SOP 90 50-ModAtt.pdf

SOP 90 50

BREACH NOTIFICATION

RESPONSE PLAN

Office of the Chief Information Officer/ Chief Privacy Officer

U.S. Small Business Administration http://www.sba.gov/index.html

SMALL BUSINESS ADMINISTRATION

STANDARD OPERATING PROCEDURE

SUBJECT: S.O.P. REV

Breach Notification Response Plan

SECTION

NO.

INTRODUCTION

1. Purpose: To establish guidelines and procedures for SBA’s Management of Data Breaches.

2. Personnel Concerned: All SBA employees, contractors, and other users who use automated information systems.

3. Originator: Office of the Chief Information Officer/Chief Privacy Officer

AUTHORIZED BY:

Christine H. Liu Chief Information Officer

EFFECTIVE DATE

July 29, 2008

PAGE

SBA Form 989 (5-90) Ref: SOP 00

Federal Recycling Program Printed on Recycled Paper

Table of Contents

1. Purpose…………………………………………………………………………………..3

2. Scope ……………………………………….…………………………………………..3

3. Definitions………………………………………………………………………………3

4. Assumptions………………………………………………………………………….….6

5. The SBA Executive Response Team……………………………………….……….…..6

6. Program Office Notification Process……………………………………………………7

7. Risk-Based Decision ………….…………………………………………………….…..7

8. Incident Reporting and Handling………………………………………………………..8

9. Rules of Behavior and Consequences………………………………………………….13

Appendix A. Levels of Impact …………………………..……………………………

Appendix B. Mitigation Strategies ………………..……………..…………………….…15

Appendix C. Sample Notification Letter …………..……………..………………………17

Appendix D. References………………………………..…………………………………18

Figures 8.1………………………………………………………………………………….9

Effective Date: July 29, 2008

Effective Date: July 29, 2008 3

1. Purpose

This plan outlines the Small Business Administration’s (SBA) agency-wide policy for management of data breaches, particularly loss of personally identifiable information (PII), as defined in the Office of Management and Budget (OMB) in Memorandum M-07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information. In the directive, OMB states “Given the volume of personal information appropriately collected to carry out a myriad of government functions, it is almost inevitable that some agencies will, on occasion, lose control of such information.” The SBA is prepared for such losses and will respond accordingly to protect any affected individuals or businesses. This document also addresses the detection and reporting of such incidents, the assessment of the risk, the proper escalation to upper-level management, and the appropriate notification and remedy options.

2. Scope

2.1 The scope of this policy includes electronic, paper and manual processes and systems surrounding the management of PII collected by the SBA, and any future breach incidents. The plan was derived from OMB guidance and other regulatory requirements for responding to intentional or inadvertent information security incidents affecting the loss or compromise of any PII in the control of the SBA.

2.2 This plan includes PII and Sensitive Information, defined in section 3 below, and is applicable to anyone dealing with a data breach incident, including

a. SBA Executive Response Team;

b. SBA Computer Emergency Response Team (CERT) OCIO staff; and

c. SBA employees and contractors with access to PII.

3. Definitions

3.1 Authorized User – An employee, contractor or volunteer of the SBA, in a role that requires access to a computer system or network, who has been granted formally, specific permission to access that system, based on the credentials required for the role.

3.2 Data Breach – The loss of control, compromise, unauthorized disclosure, unauthorized acquisition, unauthorized access, or any similar term referring to situations where persons other than authorized users and for other than authorized purposes have access or potential access to personally identifiable information, whether physical, hard copy, or electronic.

http://www.dhs.gov/xlibrary/assets/privacy/privacy_attachment6_OMB07-16.pdf http://www.dhs.gov/xlibrary/assets/privacy/privacy_attachment6_OMB07-16.pdf

Effective Date: July 29, 2008 4

3.3 Event – An occurrence, not yet assessed, that may affect data or the performance of an information system or the operations of the agency.

3.4 Identity Theft – The act of obtaining an individual’s identifying information without authorization in an attempt to commit or facilitate the commission of fraud or other crimes. Typical identity theft includes:

a. Accessing existing bank, investment, or credit accounts using information associated with the individual;

b. Withdrawing or borrowing money from existing accounts or charging purchases to the accounts;

c. Opening new accounts with an individual’s PII without that individual’s knowledge; and

d. Obtaining driver’s licenses, social security cards, passports, or other identification documents using the stolen identity.

