Privacy, IT officers come together to create policy

The Bush administration’s effort to improve how agencies protect personally identifiable information and report breaches has pushed federal privacy and information technology officers to work together, according to federal privacy and data security executives.

A May 22 Office of Management and Budget memorandum expanded on the 2002 Federal Information Security Management Act and the 1974 Privacy Act to require agencies to develop and implement a breach notification policy in 120 days. The directive also requires agencies to review the amount of personal data they store and work to decrease it. Working to draft a plan has brought privacy and IT officers together, said Toby Levin, senior adviser to the Homeland Security Department’s Privacy Office. The policy was due last week.

“We have found the efforts to implement it a good vehicle for meshing [the IT and privacy office’s] roles together,” she said. “I think they quickly saw that most IT incidents involve [personally identifiable information], so there is a natural synergy between our programs and missions.”

Agencies must encrypt sensitive data on mobile devices by using only National Institute of Standards and Technology standards, use two-factor identification to control remote access, block remote devices from access after 30 minutes without activity, and log and verify all data extracts. Also, employees with access to personally identifiable information must sign a statement at least once a year stating that they understand their responsibilities.

OMB also requires that all data breaches be reported to the U.S. Computer Emergency Readiness Team within an hour of discovery, but it is up to the agency to notify affected individuals or the media.

Concerns about how to protect employees’ private data have underscored the importance and challenges associated with the relationship between chief privacy and chief information officers, said Marc Groman, the Federal Trade Commission’s chief privacy officer. Groman and Levin spoke on the same panel Sept 25 at an American Society of Access Professionals conference on privacy issues.

“I think there is possibly no more important relationship than the relationship between the chief privacy officer and the chief information officer,” Groman said.

About the Author

Ben Bain is a reporter for Federal Computer Week.

Featured

  • Telecommunications
    Stock photo ID: 658810513 By asharkyu

    GSA extends EIS deadline to 2023

    Agencies are getting up to three more years on existing telecom contracts before having to shift to the $50 billion Enterprise Infrastructure Solutions vehicle.

  • Workforce
    Shutterstock image ID: 569172169 By Zenzen

    OMB looks to retrain feds to fill cyber needs

    The federal government is taking steps to fill high-demand, skills-gap positions in tech by retraining employees already working within agencies without a cyber or IT background.

  • Acquisition
    GSA Headquarters (Photo by Rena Schild/Shutterstock)

    GSA to consolidate multiple award schedules

    The General Services Administration plans to consolidate dozens of its buying schedules across product areas including IT and services to reduce duplication.

Stay Connected

FCW Update

Sign up for our newsletter.

I agree to this site's Privacy Policy.