OPM breach notifications, round two

Shutterstock image: checking documents.

At long last, vendors can size up the official requirements for protecting the identities of 21.5 million affected by the Office of Personnel Management background check breach.

The full load could be more like 28 million, and whoever wins will have to let the feds inside their own databases.

Quotations are due Aug. 14 at 8 p.m. EDT, per the General Services Administration’s request for quotations, with any questions due through eBuy by Aug. 12.

The Naval Sea Systems Command solicitation assumes an award date of Aug. 21.

Gargantuan responsibility

Contracting papers released Aug. 4 reiterate the scope of exposed information – millions of Social Security numbers, background check interviews, fingerprints, usernames and passwords – and tasks would-be partners with supplying a full suite of solutions: website and call center services, credit and identity monitoring, identity theft insurance and identity restoration services.

Because of the huge scope of the breach exposure, the winning contractor will also be responsible for protecting the dependent minor children of breach victims – NAVSEA estimates that includes about 6.4 million people.

Contractors will be responsible for a minimum of $1 million in identity theft insurance per affected individual.

After a long notification delay, the feds plan to move fast.

The contractor will have 12 weeks after the award to issue notifications, but, “The government expects to complete the bulk of notifications within the first weeks of the task order award,” NAVSEA’s solicitation states.

(NAVSEA, brought in to help because of its experience “awarding large and complex contracts,” will work with GSA, OPM and the Office of Management and Budget to make the final award.)

Not repeating the same mistakes

The feds won’t give the winning contractor free rein.

“The contractor shall support security onsite inspections by the government at any location where protected information is collected, stored or sued,” the NAVSEA solicitation states.

Several times throughout the document, NAVSEA adds the caveat, “The government reserves the right to inspect and validate the contractor’s facilities, protocols, and processes for compliance.”

That caution comes after compromised contractor credentials were fingered as the key to the OPM breaches.

OPM’s contractor for the first round of notifications, CSID, faced criticism for its handling of the breach response.

Part of that criticism: Feds were uncertain of the trustworthiness of emails coming from a .com address, a concern so substantial that the Defense Department shut off breach notifications for several days.

The next round of notifications might avoid that problem.

“The contractor shall establish a dedicated, branded website for impacted individuals,” the new contracting specifications state. “The government may require the site to link with a web page.”

CSID also drew fire when some feds claimed they started getting telemarketing robocalls after signing up for identity protection services. 

“[M]arketing of any kind” is prohibited in the new contracting paperwork.

About the Author

Zach Noble is a former FCW staff writer.


  • Defense
    Ryan D. McCarthy being sworn in as Army Secretary Oct. 10, 2019. (Photo credit: Sgt. Dana Clarke/U.S. Army)

    Army wants to spend nearly $1B on cloud, data by 2025

    Army Secretary Ryan McCarthy said lack of funding or a potential delay in the JEDI cloud bid "strikes to the heart of our concern."

  • Congress
    Rep. Jim Langevin (D-R.I.) at the Hack the Capitol conference Sept. 20, 2018

    Jim Langevin's view from the Hill

    As chairman of of the Intelligence and Emerging Threats and Capabilities subcommittee of the House Armed Services Committe and a member of the House Homeland Security Committee, Rhode Island Democrat Jim Langevin is one of the most influential voices on cybersecurity in Congress.

Stay Connected


Sign up for our newsletter.

I agree to this site's Privacy Policy.