all data on mobile computers/devices carrying agency data unless the data is determined not to be sensitive, in writing, by your Deputy Secretary or a senior-level individual he/she may designate in writing; Allow remote access only with two-factor Control Remote Access. authentication where one of the factors is provided by a device separate from the computer gaining access; Use a for remote access and Time-Out Function. “time-out” function mobile devices requiring user re-authentication after thirty minutes of inactivity; Log all computer-readable data extracts from databases Log and Verify. holding sensitive information and verify each extract, including whether sensitive data has been erased within 90 days or its use is still required; and Continued on next page 1. Federal Requirements, Continued q. OMB Ensure all individuals with Ensure Understanding of Responsibilities. Memorandum authorized access to personally identifiable information and their 07-16, supervisors sign at least annually a document clearly describing their Safeguarding responsibilities; Against and Implement a correction process for problematic holdings; Responding to Reduce data in systems to minimum necessary for proper performance of the Breach of the documented agency function ; and Personally Develop policy to ascertain data quality at point of decision-making Identifiable Information (2007) Reference: (continued) r. Open The Office of Management and Budget (OMB) issued the Open Directive (OGD) on December 8, 2009. Directive: Guidance for Each agency is required to create a webpage at http://www.[agency].gov/open Agency Web to serve as a gateway to activities related to the Directive. This document and New Media serves as a guideline for the content, format and function of those web pages, Teams (2009) thereby ensuring a consistent user experience across agency sites. Agencies were required to publish their Open Plans on their gov/open web pages. References:
all data on mobile computers/devices carrying agency data unless the data is determined not to be sensitive, in writing, by your Deputy Secretary or a senior-level individual he/she may designate in writing; Control Remote Access. Allow remote access only with two-factor authentication where one of the factors is provided by a device separate from the computer gaining access; Time-Out Function. Use a “time-out” function for remote access and mobile devices requiring user re-authentication after thirty minutes of inactivity; Log and Verify. Log all computer-readable data extracts from databases holding sensitive information and verify each extract, including whether sensitive data has been erased within 90 days or its use is still required; and Continued on next page 1. Federal Requirements, Continued q. OMB Memorandum 07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information (2007) (continued) Ensure Understanding of Responsibilities. Ensure all individuals with authorized access to personally identifiable information and their supervisors sign at least annually a document clearly describing their responsibilities; Implement a correction process for problematic holdings; Reduce data in systems to minimum necessary for proper performance of the documented agency function ; and Develop policy to ascertain data quality at point of decision-making Reference: r. Open Directive: Guidance for Agency Web and New Media Teams (2009) The Office of Management and Budget (OMB) issued the Open Directive (OGD) on December 8, 2009. Each agency is required to create a webpage at http://www.[agency].gov/open to serve as a gateway to activities related to the Directive. This document serves as a guideline for the content, format and function of those web pages, thereby ensuring a consistent user experience across agency sites. Agencies were required to publish their Open Plans on their gov/open web pages. References: