All Federal public websites must comply with Section 207(f)(1)(b)(iv) of the p. Security Protocols to E–Gov Act of 2002, which requires organizations to have security protocols Protect to protect information. Information Under the References: Government Act of 2002 Continued on next page 1. Federal Requirements, Continued q. OMB Promulgated May 22, 2007, this directive renewed emphasis on fair Memorandum information principles of data minimization, data quality and transparency. 07-16, As part of the work of the Identity Theft Task Force, this memorandum Safeguarding requires agencies to develop and implement a breach-notification policy Against and within 120 days. Breaches subject to notification requirements include both Responding to electronic systems as well as paper documents. In short, agencies are required the Breach of to report on the security of information systems in any formant (e.g., paper, Personally electronic, etc.) Identifiable Information Agencies were also required to: (2007) Review holdings of identifying information for accuracy, relevance, timeliness and completeness; Reduce the collection and use of social security numbers (SSNs), developing a plan to eliminate unnecessary SSNs in collections; Participate in government-wide efforts to explore alternatives to agency use of Social Security Numbers as a personal identifier for both Federal employees and in Federal programs (e.g., surveys, data calls, etc.); Adhere to five requirements derived from existing security policy and NIST guidance: Encrypt, using only NIST certified cryptographic modules, Encryption.
p. Security Protocols to Protect Information Under the Act of 2002 All Federal public websites must comply with Section 207(f)(1)(b)(iv) of the E–Gov Act of 2002, which requires organizations to have security protocols to protect information. References: Continued on next page 1. Federal Requirements, Continued q. OMB Memorandum 07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information (2007) Promulgated May 22, 2007, this directive renewed emphasis on fair information principles of data minimization, data quality and transparency. As part of the work of the Identity Theft Task Force, this memorandum requires agencies to develop and implement a breach-notification policy within 120 days. Breaches subject to notification requirements include both electronic systems as well as paper documents. In short, agencies are required to report on the security of information systems in any formant (e.g., paper, electronic, etc.) Agencies were also required to: Review holdings of identifying information for accuracy, relevance, timeliness and completeness; Reduce the collection and use of social security numbers (SSNs), developing a plan to eliminate unnecessary SSNs in collections; Participate in government-wide efforts to explore alternatives to agency use of Social Security Numbers as a personal identifier for both Federal employees and in Federal programs (e.g., surveys, data calls, etc.); Adhere to five requirements derived from existing security policy and NIST guidance: Encryption. Encrypt, using only NIST certified cryptographic modules, Government