handling Sensitive Personally Identifiable Information (PII) in Open

Archival Materials.

NARA 1609, Initial Privacy Reviews and Privacy Impact Assessments.

Effective date: This policy is effective upon date of signature.

Contact information: For questions on this policy, please contact Hannah Bergman, Office of

General Counsel (NGC), on (301) 837-0344 or by email.

DEBRA STEIDEL WALL

Deputy Archivist of the United States

Attachments https://update.nara-at-work.gov/files/0100_series/nara0108.pdf https://www.nara-at-work.gov/files/policies/nara0205.pdf https://update.nara-at-work.gov/files/0200_series/nara0211_1.pdf https://www.nara-at-work.gov/files/policies/nara1603.pdf http://www.nara-at-work.gov/files/policies/nara1607.pdf http://www.nara-at-work.gov/files/policies/nara1607.pdf http://www.nara-at-work.gov/files/policies/nara1609.pdf mailto:hannah.bergman@nara.gov

NARA 1608

DRAFT

SUBJECT: NARA’s Privacy Program

1608.1 Policy.

a. Protecting the privacy of our employees, our customers, and the public is of paramount interest to NARA. NARA uses physical and technical safeguards to protect personally identifiable information (PII) found in NARA IT systems and the records listed in subparagraph 1608.2b.

b. PII is any information that can be used to distinguish or trace an individual’s identity, such as their name, Social Security Number, biometric records, etc. alone, or when combined with other personal or identifying information that is linked or linkable to a specific individual, such as date and place of birth, mother’s maiden name, etc.

c. Sensitive PII is PII, which if lost, compromised, or disclosed without authorization, could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. Sensitive PII requires stricter handling guidelines because of the increased risk to an individual if the data are compromised.

(1) Some categories of PII are sensitive as stand-alone data elements.

Examples include Social Security Number, driver’s license or state identification number, passport number, Alien Registration Number, or financial account number.

(2) Other data elements such as citizenship or immigration status, medical information, ethnic, religious, sexual orientation, or lifestyle information, and account passwords, in conjunction with the identity of an individual (directly or indirectly inferred), are also sensitive PII.

d. NARA maintains a Breach Response Team (BRT) that is responsible for addressing suspected and actual breaches of PII at NARA.

e. Staff must follow the procedures for

(1) Protection of sensitive PII; and

(2) Responding when breaches of sensitive PII are discovered.

f. In the event of an inappropriate release of sensitive PII, NARA

(1) Makes every effort to notify impacted individuals;

(2) Provides credit monitoring and other services aimed at mitigating harm to impacted individuals; and

(3) Holds individuals personally accountable for their actions related to PII entrusted to them.

e. NARA only collects personal information that is necessary to conduct agency business per the Privacy Act of 1974, the Paperwork Reduction Act of 1995, and other privacy laws.

1608.2 Scope and applicability.

This guidance applies to

a. All NARA employees, contractors, National Archives Foundation staff, Presidential Library Foundation staff, foundation funded employees, interns, volunteers, detailees, or other individuals performing work for NARA with access to NARA IT systems or the records listed in subparagraph 1608.2b, hereafter known as “NARA users.”

b. Records that contain PII in any form or format found among

(1) NARA’s operational records, including by not limited to

(a) Researcher Application Files;

(b) Reference Request Files;

(c) Freedom of Information Act Request and Mandatory Review

Request Files;

(d) Records Reproduction Order Forms; and

(e) Payroll Time and Attendance Files and other personnel related items;

(2) Official Military Personnel Files and Official Personnel files in NARA’s legal custody;

(3) Federal or Presidential Records in NARA’s legal custody;

(4) Donated materials in NARA’s legal custody; and

(5) IT systems for which NARA is not the owner, including but not limited to

FPPS, QuickTime, and Concur.

c. For records in NARA’s physical custody at Federal Records Centers, NARA staff must follow the provisions of any Interagency Agreements (IAA’s) that outline appropriate protocols for protecting PII. When the IAA does not address privacy concerns, staff must follow the physical and technical protocols outlined in this directive to ensure that PII is protected from unauthorized access.

d. NARA’s handling of an individual’s personnel records is subject to these policies and procedures until they have been delivered to the individual. This policy does not apply to how an individual handles copies of their own personnel records. Nonetheless, it is a good idea to properly safeguard such information for your own protection.