3.5 Personally Identifiable Information (PII) – Information which can be used to distinguish or trace an individual’s identity, such as name, social security number (SSN), biometric records, or other defining data points, used alone, or when combined with other personal or identifying information which is linked or linkable to a specific individual, such as date and place of birth, mother’s maiden name, etc.

a. While the list below is not inclusive, these are examples of PII:

(1) Social security number

(2) Date and place of birth

(3) Mother’s maiden name

(4) Home and email address

(5) Phone number

(6) Biometric Number

(7) Financial transaction/account

(8) Medical History

(9) Criminal or employment history

(10) Education

b. Information that is not generally considered personally identifiable is that which many people share, such as:

(1) Individuals’ name, if common (For example: Smith or Brown);

(2) Country, state, or city of residence;

(3) Age, especially if non-specific;

(4) Gender or race;

(5) Name of the school attended or the workplace; and

(6) Salary, grades, or job position.

c. Sometimes multiple pieces of information, none of which are PII, may uniquely identify a person when brought together, for example: an

Effective Date: July 29, 2008 5 individual’s name and position.

3.6 Privacy Working Group (PWG) – A cross-discipline group of privacy subject matter experts from SBA Offices, who contribute specific expertise to the Agency’s privacy policy and include recommendations for breach plans. The PWG members include the Office of the Inspector General, Office of Hearings and Appeals, Office of the Chief Human Management, Office of General Counsel, and the Office of the Chief Information Officer/Chief Privacy Officer.

3.7 Security Incident – An event determined to be a deliberate or accidental subversion of the confidentiality, integrity, or availability of information. An attempted or achieved unauthorized entry and/or information attack on an SBA system or network.

a. For a more complete description of computer security incidents, refer to the National Institute of Standards and Technology (NIST) Special Publication 800-61, Computer Security Incident Handling Guide.

3.8 Sensitive Information – information, the loss, misuse, or modification of which, or unauthorized access to, could affect the national interest, law enforcement activities, the conduct of Federal programs, or the privacy to which individuals are entitled under Section 552a of Title 5, U.S. Code, but that has not been specifically authorized under criteria established by an Executive Order or an act of Congress to be kept classified in the interest of national defense or foreign policy.

a. Typical SBA Sensitive Information includes:

(1) Financial institution examinations or oversight reports;

(2) SBA’s internal rules and practices that are not releasable to the public;

(3) Personnel data to include evaluations, assignments (but not salary or grade); and

(4) Records pertaining to contractual proposals and awards, particularly financial or performance data.

b. Some Data (IP addresses, information system and vulnerability assessment data) may be considered sensitive.

3.9 Significant PII Loss – A data breach event of PII information serious enough to warrant involvement of the SBA Chief Information Officer (CIO)/Chief Privacy Officer (CPO), and/or the SBA Administrator, as determined by the Chief Information Security Officer (CISO). Significant loss is characterized by the following:

a. Amount of data lost;

b. Type of data lost; and

c. Links between the data.

http://csrc.nist.gov/publications/PubsSPs.html

Effective Date: July 29, 2008 6

4. Assumptions

4.1 The event that causes the significant loss of PII is localized to the SBA systems for which the SBA is wholly responsible, or to contractor-owned or contractor-managed systems that contain the SBA’s PII data. It is not a general loss, such as a compromise of a commercial entity affecting a broader group of organizations that includes the SBA.

4.2 Notification to individuals affected by a loss may not occur or may be delayed if national security or law enforcement agencies determine that the notification will impede a criminal investigation. This determination will be made by the SBA Executive Response Team in consultation with the Office of the Inspector General (OIG) and other law enforcement authorities. Likewise, to the extent possible under law, the SBA will ensure that any information associated with an ongoing criminal investigation is not released under the FOIA.

4.3 This policy will comply with all existing security and privacy requirements, including those references in the SBA Standard Operating Procedure (SOP) Automated Information System Security Program, 90 47 2 and Privacy Act Procedures, SOP 40 04 3.

5. The SBA Executive Response Team

5.1 The organizational authority for incident response is the SBA Executive Response Team, who will convene in the event of a significant PII loss or when a significant PII loss may be ongoing. The Executive Response Team will perform risk analysis to determine the extent of the harm posed by the PII loss and manage activities to mitigate the loss.

