OMB: Report all breaches within an hour
After hacks at several government agencies, the agency has revised its policy.
OMB memo on reporting information breaches
Agencies must now report even suspected breaches of personal information within one hour of discovery, according to an Office of Management and Budget policy memo.
The memo revises a policy that set various reporting deadlines based on the incident.
OMB wants agencies to “not distinguish between suspected and confirmed breaches,” the memo states.
In the memo, Karen Evans, administrator for e-government and information technology at OMB, also reminded agencies that they should include security and privacy requirements with fiscal 2008budget requests for IT investments.
Several agencies have struggled with breaches of personal information.
A thief stole a Department of Veterans Affairs laptop computer and its hard drive May 3. They contained the sensitive information of more than 26 million veterans and military employees.
VA Secretary Jim Nicholson told the House Veterans’ Affairs Committee June 28 that the FBI had recovered the computer, which is undergoing forensic investigations.
The FBI said it appears that the thief did not access or compromise the data.
The loss created a firestorm of problems for the department. It and other breaches into agencies’ sensitive information caused OMB to adjust policies to guard private information.