OMB: Report all breaches within an hour

OMB memo on reporting information breaches

Related Links

Agencies must now report even suspected breaches of personal information within one hour of discovery, according to an Office of Management and Budget policy memo.

The memo revises a policy that set various reporting deadlines based on the incident.

OMB wants agencies to “not distinguish between suspected and confirmed breaches,” the memo states.

In the memo, Karen Evans, administrator for e-government and information technology at OMB, also reminded agencies that they should include security and privacy requirements with fiscal 2008budget requests for IT investments.

Several agencies have struggled with breaches of personal information.

A thief stole a Department of Veterans Affairs laptop computer and its hard drive May 3. They contained the sensitive information of more than 26 million veterans and military employees.

VA Secretary Jim Nicholson told the House Veterans’ Affairs Committee June 28 that the FBI had recovered the computer, which is undergoing forensic investigations.

The FBI said it appears that the thief did not access or compromise the data.

The loss created a firestorm of problems for the department. It and other breaches into agencies’ sensitive information caused OMB to adjust policies to guard private information.


  • Defense
    concept image of radio communication (DARPA)

    What to look for in DOD's coming spectrum strategy

    Interoperability, integration and JADC2 are likely to figure into an updated electromagnetic spectrum strategy expected soon from the Department of Defense.

  • FCW Perspectives
    data funnel (anttoniart/

    Real-world data management

    The pandemic has put new demands on data teams, but old obstacles are still hindering agency efforts.

Stay Connected