Additional Notification Concerning Loss of Personally Identifiable Information from Departmental Systems (EM)

· Department of Energy Washington, DC 20585 July 28,2010 MEMORANDUM FOR MAITHEW S. MCCORMICK MANAGER RICHLAND OPERATIONS OFFICE FROM: · INEsR.TRIAY~ ~~· ASSISTANT SECRETARY FOR U SUBJECT: ENVIRONMENTAL MANAGEMENT Additional Notification Concerning Loss of Personally Identifiable Infonnation from Departmental Systems The purpose of this memorandum is to ensure that current managers are infonned of the Department's direction for the reporting of loss or breach of Personally Identifiable Info~ation (PIT). Attached is a Memorandum dated March 23, 2009, signed by Ingrid Kolb, Director, Office of Management Senior Agency Official Review for Privacy. As the memo states, Departmental statistics demonStrate an increase in the number of PIT breaches. In fiscal year 2009 the Depa,rtment reported 190 breaches for the year. As of June 2010, 9 months into the reporting year, the Department has reported 121 breaches ofPII data. Therefore it is necessary that Environmental Management Headquarters and Field Office managers c~surc that federal and contractor employees are trained and aware of the Department's direction concerning the handling pfPII and reporting ofPII incidents. Incidents involving the loss or breach ofPII must be reported to the Department ofEnergy-Cyber Incident Response Capability (DOE-CIRC) within 45 minutes of detection whether confirmed or not. After initial reporting, updates should be submitted, as warranted, until the report is closed. DOE Order 206.1, Department of Energy Privacy·Program and the Under S~cretary's Program Cybcr Security Plan, dated October 29, 2008, document the Department•s policy and procedures for reporting incidents and the safe handling ofPII. Two previous memorandums relative to security incidents and the loss of PII are also attached: Memorandum from Clay Sell, dated September 29, 2~06, subject . "Appropriate Notifications for the Secretary and Deputy Secretary of Cyber Intrusions and Other Types of Security Incidents" * Printed with soy Ink on recyclod paper '· Memorandum from Claudia Cross and Michael Kane, dated September 29, 2006, subject, "Notifying Employees and Others Affected by Loss of Personally Identifi!lble Information from Departmental Systems, In addition to the reporting requirements outlined in these memoranda relat¢ to the DOE-CIRC and the Office of the Secretary and Deputy Secretary notificatio~, I am requesting that you also provide a concurrent notification to the Principal Deputy Assistant Secretary and me within the timeframe outlined. I consider th~ protection of ~ur employees' P~I one of my highest priorities .. If you have any questions, please contact Jeanne. Beard, Director, Office of Co.rpOrate Information Technology, EM-72,.at (202) 586-0200 or Jeanne.Beard@hg.doe.gov · Attachments cc: Jeanne M. Beard, EM-72 Stanley: P. Wujcik; EM-72 Tim Hanns, EM-4.1 Wayne· Whitley, EM-4.1 r