I have long been promoting the concept…more accurately, the NEED…of having IT/Information Security and Privacy (often in the legal area) work closely together in order to not only result in each area being the most effective and efficient in their efforts, but also to ensure no conflicting messages are being sent and no gaps in addressing these issues exist. It is additionally good for and improves business to have these areas work closely together; there are at least 20 overlapping topics these areas work on. Unfortunately too often the Privacy and IT/Information Security areas do not even come closely to working together.
It was good to see an article in the latest issue of Federal Computer Week, “Privacy, IT officers come together to create policy.”
“A May 22 Office of Management and Budget memorandum expanded on the 2002 Federal Information Security Management Act and the 1974 Privacy Act to require agencies to develop and implement a breach notification policy in 120 days. The directive also requires agencies to review the amount of personal data they store and work to decrease it. Working to draft a plan has brought privacy and IT officers together, said Toby Levin, senior adviser to the Homeland Security Department’s Privacy Office. The policy was due last week.
‚ÄúWe have found the efforts to implement it a good vehicle for meshing [the IT and privacy office’s] roles together,‚Äù she said. ‚ÄúI think they quickly saw that most IT incidents involve [personally identifiable information], so there is a natural synergy between our programs and missions.‚Äù
Agencies must encrypt sensitive data on mobile devices by using only National Institute of Standards and Technology standards, use two-factor identification to control remote access, block remote devices from access after 30 minutes without activity, and log and verify all data extracts. Also, employees with access to personally identifiable information must sign a statement at least once a year stating that they understand their responsibilities.
OMB also requires that all data breaches be reported to the U.S. Computer Emergency Readiness Team within an hour of discovery, but it is up to the agency to notify affected individuals or the media.
Concerns about how to protect employees‚Äô private data have underscored the importance and challenges associated with the relationship between chief privacy and chief information officers, said Marc Groman, the Federal Trade Commission’s chief privacy officer. Groman and Levin spoke on the same panel Sept 25 at an American Society of Access Professionals conference on privacy issues.
‚ÄúI think there is possibly no more important relationship than the relationship between the chief privacy officer and the chief information officer,‚Äù Groman said. “
Yes! This *IS* an extremely important relationship!
Partnering definitely is necessary when responding to privacy breaches. However, the needs to partner activities also go way beyond breach notice procedures and actions into other important business processes as well.
It has been one of my goals to try and help organizations to see the importance of this relationship and help them to effectively partner to address privacy and information security and IT issues.
For the past two years I have been co-teaching a 2-day class I co-created with Chris Grillo, Medica CISO, called “Handling Complex and Difficult Privacy and Information Security Issues” to help in meeting this goal.
I’m so happy to see a story talking about how the federal government finally realizes this importance!!
It is not often that the government leads the way with innovative actions, but I hope other organizations and industries will take note of this article and get their own Privacy and IT/Information Security areas working TOGETHER.
Tags: awareness and training, Federal Trade Commission, Homeland Security, Information Security, IT compliance, Marc Groman, personally identifiable information, PII, policies and procedures, privacy, Toby Levin