The SBA Executive Response Team includes:

• Chief Information Officer (CIO)/Chief Privacy Officer (CPO)

• General Counsel (GC);

• Chief Information Security Officer (CISO);

• Chief Human Capital Officer (CHCO);

• Office of Management and Administration (OMA) Associate

Administrator;

• Office of Communications and Public Liaison (OCPL) Associate

Administrator;

• Chief Financial Officer (CFO):

• Senior Advisor to the Chief Privacy Officer;

• Office of Inspector General (Advisor Role); and

• Program Manager from the office that experienced the breach.

The SBA Executive Response Team is supported by the staff members of each of the http://www.sba.gov/tools/resourcelibrary/sops/index.html

Effective Date: July 29, 2008 7 offices represented.

The SBA Executive Response Team should convene at least annually to review these procedures and discuss likely actions should an incident occur.

The Chief Information Officer/Chief Privacy Officer is the lead for these reviews. In addition, the CIO will be responsible for information Technology guidance in responding to a suspected or actual breach, to include identification and of compensating controls to protect data in electronic form.

The OGC will be responsible for providing legal support and guidance in responding to a suspected or actual breach.

The OIG may participate and engage with expertise as each incident is discussed, but does not take a position regarding the course of action ultimately determined by the Executive Response Team.

6. Program Office Notification Process

6.1 Any employee that learns of a data breach involving an actual or potential loss of PII must immediately report that information to his or her immediate supervisor.

6.2 Program managers must be notified of the PII incident within their office and support the investigation, mitigation, and recovery activities as directed by the SBA Executive Response Team, if an investigation is being conducted by the Office of the Inspector General. Program management notification will be directed to:

a. Program offices;

b. Program representatives;

c. Liaison from the SBA CERT OCIO Staff; and

d. Owner of the system from which the loss occurred to include third Party systems.

6.3 The program offices will have a mechanism to alert the appropriate staff about the breach, such as a call tree or e-mail notice. The program office will initially meet on their own to discuss the breach, and with the Executive Response Team, as necessary, to support incident remediation plans or activities.

7. Risk-Based Decision

7.1 The first step in considering potential harm, and whether a response is necessary, is categorizing typical information used to personally identify the SBA’s customers and then determining whether that information has been or potentially was compromised.

Effective Date: July 29, 2008 8

7.2 A loss of control over PII may, but need not necessarily, present a significant risk.

For example, a data report showing “John Smith,” with no further identifying information related to John Smith, will present little risk of harm resulting from the exposure of the information. However, release of financial data for a small business owner could result in identity theft, fraud, or embarrassment to an individual or the Agency.

For example, an SSN alone can identify an individual and lead to identity theft.

Combinations of information can have the same effect. Identity theft becomes possible with a name, address, or telephone number, in combination with:

a. Any government-issued identification number (such as a driver’s license number)

b. A biometric record;

c. A financial account number, together with a PIN or security code; or

d. Any additional, specific factor that adds to the personally identifying profile of a specific individual, such as a relationship with a specific financial institution or membership in a club.

7.3 Even where a significant risk of identity theft exists, other factors should be considered in determining whether the information accessed could result in identity theft, exposure of sensitive SBA information, or other harm. Considering these factors together should permit the SBA to establish potential harm represented by the breach.

The stages of incident reporting and handling for a breach of PII are described below in section 8, Incident Reporting and Handling, including the risk assessment process applied throughout a data breach.

8. Incident Reporting and Handling

8.1 The SBA process to notify stakeholders regarding a PII breach, including a decision-making process to determine if an external notification is warranted, is shown in Figure 8.1. The SBA will continue to meet Federal Information Security Management Act requirements for evaluation, monitoring, and planning for incident handling. The agency will review its existing processes to detect, report, mitigate, and respond to security incidents.

8.2 SBA must comply with the OMB M-06-19, “Reporting Incident Involving Personally Identifiable Information,” and OMB M-07-16. “Safeguarding Against and Responding to the Breach of Personally Identifiable Information”, reporting all incidents involving PII to US-CERT within one hour. This reporting requirement does not distinguish between potential and confirmed breaches. Employees must report potential breaches to OCIO Help Desk or call (202) 205-8300 and notify their immediate supervisor.

The following activities, although described as separate stages, will overlap during a real incident response.

SBA Incident Reporting and Handling

C

PO

/C

IO

C

IS

O U

S- C

ER

T

2. CISO receives notification of potential or actual breach

7. CISO forwards breach information to CIO/CPO

A dm in is tr at or

Internal SBA Process

O C

PL

External Process

Inquiry 1:

Did breach actually occur?