1608.3 Responsibilities.

In addition to the authorities delegated in NARA 101, NARA Organization and Delegation of

Authority, the following responsibilities are assigned in order to effectively implement this policy.

a. General Counsel.

(1) As NARA’s designated Senior Agency Official for Privacy (SAOP), leads

NARA’s Privacy Program, including ensuring compliance with applicable privacy requirements, developing and evaluating privacy policy, and managing privacy risks consistent with the NARA’s mission.

(a) Designates NARA’s Chief Privacy Officer who is responsible for day-to-day management of NARA’s privacy program.

(b) Designates NARA’s Privacy Act Officer.

(2) Chairs NARA’s Breach Response Team.

(a) Provides privacy awareness training for employees and contractors.

(b) Develops and implements formal breach management policies and procedures, including a Breach Response Plan.

(c) Maintains breach response capabilities, including a mechanism for notifying potentially affected individuals.

b. Chief Privacy Officer.

(1) Ensures that NARA considers and addresses the privacy implications of all agency regulations and policies, and leads the agency’s evaluation of the privacy implications of legislative proposals, congressional testimony, and other materials pursuant to OMB Circular No. A-19, “Legislative

Coordination and Clearance.”

(2) Ensures that NARA complies with applicable privacy requirements in law, regulation, and policy.

(3) Manages privacy risks associated with any NARA activities that involve the creation, collection, use, processing, storage, maintenance, dissemination, disclosure, and disposal of PII by programs and information systems

c. Chief Information Officer (CIO).

(1) Conducts periodic risk assessments to identify areas of privacy-related vulnerabilities and risks that can be found among NARA’s IT systems.

(2) Convenes meetings of the NARA BRT in the absence of the SAOP

(3) Identifies technical remediation and forensic analysis capabilities that exist within the agency and which can be leveraged in the event of a breach.

d. Chief Information Security Officer (CISO).

(1) Conducts an immediate review of any NARA owned or operated IT

System when notified of an actual or suspected breach of PII from that system.

(2) Provides technical remediation and forensic analysis capabilities.

(3) Reports actual or suspected breaches of electronic PII to the US Computer

Emergency Readiness Team (US CERT) as required by US CERT and

OMB in applicable guidance.

e. NARA Breach Response Team.

(1) Makes the final determination on the appropriate response to a suspected or confirmed data breach involving PII using the Risk Based Decision

Framework outlined in applicable OMB guidance.

(2) Addresses potential privacy issues that impact NARA programs and initiatives.

(3) Holds regular and recurring meetings to address privacy concerns and compliance reporting.

(4) Membership.

(a) Archivist of the United States;

(b) Deputy Archivist of the United States;

(c) Director of Congressional Affairs;

(d) Chief of Management and Administration;

(e) CIO (Vice-Chair);

(f) CISO;

(g) Senior Agency Official for Privacy and General Counsel (Chair);

(h) Chief Privacy Officer;

(i) Director, Communications and Marketing Division;

(j) Inspector General; and

(k) Other NARA staff at the request of the SAOP, depending on the nature and scope of the breach in question.

f. Inspector General.

(1) Evaluates and provides recommendations for NARA’s PII compliance in accordance with the provisions of the Federal Information Security

Management Act (FISMA) and related laws and regulations.

(2) Evaluates both suspected and confirmed breaches of PII to determine if there are any law enforcement implications.

g. Privacy Act system managers.

(1) Responsible for managing personally identifiable information found in properly published system of records notices (SORNs) in accordance with the provisions of the Privacy Act.

