Privacy, IT officers come together to create policy

The Bush administration’s effort to improve how agencies protect personally identifiable information and report breaches has pushed federal privacy and information technology officers to work together, according to federal privacy and data security executives.

A May 22 Office of Management and Budget memorandum expanded on the 2002 Federal Information Security Management Act and the 1974 Privacy Act to require agencies to develop and implement a breach notification policy in 120 days. The directive also requires agencies to review the amount of personal data they store and work to decrease it. Working to draft a plan has brought privacy and IT officers together, said Toby Levin, senior adviser to the Homeland Security Department’s Privacy Office. The policy was due last week.

“We have found the efforts to implement it a good vehicle for meshing [the IT and privacy office’s] roles together,” she said. “I think they quickly saw that most IT incidents involve [personally identifiable information], so there is a natural synergy between our programs and missions.”

Agencies must encrypt sensitive data on mobile devices by using only National Institute of Standards and Technology standards, use two-factor identification to control remote access, block remote devices from access after 30 minutes without activity, and log and verify all data extracts. Also, employees with access to personally identifiable information must sign a statement at least once a year stating that they understand their responsibilities.

OMB also requires that all data breaches be reported to the U.S. Computer Emergency Readiness Team within an hour of discovery, but it is up to the agency to notify affected individuals or the media.

Concerns about how to protect employees’ private data have underscored the importance and challenges associated with the relationship between chief privacy and chief information officers, said Marc Groman, the Federal Trade Commission’s chief privacy officer. Groman and Levin spoke on the same panel Sept 25 at an American Society of Access Professionals conference on privacy issues.

“I think there is possibly no more important relationship than the relationship between the chief privacy officer and the chief information officer,” Groman said.

About the Author

Ben Bain is a reporter for Federal Computer Week.

Featured

  • FCW Perspectives
    human machine interface

    Your agency isn’t ready for AI

    To truly take advantage, government must retool both its data and its infrastructure.

  • Cybersecurity
    secure network (bluebay/Shutterstock.com)

    Federal CISO floats potential for new supply chain regs

    The federal government's top IT security chief and canvassed industry for feedback on how to shape new rules of the road for federal acquisition and procurement.

  • People
    DHS Secretary Kirstjen Nielsen, shown here at her Nov. 8, 2017, confirmation hearing. DHS Photo by Jetta Disco

    DHS chief Nielsen resigns

    Kirstjen Nielsen, the first Homeland Security secretary with a background in cybersecurity, is being replaced on an acting basis by the Customs and Border Protection chief. Her last day is April 10.

Stay Connected

FCW INSIDER

Sign up for our newsletter.

I agree to this site's Privacy Policy.