End of Process

2a. CISO notifies US-CERT of potential or actual breach within one hour

2b. US-CERT launches their event response

4. CISO begins initial event assessment

6. US-CERT ends event response

Yes

5. CISO notifies

US-CERT, CIO

and CPO that breach did not occur

No

9. CPO/CIO

notifies

Administrator of breach

8. CIO/CPO

evaluates incident and determines harm level and PII loss

Inquiry 2:

What level of harm can the incident cause?

Med/Low

High

16. CIO/CPO and CISO develop plan to mitigate risk

13. Administrator reviews incident, approves plan

11. PWG

recommends response plan, including specific legal actions

15. OCPL develops a plan to communicate incident information to the media

14. Administrator launches plan, including communication efforts

17. CISO monitors mitigation plan

18. CISO

concludes monitoring plan

START

Ex ec

R es po ns e

Te am

12. Exec team reviews recommendations and determines next steps

10. Sr. Advisor for Privacy convenes Privacy Working

Group (PWG)

3. CISO notifies CIO/CPO of event

Pr og ra m

O ffi ce

1. Program Office reports data breach event

Effective Date: July 29, 2008 9

Figure 8.1

Stage 1: Notification and Reporting

The SBA Program Offices will report any potential or actual breach to the SBA’s CISO, who will coordinate incident management efforts. The CISO will also alert the SBA’s CIO/CPO of potential breach, the Senior Advisor for Privacy. The CISO will, within one hour, report the incident to the US-CERT. The CIO/CPO will alert the Administrator if the level of harm is determined to be High.

Stage 2: Assessment of Event and Risk of Harm

The CISO will assess the event, determine exactly what data, if any, was lost, and, unless the initial breach report is unfounded, notify US-CERT, and the CIO/CPO. The CIO/CPO will evaluate any confirmed breach for loss of PII and determine if any PII was lost and share the results with the CISO.

The CISO and CIO/CPO will assess the potential harm to the SBA, its customers, contractors or vendors based on the specific circumstances of the incident and the:

a. Sensitivity of the data lost;

b. Amount of data lost and number of individuals affected;

c. Likelihood data is usable or may cause harm;

d. Likelihood the data was intentionally targeted;

e. Strength and effectiveness of security technologies protecting data;

f. Nature of the data (operational or personal); and

g. Ability of the agency to mitigate the risk of harm.

The CISO and CIO/CPO will assign an initial impact level of the breach. The levels are High, Moderate and Low in accordance with the NIST guidance. Appendix A defines the impact levels. The CIO/CPO will alert the Administrator of any event that meets the threshold for a significant incident. Any office designated by the President will also be notified.

The Senior Advisor for Privacy will also convene the Privacy Working Group (PWG), as defined in section 3, Definitions, in cases of PII loss. The PWG will examine the situation and make remediation recommendations, particularly surrounding legal issues on behalf of the Agency.

The CISO will also work with the OIG to determine whether further investigation is required by law enforcement and to notify law enforcement authorities as appropriate.

Stage 3: Notification Planning

Effective Date: July 29, 2008 10

The SBA Executive Response Team will review and assess the details of the incident and make a final determination regarding the appropriate course of action, including the level of notification required to affected individuals, the resources needed, and any appropriate remedy options. The SBA Executive Response Team will also determine whether OMB or Congress, via the Office of Congressional and Legislative Affairs (OCLA), should be notified. The Executive Response Team will defer to the authority of the OIG on matters involving a criminal investigation.

First-class mail will be the primary channel of communication with individuals affected by the breach, except that e-mail will be the primary channel for the SBA’s employees and contractors, as outlined below in, Stage 4: Recovery and Resolution, and Stage 5:

Method of Notification. However, the SBA may determine, based on the level of risk and the circumstances surrounding the incident, to notify individuals affected by the breach by e-mail or individual telephone calls. Mitigation strategies for the SBA and their customers are listed in Appendix B.

Stage 4: Recovery and Resolution

The CISO will move to implement a corrective action plan based on the recommendations of the Senior Advisor for Privacy and the Privacy Working Group. The CISO, as well as other members of the SBA Executive Response Team, must bear in mind the notice of a breach can generate from individuals is not “costless,” a consideration that can be especially important where the risk is low. The costs can include the financial expense and inconvenience that can arise from canceling credit cards, closing bank accounts, placing fraud alerts on credit files, and/or obtaining new identity documents. Moreover, frequent public notices of such incidents may be counterproductive, making it more difficult for citizens to discern the difference between serious and minor threats. Thus, weighing all the facts available, and the risks to citizens caused by the data breach warrant a notice when a notice would facilitate appropriate remedial action that is justified given the risk.

