The reasons for the use or disclosure; and Whether the harm can be mitigated. 3.15 Complete Mitigation Plan of Action and External Notification Following the assessment of the breach incident, the mitigation plan of action and external notification should be completed as determined appropriate by the BITTF based on the nature of the incident. Section 4.0 of this Strategy, Breach “External Notification,” details the external breach notification policy for incidents involving PII and may be consulted for further information. Note that the Director of Public Affairs, or designee, is responsible for directing all meetings and discussions with the news media and the public, in coordination with the BITTF and/or Interior ITTF. In the absence of Public Affairs representative, the responsibility reverts to the Deputy Secretary. 3.16 Review Lessons Learned The step in incident response activities is for the ITTF to perform an assessment of learned” and to consider whether modifications to the Privacy Loss Mitigation “lessons Strategy or incident handling procedures are warranted. and ITTF should notify Bureau/Office Information Reduction Teams in cases where PII collections involved in an incident might be reduced. 4.0 External Breach Notification Once the is notified that there is a breach of PII, persons affected by the breach will be notified by the Agency Head or senior-level personnel he/she may designate in writing without unreasonable delay, but no later than ten (10) business days after the determination is made. When the breach involves a Federal contractor or a public-private partnership operating a system of records on behalf of the agency, the agency is responsible for ensuring that any notification and corrective actions are taken. 4.1 External Notification Determining Factors The need for providing an external notification of a breach to impacted individuals should be assessed on a case by case basis. There are six elements which should be considered in determining if external notification is necessary: Whether the breach notification is required; Timeliness of the notification; Source of the notification; Contents of the notification; Means of providing the notification; and
The reasons for the use or disclosure; and Whether the harm can be mitigated. 3.15 Complete Mitigation Plan of Action and External Notification Following the assessment of the breach incident, the mitigation plan of action and external notification should be completed as determined appropriate by the BITTF based on the nature of the incident. Section 4.0 of this Strategy, “External Breach Notification,” details the external breach notification policy for incidents involving PII and may be consulted for further information. Note that the Director of Public Affairs, or designee, is responsible for directing all meetings and discussions with the news media and the public, in coordination with the BITTF and/or Interior ITTF. In the absence of Public Affairs representative, the responsibility reverts to the Deputy Secretary. 3.16 Review Lessons Learned The step in incident response activities is for the ITTF to perform an assessment of “lessons learned” and to consider whether modifications to the Privacy Loss Mitigation Strategy or incident handling procedures are warranted. and ITTF should notify Bureau/Office Information Reduction Teams in cases where PII collections involved in an incident might be reduced. 4.0 External Breach Notification Once the is notified that there is a breach of PII, persons affected by the breach will be notified by the Agency Head or senior-level personnel he/she may designate in writing without unreasonable delay, but no later than ten (10) business days after the determination is made. When the breach involves a Federal contractor or a public-private partnership operating a system of records on behalf of the agency, the agency is responsible for ensuring that any notification and corrective actions are taken. 4.1 External Notification Determining Factors The need for providing an external notification of a breach to impacted individuals should be assessed on a case by case basis. There are six elements which should be considered in determining if external notification is necessary: Whether the breach notification is required; Timeliness of the notification; Source of the notification; Contents of the notification; Means of providing the notification; and