Appendix A - Breach Response and Notification Assessment Checklist Breach Response Requirement or Element SIMM 5340-C Yes No Notes/Comments Reference 6.3.1. The information is in the physical possession and control of p.9 an unauthorized person, such as a misdirected, lost, or stolen hardcopy document, or file containing notice-triggering information. p.9 6.3.2. The information has been viewed, acquired, or copied by an unauthorized person, or a person exceeding the limits of their authorized access. 6.3.3. The information was used by an unauthorized person, such p.9 as instances of identity theft reported or fraudulent accounts opened. 7. Timeliness of Notification p.9 7.1. Notification can be sent within ten (10) days from the date p.10 data acquisition has been determined. 7.2. Notification must be delayed due to legitimate needs of p.10 law enforcement. 7.3. Notification must be delayed to determine scope of breach. p.10 7.4. Notification must be delayed to restore system to reasonable integrity. p.10 7.5. Delay will or may exacerbate the risk of harm to individuals. p.10 7.6. Agency head (or the senior-level individual designated in writing p.10 by the agency head as having authority to act on his/her behalf) has authorized the delay of notification. 8. Source of Notification p. 10 p. 10 8.1. Agency head (or the senior-level individual designated in writing by the agency head as having authority to act on his/her behalf) will sign the notice. 8.2. The notice is addressed by the entity in which the recipient has p. 10 a relationship. 8.2. The notice is addressed by an entity in which the recipient has p. 10 no direct relationship, but the relationship is explained sufficiently in the notice. 9. Format of Notice p. 11 p. 11 9.1. The notice shall be designed to call attention to the nature and significance of the information it contains, and shall be formatted on official letterhead to include: 9.2. No smaller than 10-point Ariel font type; p. 11
Appendix A - Breach Response and Notification Assessment Checklist Breach Response Requirement or Element SIMM 5340-C Reference Yes No Notes/Comments 6.3.1. The information is in the physical possession and control of an unauthorized person, such as a misdirected, lost, or stolen hardcopy document, or file containing notice-triggering information. p.9 6.3.2. The information has been viewed, acquired, or copied by an unauthorized person, or a person exceeding the limits of their authorized access. p.9 6.3.3. The information was used by an unauthorized person, such as instances of identity theft reported or fraudulent accounts opened. p.9 7. Timeliness of Notification p.9 7.1. Notification can be sent within ten (10) days from the date data acquisition has been determined. p.10 7.2. Notification must be delayed due to legitimate needs of law enforcement. p.10 7.3. Notification must be delayed to determine scope of breach. p.10 7.4. Notification must be delayed to restore system to reasonable integrity. p.10 7.5. Delay will or may exacerbate the risk of harm to individuals. p.10 7.6. Agency head (or the senior-level individual designated in writing by the agency head as having authority to act on his/her behalf) has authorized the delay of notification. p.10 8. Source of Notification p. 10 8.1. Agency head (or the senior-level individual designated in writing by the agency head as having authority to act on his/her behalf) will sign the notice. p. 10 8.2. The notice is addressed by the entity in which the recipient has a relationship. p. 10 8.2. The notice is addressed by an entity in which the recipient has no direct relationship, but the relationship is explained sufficiently in the notice. p. 10 9. Format of Notice p. 11 9.1. The notice shall be designed to call attention to the nature and significance of the information it contains, and shall be formatted on official letterhead to include: p. 11 9.2. No smaller than 10-point Ariel font type; p. 11