Assuming the SBA Executive Response Team has made the decision to provide notice to those put at risk, the following elements should be incorporated into the notification process.

Timing

The notice should be provided in a timely manner, but without compounding the harm from the initial incident through premature announcement based on incomplete facts or in a manner that may make identity theft more likely to occur as a result of the announcement. SBA will also coordinate notification efforts with law enforcement agencies conducting the investigation of the breach.

Source

Given the serious security and privacy concerns raised by data breaches, notification to individuals affected by the data loss should be issued in writing by the Administrator or by the office that experienced the breach.

Effective Date: July 29, 2008 11

Contents

The substance of the notice should be a stand-alone document, written in clear, concise, and easy-to-understand language. The notice should also be appropriate for distributing to individuals via letters, e-mail; and/or posting on the SBA Website or other agency websites; and all media channels. The notice should include:

a. A brief description of what happened;

b. A description of the PII that was involved in the data breach and whether that information was encrypted or protected by other means (e.g., full name, SSN, date of birth, home address, account numbers, disability code.);

c. A brief description of the investigation of the breach and efforts to mitigate losses and prevent further breaches;

d. Contact procedures and information including a toll-free number, website, and/or postal address to obtain additional information; and

e. Steps individuals should take to protect themselves from the risk of identity theft.

Specific PII affected by the data breach is sensitive and should be treated as such. It should not be e-mailed unencrypted and should be wrapped appropriately when hand-carried. Also, to the extent possible under law, the SBA should ensure that any PII associated with the affected parties is not released under the FOIA.

Given the amount of information needed to give meaningful notice, the SBA shall consider providing the most important information up front, with the additional details in a set of Frequently Asked Questions (FAQ) format on its website. The notice should also be available, with appropriate accommodations, to those who do not speak/read English or who may have a disability. A sample notification letter is attached in Appendix C.

Stage 5: Method of Notification

Notification should occur in a manner calibrated to ensure that the individuals affected receive actual notice of the incident and the steps they should take. According to OMB, first-class mail notification to the last known mailing address of the individual should be the primary means by which the agency provides notification.

Substitute means of notice such as broad public announcement through the media, website announcements, and distribution to public service and other membership organizations likely to have access to the affected individuals, should be employed to supplement direct mail notifications or if the SBA cannot obtain valid mailing addresses.

Media notification should focus on providing information to aid the public in response to the breach.

Effective Date: July 29, 2008 12

E-mail notification can be problematic and is discouraged unless the affected individuals consent to such use in advance. Care should be taken not to solicit information from affected individuals as they could encounter difficulties in distinguishing the Agency’s e-mail from a fraudulent “phishing” e-mail.

The Administrator may also determine that the SBA’s customers would be best served by the widespread notification of the breach, and alert the media. The Office of Communications and Public Liaison will work with the SBA Executive Response Team to develop an appropriate communications and information dissemination plan.

Unauthorized news media is prohibited and could result in disciplinary action.

The SBA should also give special consideration in providing notice to individuals who are visually or hearing impaired consistent with Section 504 of the Rehabilitation Act of 1973. Reasonable accommodations may include establishing a Telecommunications Device for the Deaf (TDD) or posting a large-font notice at www.SBA.gov.

9. Rules of Behavior and Consequences

9.1 The SBA has established rules of behavior that identify consequences and corrective actions for failure to follow the breach notification process. This does not include a breach notification that, upon investigation, is a false alarm. This policy will include the terms and conditions for the individual(s) responsible for the breach, the consequences they may be subject to, as well as an outline for corrective action.

Consequences may include verbal or written reprimand, suspension or removal. The SBA’s first step, in most cases, will be rescinding access rights from individuals who violate the Breach Notification Response Plan.

9.2 The SBA employees are subject to the criminal and civil penalties outlined in the Privacy Act of 1974, which states:

“Any officer or employee of an agency, who by virtue of his employment or official position, has possession of, or access to, agency records which contain individually identifiable information the disclosure of which is prohibited by this section or by rules or regulations established there under, and who knowing that disclosure of the specific material is so prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000.” 5 U.S.C. § 552a(i)(1).

