Attachment 3.doc

SSA-RFP-12-1052

Attachment 3

Attachment 3 – Worksheet for Reporting the Loss, Compromise, or Potential Compromise of Personally Identifiable Information

Contractor and Subcontractor Employees: See last page of this attachment for instructions on completing this worksheet.

1. My primary SSA contact for reporting the loss, compromise, or potential compromise of PII is:

The alternates to this primary contact are as follows:

First Alternate:

2. Information about the individual making the report to SSA’s Network Customer Service Center (NCSC):

Name:

Position:

Phone Numbers:

Work:

Cell:

Home/Other:

E-mail Address:

Check one of the following:

Management Official

Security Officer

Non-Management

Additional Information (to be provided when a contractor or subcontractor employee is reporting directly to the NCSC):

*Contractor/Subcontractor (circle as appropriate):

**SSA Contract Number (if known):

3. Information about the data that was lost/stolen:

Describe what was lost or stolen (e.g., case file, MBR (Master Beneficiary Record) data):

Which element(s) of PII did the data contain?

Name

Bank Account Info

SSN

Medical/Health Information

Date of Birth

Benefit Payment Info

Place of Birth

Mother’s Maiden Name

Address

Other (describe):

Estimated volume of records involved:

4. How was the data physically stored, packaged and/or contained?

Paper or Electronic? (circle one):

If Electronic, what type of device?

Laptop

Tablet

Backup Tape

Blackberry

Workstation

Server

CD/DVD

Blackberry Phone #

Hard Drive

Floppy Disk

USB Drive

Other (describe):

Additional Questions if Electronic:

a. Was the device encrypted?

b. Was the device password protected?

c. If a laptop or tablet, was a VPN SmartCard lost?

Cardholder’s Name:

Cardholder’s SSA logon PIN:

Hardware Make/Model:

Hardware Serial Number:

Additional Questions if Paper:

a. Was the information in a locked briefcase?

b. Was the information in a locked cabinet or drawer?

c. Was the information in a locked vehicle trunk?

d. Was the information redacted?

e. Other circumstances:

5. If the employee/Contractor/subcontractor who was in possession of the data or to whom the data was assigned is not the person making the report to the NCSC (as listed in #1), information about this employee/Contractor/subcontractor:

Name:

Position:

Phone Numbers:

Work:

Cell:

Home/Other:

E-mail Address:

Additional Information (to be provided when person who was in possession of the data or assigned to the data is a Contractor/subcontractor employee):

*Contractor/Subcontractor (circle as appropriate):

**SSA Contract Number (if known):

6. Circumstances of the loss:

a.

When was it lost/stolen?

b.

Brief description of how the loss/theft occurred:

c.

When was it reported to SSA management official (date and time)?

7. Have any other SSA components been contacted? If so, who? (Include deputy commissioner level, agency level, regional/associate level component names)

8. Which reports have been filed? (include FPS, local police, and SSA reports)

Federal Protective Service

Local Police

SSA-3114 (Incident Alert) -- Not Applicable for Contractors or Subcontractors

SSA-342 (Report of Survey) -- Not Applicable for Contractors or Subcontractors

Other (describe)

INSTRUCTIONS (to the Contractor/Subcontractor Employee): Worksheet for Reporting Loss or Potential Loss of Personally Identifiable Information

1. If you are reporting the incident to the primaary SSA contact, only complete Items 3 through 6. Special notes regarding Item 5:

· For “Position,” write “Contractor Employee” or “Subcontractor Employee,” as applicable, followed by a hyphen and your job title under the contract.

· With respect to Deputy Commissioner Level Organization, this should be the SSA Contracting Officer’s Technical Representative (COTR)’s Deputy Commissioner Office and should already be provided on the form. If it is not (and you do not know this), have your primary or alternate contact, as applicable, complete the information.

· Be sure to provide the additional information regarding your company/organization’s name and, if known, the Agency-assigned contract number.

2. If you are reporting the incident directly to the NCSC, complete all items to the extent possible (note: Item 4 will be “not applicable”). Special notes regarding Item 2:

· For “Position,” write “Contractor Employee” or “Subcontractor Employee,” as applicable, followed by a hyphen and your job title under the contract.

· With respect to Deputy Commissioner Level Organization, this should be the SSA COTR’s Deputy Commissioner Office and should already be provided on the form. If it is not and you do not know this information, try to identify the name of the main program office which the contract is servicing (e.g., Office of Telecommunications and Systems Operations).

· Be sure to provide the additional information regarding your company/organization’s name and, if known, the Agency-assigned contract number.