IPMOU - Laserfiche WebLink

Home Browse Search

LL A. General Requirements For information disclosed and systems used to disclose information under this agreement, SSA and the Reporter will comply with applicable requirements of the Privacy Act of 1974, 5 U.S.C. $ 552a; the Federal Information Security Management Act (FISMA), 44 U.S.C. Chapter 35, Subchapter II, as amended by the Federal Information Security Modernization Act of 2014 (Pub. L. No. l13-283); related Office of Management and Budget (OMB) circulars and memoranda, such as Circular A-130, "Managing Information as a Strategic Resource" (July 28, 2016), and Memorandum M-17-12, "Preparing for and Responding to a Breach of Personally Identifiable Information" (January 3,2017); National Institute of Standards and Technology (NIST) directives; the Federal Acquisition Regulations; and other Federal laws, regulations, and directives that include requirements for safeguarding Federal information systems and personally identifiable information (PID. SSA and the Reporter recognize and will implement any applicable laws, regulations, NIST standards, and OMB directives including those published subsequent to the effective date of this agreement. FISMA requirements apply to all Federal contractors, organizations, or entities that possess or use Federal information, or that operate, use, or have access to Federal information systems on behalf of an agency. Both parties are responsible for oversight and compliance of their contractors and agents. B. PII Loss Reporting and Breach Notification If SSA experiences a suspected or actual loss of PII received from the Reporter under the terms of this agreement, SSA will follow the loss reporting guidelines and breach notification procedures issued by OMB and notify the Reporter of the incident. If an employee, contractor, or agent of the Reporter becomes aware of suspected or actual loss of PII received from SSA under the terms of this agreement (i.e., information about suspended individuals), he or she must immediately contact the Reporter's Systems Security Contact identified below or his/her delegate. The Reporter must then notiff the SSA Regional Prisoner Coordinator and SSA Systems Security Contact identified below. If, for any reason, the Reporter is unable to notify the SSA Regional Prisoner Coordinator or the SSA Systems Security Contact within I hour, the Reporter must report the incident by contacting SSA's National Network Service Center at l-877-697-4889- The Reporter will use the worksheet, attached as Attachment B, to quickly gather and organize information about the incident. In the future, SSA may update this worksheet to ensure continued compliance with OMB requirements. If SSA provides the Reporter with an updated worksheet, the Reporter will use the updated worksheet. The Reporter must provide to SSA information gathered about the incident and timely updates as any additional information about the loss of PII as it becomes available. If the party that experienced the breach determines that the risk of harm requires notification to affected individuals or other remedies, that agency will carry out these remedies without cost to the other party.