(2) Works with the NARA Privacy Act Officer to update existing SORNs or develop new SORNS as appropriate.

h. System administrators implement, operate, and monitor all NARA IT systems in compliance with established protocols for control of PII access.

i. Supervisors.

(1) Ensure that 100 percent of the employees within their organization successfully complete the annual agency-wide privacy awareness training.

(2) Advise employees of their responsibilities regarding the appropriate physical and technical safeguards for protecting PII within their organization, through office or job specific training for employees or others that work with PII as a part of their official duties.

(3) Promptly report any suspected mishandling or breach of PII according to established incident handing procedures.

j. NARA users.

(1) Minimize the collection of PII to only that required to conduct NARA business.

(2) Ensure PII is protected by appropriate safeguards to ensure security, confidentiality and privacy.

(3) Complete annual agency-wide privacy awareness training and, as appropriate, office or job specific training.

(4) Acknowledge, on an annual basis, specific responsibilities related to the protection of PII and consequences of the failure to properly protect PII.

(5) Immediately report any suspected or confirmed breach of PII.

(a) Breaches from NARA IT systems must be reported to the designated system owner.

(b) Breaches from paper records must be reported to a supervisor.

(c) Suspected or actual loss of portable devises containing PII must be reported to a supervisor.

(6) Maintain and delete any data extracts containing PII in accordance with the procedures outlined in the attached supplement.

1608.4 Procedures.

a. Procedures for carrying out this policy may be found in the attached supplement, NARA’s Privacy Program.

b. Additional instructions, guidance, and resources for NARA users dealing with PII can be found on NARA’s Privacy Resources for NARA Employees page.

1608.5 Penalties for failing to properly safeguard PII.

https://www.nara-at-work.gov/staff_resources_and_services/employee_resources/privacy.html

a. NARA users will be held personally accountable for their actions related to PII entrusted to them. Failure to comply with the stated rules of behavior may result in administrative penalties or criminal sanctions.

b. Supervisors are subject to disciplinary action for failure to ensure that their staff completes any agency-wide or job specific privacy awareness training or for failure to take appropriate action upon discovering a suspected or actual breach of PII.

c. Specific penalties are outlined in the employee handbook, PERSONNEL 300, Appendix 752A, Penalty Guide.

1608.6 Penalties for NARA users who are responsible for causing a breach of PII.

a. NARA users are held accountable for their individual actions related to the protection of PII. If the BRT determines that a NARA user is responsible for the breach of PII, the BRT will recommend appropriate administrative penalties to the immediate supervisor.

b. If the BRT determines that a supervisor is aware of a subordinate committing or causing PII breach incidents and allows such conduct to continue, they will also be held responsible for failure to provide effective organizational oversight.

c. Specific penalties are outlined in the employee handbook, PERSONNEL 300, Appendix 752A, Penalty Guide.

d. There are no penalties or negative consequences associated with reporting a suspected breach, even if there is later determined to have not been a breach.

1608.7 Authorities.

a. Freedom of Information Act, as amended (5 U.S.C. §552) gives individuals the right to access information from the Federal government.

b. Privacy Act of 1974, as amended (5 U.S.C §552a) regulates the collection, maintenance, use, and dissemination of personal information by Federal executive branch agencies.

c. E-Government Act of 2002 (44 U.S.C. §3501 note) requires Federal government agencies that develop or procure new information technology involving the collection, maintenance, or dissemination of information in identifiable form or that make substantial changes to existing information technology that manages information in identifiable form to make Privacy Impact Assessments of those systems.

d. Federal Information Security Modernization Act of 2014 (44 U.S.C.

§3541) requires each Federal agency to develop, document, and implement an agency-wide program to provide information security for the information and systems that support the operations and assets of the agency, including those provided or managed by another agency, contractor, or other sources.

e. Paperwork Reduction Act of 1995 (44 U.S.C. §§ 3501 through 3520) requires that

Federal…