“Any officer or employee of any agency who willfully maintains a system of records without meeting the notice requirements of subsection (e)(4) of this section shall be guilty of a misdemeanor and fined not more than $5,000.” 5 U.S.C. § 552a(i)(2).

“Any person who knowingly and willfully requests or obtains any record concerning an individual from an agency under false pretenses shall be guilty of a misdemeanor and fined not more than $5,000.” 5 U.S.C. § 552a(i)(3).

Effective Date: July 29, 2008 13 http://www.usdoj.gov/oip/04_7_1.html

Appendix A Levels of Impact

You should review and reassess the level of impact you have already assigned to the information using the impact level defined by NIST. There are three impact levels which are used to describe the (worst case) potential impact on an organization or individual if a breach of security occurs:

• LOW: the loss of confidentiality, integrity, or availability is expected to have a limited adverse effect on organizational operations, organizational assets or individuals.

• MODERATE: the loss of confidentiality, integrity, or availability is expected to have a serious adverse effect on an organizational operations, organizational assets or individuals.

• HIGH: the loss of confidentiality, integrity, or availability is expected to have a severe or catastrophic adverse effect on organizational, operations assets or individuals.

The impact levels will help determine when and how notification should be provided.

Where is a range of risk levels attributed to the factors, the decision to provide notification should give greater weight to the likelihood the information is accessible and usable and whether the breach lead to harm.

Effective Date: July 29, 2008 14

Appendix B Mitigation Strategies

1. Mitigation Strategies for the SBA and its Customers

a. If the breach involves individuals’ banking, credit card, or other financial PII, the

SBA will notify the individuals and inform them of steps that they should take to mitigate the risk. Where necessary, the SBA should assist the individuals’ mitigation efforts.

b. If the breach involves a large volume of users, the SBA will consider establishing a

Help Line that allows affected individuals to call in for more information.

c. If the breach of PII has the potential to compromise the physical safety of the individuals involved, the SBA should ensure that the appropriate law enforcement agencies are notified and that the agencies take appropriate protective action.

d. If the breach involves government-authorized credit cards, the SBA will notify the issuing bank promptly. If the breach involves individuals’ bank account numbers to be used for the direct deposit of credit card reimbursements, government employee salaries, or any benefit payment, the SBA will notify the bank or other entity that handles that particular transaction for the agency.

e. The SBA may take two other significant steps that can offer additional measures of protection when a breach involves government-authorized credit cards, but which will involve agency expense. They are

(1) Data Breach Analysis – Using new technology, analyze whether a particular data loss appears to be resulting in identity theft. The SBA may consider using this measure if it is uncertain about whether the identity-theft risk warrants implementing more costly additional steps or if it wishes to do more than rely on individual actions.

(2) Credit Monitoring – In deciding whether to offer credit monitoring services and of what type and length, the SBA should consider the seriousness of the risk of identity theft arising from the data breach. Particularly important are whether identity theft incidents have already been detected and the cost of the service. To assist the timely implementation of either data breach analysis or credit monitoring, the General Services Administration (GSA) is putting in place several government-wide contracting methods to provide these services if needed.

2. Actions that Individuals Can Routinely Take for Mitigating the Risk

Effective Date: July 29, 2008 15

a. Contact their financial institution to determine whether their account(s) should be monitored or closed. This option is relevant only when financial account information is part of the breach.

b. Monitor their financial account statements and immediately report any suspicious or unusual activity to their financial institution.

c. Request a free credit report at www.AnnualCreditReport.com or by calling 1-877- 322-8228. It may take a few months for most signs of fraudulent account activity to appear on the credit report. This option is most useful when the data breach involves information that can be used to open new accounts.

d. Contact the three major credit bureaus and place an initial fraud alert on credit reports maintained by each of the credit bureaus. This option is most useful when the breach includes information that can be used to open a new account, such as SSNs.

e. For residents of states in which state law authorizes a credit freeze, consider placing a credit freeze on their credit file. This option is most useful when the breach includes information that can be used to open a new account, such as SSNs.

f. For deployed members of the military, consider placing an active duty alert on their credit file. This option is most useful when the breach includes information that can be used to open a new account, such as SSNs.

g. Review resources provided on the Federal Trade Commission (FTC) identity theft

Website, www.ftc.gov/idtheft.

h. Complete a Federal Trade Commission ID Threat Affidavit at the above FTC Website. This will allow an individual to legally notify their creditors that their identity has been compromised. Any debts incurred after that date will not be assigned to them.

i. Be aware that the public announcement of the breach could itself cause criminals engaged in fraud to use various techniques to deceive individuals affected by the breach into disclosing their personal information.

