9000-1709-SOP.doc

SBA Procedural Notice11/5/96

Set ExpDate"12/31/96" 12/31/96

10/21/2007

In accordance with several of the Office of Management and Budget (OMB) memoranda requesting all government agencies to implement procedures to safeguard Agency sensitive and personally identifiable information (PII), SBA is implementing controls to protect data downloaded to the desktop or transported on removable media and portable/mobile devices such as flash drives, diskettes and laptop computers. This also applies to PII data that appears in end-user programs and spreadsheets.

Managers are required to establish and implement procedures that will manage file extracts or end-user programs/spreadsheets that contain or process sensitive information. As part of the oversight and enforcement procedures, managers should ensure that all employees and contractors follow these steps.

1) All computer-readable data extracts from databases holding sensitive information should be logged; then verify that each extract, including sensitive data has been erased within 90 days unless further needed. Files required beyond 90 days must have written justification provided by the responsible person and must be tracked. (See attached End-User Management Guidance)

2) Utilize the attached End-User Management Guidance for developing intra-office procedures to protect files containing sensitive Agency PII data/end-user programs/spreadsheets. See Attachment A - details on Password Protecting file(s) using WinZip. Attachment B- details on Password Protecting Microsoft Office Suite Files and a sample Data Extract Log Sheet.

3) Program Offices will be required to perform a monthly review to ensure that:

· Files are being deleted as required

· A thorough review of logs to validate the continued need to use existing data extract files, primarily files that exceed the original 90 days

· File protections are in place as required by this notice The Office of the Chief Information Officer (OCIO) will incorporate the review of data extract logs in the Certification and Accreditation process, specifically in the area of Continuous Monitoring. As part of Continuous Monitoring, every quarter program offices will utilize a control called the Continuous Monitoring Assessment Report; the results will be reported to the Chief Information Security Officer. A fail will be identified as a new vulnerability, tracked in the Plans of Action and Milestones and reported in the Quarterly FISMA report. The OCIO will also work with the Office of Chief Financial Officer to include file protection due diligence in the Agency’s annual internal control reviews.

The OCIO is reviewing and evaluating additional controls, such as encryption, to protect access to sensitive data and PII. As these improved security protection solutions are deployed, notices will be issued to ensure that all Agency employees and contractors are taking the steps necessary to safeguard this kind of Agency data.

If your office has existing policies for end-user computing in force, it is recommended that intra-office notices are issued enforcing end-user level protection as required by this notice. Guidance for developing office procedures are attached along with a sample Data Extract Log Sheet.

· End-users should be advised to develop a system to track passwords since losing or forgetting a password will result in data loss. (Reference SOP 90-47-2 for guidance regarding the establishment of good passwords.

As defined by OMB, sensitive information is data requiring protection due to the risk or magnitude of loss or harm that could result from its inadvertent or deliberate disclosure, modification, or destruction. Examples of sensitive information include information protected by the Privacy Act of 1974, and the Trade Secrets Act.

PII is any information about an individual maintained by an agency that can be used to distinguish or trace an individual's identity, such as name, social security number, date and place of birth, mother's maiden name, biometric records, financial information, health or medical condition or any other personal information which is linked or linkable to an individual.

If you require additional information, please contact Joyce Lewis at (202) 205-6318 or Charles McClam, Deputy Chief Information Officer at (202) 205-6708.

Christine H. Liu

Chief Information Officer and Chief Privacy Officer

Attachment

EXPIRES:

10/1/2008 SBA Form 1353.3 (4-93) MS Word Edition; previous editions obsolete

Must be accompanied by SBA Form 58

Federal Recycling Program Printed on Recycled Paper

EXPIRES:

SBA Form 1353.3 (4-93) MS Word Edition; previous editions obsolete

Must be accompanied by SBA Form 58

Federal Recyling Program Printed on Recycled Paper

EXPIRES:

SBA Form 1353.3 (4-93) MS Word Edition; previous editions obsolete

Must be accompanied by SBA Form 58

Federal Recyling Program Printed on Recycled Paper

_1222156939.doc