OMB: Report all breaches within an hour

OMB memo on reporting information breaches

Related Links

Agencies must now report even suspected breaches of personal information within one hour of discovery, according to an Office of Management and Budget policy memo.

The memo revises a policy that set various reporting deadlines based on the incident.

OMB wants agencies to “not distinguish between suspected and confirmed breaches,” the memo states.

In the memo, Karen Evans, administrator for e-government and information technology at OMB, also reminded agencies that they should include security and privacy requirements with fiscal 2008budget requests for IT investments.

Several agencies have struggled with breaches of personal information.

A thief stole a Department of Veterans Affairs laptop computer and its hard drive May 3. They contained the sensitive information of more than 26 million veterans and military employees.

VA Secretary Jim Nicholson told the House Veterans’ Affairs Committee June 28 that the FBI had recovered the computer, which is undergoing forensic investigations.

The FBI said it appears that the thief did not access or compromise the data.

The loss created a firestorm of problems for the department. It and other breaches into agencies’ sensitive information caused OMB to adjust policies to guard private information.


  • FCW Perspectives
    zero trust network

    Why zero trust is having a moment

    Improved technologies and growing threats have agencies actively pursuing dynamic and context-driven security.

  • Workforce
    online collaboration (elenabsl/

    Federal employee job satisfaction climbed during pandemic

    The survey documents the rapid change to teleworking postures in government under the COVID-19 pandemic.

Stay Connected