Effective Date: July 29, 2008 16 http://www.ftc.gov/idtheft

Appendix C Sample Notification Letter

MODEL LETTER FOR THE

COMPROMISE OF SOCIAL SECURITY NUMBERS

Dear _____________:

We are contacting you about a potential problem involving identity theft.

[Describe the information compromise and how you are responding to it.]

We recommend that you place a fraud alert on your credit file. A fraud alert tells creditors to contact you before they open any new accounts or change your existing accounts. Call any one of the three major credit bureaus. As soon as one credit bureau confirms your fraud alert, the others are notified to place fraud alerts. All three credit reports will be sent to you, free of charge, for your review.

Equifax Experian TransUnionCorp

800-525-6285 888-397-3742 800-680-7289

Even if you do not find any suspicious activity on your initial credit reports, the Federal Trade Commission (FTC) recommends that you check your credit reports periodically.

Victim information sometimes is held for use or shared among a group of thieves at different times. Checking your credit reports periodically can help you spot problems and address them quickly.

If you find suspicious activity on your credit reports or have reason to believe your information is being misused, call [insert contact information for law enforcement] and file a police report. Get a copy of the report; many creditors want the information it contains to absolve you of the fraudulent debts. You also should file a complaint with the FTC at www.ftc.gov/idtheft or at 1-877-ID-THEFT (877-438-4338). Your complaint will be added to the FTC’s Identity Theft Data Clearinghouse, where it will be accessible to law enforcers for their investigations.

We have enclosed a copy of Take Charge: Fighting Back Against Identity Theft, a comprehensive guide from the FTC to help you guard against and deal with identity theft.

[Insert closing] Your Name

Effective Date: July 29, 2008 17 http://www.ftc.gov/idtheft http://www.ftc.gov/bcp/edu/pubs/consumer/idtheft/idt04.htm

Appendix D References

1. OMB Memorandum regarding “Recommendations for Identify Theft

Related Data Breach Notification,” issued on September 20, 2006.

The OMB Memorandum is available at:

http://www.whitehouse.gov/omb/memoranda/fy2006/task_force_thef_ memo.pdf.

2. OMB Memorandum regarding “Protection of Sensitive Agency

Information,” issued June 23, 2006. The OMB Memorandum is available at:

http://www.whitehouse.gov/omb/memoranda/fy2006/m06-16.pdf.

3. OMB Memorandum regarding “ Reporting Incident Involving

Personally Identifiable Information,” issued July 12, 2006. The OMB Memorandum is available at:

http://www.whitehouse.gov/omb/memoranda/fy2006/m06-19.pdf.

4. OMB Memorandum regarding “Safeguarding Against and Responding to the Breach of Personally Identifiable Information,” issued on May 22, 2007. The OMB Memorandum is available at:

http://www.whitehouse.gov/omb/memoranda/fy2007/m07-16.pdf.

5. Standard Operating Procedure (SOP) 90 47 “Automated Information

Systems Security Program,” issued July 20, 2005.

6. Standard Operating Procedure (SOP) 40 04 3 “Privacy Act

Procedures,” issued June 23, 2004.

7. Privacy Act of 1974, Public Law No. 93-579, and amended Computer Matching and Privacy Protection Act of 1988, Public Law 100-503.

8. Freedom of Information Act (FOIA), Public Law No. 85-619, July 4, 1966.

9. The National Institute of Standards and Technology (NIST) Special Publication 800-61, “Computer Security Incident Handling Guide,” issued January 2004. This guide is available at:

http://csrc.nist.gov/publications/nistpubs/800-61/sp800-61.pdf.

Effective Date: July 29, 2008 18 http://www.whitehouse.gov/omb/memoranda/fy2006/task_force_thef_memo.pdf http://www.whitehouse.gov/omb/memoranda/fy2006/task_force_thef_memo.pdf http://www.whitehouse.gov/omb/memoranda/fy2006/m06-16.pdf http://www.whitehouse.gov/omb/memoranda/fy2006/m06-19.pdf http://www.whitehouse.gov/omb/memoranda/fy2007/m07-16.pdf