Key Sections All sections identified below are required at a minimum for a Personal and Confidential Information Management Plan. This plan does not supercede or replace existing policies or guidance from any level of the Government. In the event this form and existing policy or guidance conflict, the latter source should prevail. You must consult, apply and understand the applicable policy and expectations for managing the data that is in scope for your project. # Criteria Description Provide an overview of why sensitive information is required in the project. Overview Inlcude any details regarding personal and confidential information data 1 and associated risks to be addressed. Provide a list of all types of sensitive data, their definitions and how / Access to where the information is required in the project. In addition, outline why Confidential 2 access to sensitive data is needed on the project and identify the nature of Information access. Identify the physical locations where project team members are working Physical and / or where information may be stored. Provide a description of the 3 Safeguards physical safeguards that are in place at each location to protect sensitive data. Administrative safeguards are internal organizational controls to provide a measure of security for sensitive data. These may include designated Administrative sensitive data management and security roles, contract terms, sensitive 4 Safeguards data onboarding and training, risk mitigation guidelines, and violation reporting processes, etc. Administrative safeguards should be comprehensive and address the full lifecycle of the engagement. Specify what technical safeguards are in place for the data while in storage or when being used. Technical Provide details regarding the specific technical safeguards that are in 5 Safeguards place to limit collection or access to data. Address the specific requirements pertaining to data transfer, data sharing, data destruction and data retention. Incidents and Specify the requirements for reporting an incident, potential breach, or 6 Response disclosure of sensitive data. Access Control This section can be used for tracking access to production areas and 7 systems including both how access is granted as well as removed. List ---- END DOCUMENT ----
Key Sections All sections identified below are required at a minimum for a Personal and Confidential Information Management Plan. This plan does not supercede or replace existing policies or guidance from any level of the Government. In the event this form and existing policy or guidance conflict, the latter source should prevail. You must consult, apply and understand the applicable policy and expectations for managing the data that is in scope for your project. # Criteria Description 1 Overview Provide an overview of why sensitive information is required in the project. Inlcude any details regarding personal and confidential information data and associated risks to be addressed. 2 Access to Confidential Information Provide a list of all types of sensitive data, their definitions and how / where the information is required in the project. In addition, outline why access to sensitive data is needed on the project and identify the nature of access. 3 Physical Safeguards Identify the physical locations where project team members are working and / or where information may be stored. Provide a description of the physical safeguards that are in place at each location to protect sensitive data. 4 Administrative Safeguards Administrative safeguards are internal organizational controls to provide a measure of security for sensitive data. These may include designated sensitive data management and security roles, contract terms, sensitive data onboarding and training, risk mitigation guidelines, and violation reporting processes, etc. Administrative safeguards should be comprehensive and address the full lifecycle of the engagement. 5 Technical Safeguards Specify what technical safeguards are in place for the data while in storage or when being used. Provide details regarding the specific technical safeguards that are in place to limit collection or access to data. Address the specific requirements pertaining to data transfer, data sharing, data destruction and data retention. 6 Incidents and Response Specify the requirements for reporting an incident, potential breach, or disclosure of sensitive data. 7 Access Control List This section can be used for tracking access to production areas and systems including both how access is granted as well as removed. ---- END DOCUMENT ----
13-ocio-confidentialinfomanagementplanchecklist.docx