U.S. flag
          An official website of the United States Government  Main navigation
  

        

              Data Initiatives
                              Regulations
                                                                        Row 1
                                              FAR FAR
                              Smart Matrix Smart Matrix
                              Chapter 99 (CAS) Chapter 99 (CAS)
                              Row 2
                                              DFARS DFARS
                              DFARSPGI DFARSPGI
                              AFARS AFARS
                              DAFFARS DAFFARS
                              DAFFARS MP DAFFARS MP
                              DARS DARS
                              DLAD DLAD
                              NMCARS NMCARS
                              Row 3
                                              SOFARS SOFARS
                              TRANSFARS TRANSFARS
                              AGAR AGAR
                              AIDAR AIDAR
                              CAR CAR
                              DEAR DEAR
                              DIAR DIAR
                              DOLAR DOLAR
                              Row 4
                                              DOSAR DOSAR
                              DTAR DTAR
                              EDAR EDAR
                              EPAAR EPAAR
                              FEHBAR FEHBAR
                              GSAM/R GSAM/R
                              HHSAR HHSAR
                              HSAR HSAR
                              Row 5
                                              HUDAR HUDAR
                              IAAR IAAR
                              JAR JAR
                              LIFAR LIFAR
                              NFS NFS
                              NRCAR NRCAR
                              TAR TAR
                              VAAR VAAR
                              Tools
                                                                        Archives
                              Smart Matrix
                              Regulations Search
                              Acquisition Regulation Comparator (ARC)
                              Policy Network
                                                                        CAOC
                              CAAC
                              FAR Council
                              ISDC
 Breadcrumb
        Home
                            Regulations
                            HSAR
                            3052.204-73   Notification and credit monitoring requirements for Personally Identifiable Information incidents.
        
                  HTML
HSARPart Number: 3052
        
                  

                                
                  
        Homeland Security Acquisition Regulations
« PreviousNext »
3052.204-73 Notification and credit monitoring requirements for Personally Identifiable Information incidents.3052.204-73 Notification and credit monitoring requirements for Personally Identifiable Information incidents.       As prescribed in (HSAR) 48 CFR 3004.470–4(c), insert the following clause:                                  3052.204–73 Notification and Credit Monitoring Requirements for Personally Identifiable Information Incidents (JUL 2023)                                  (a) *Definitions.* Privacy Information includes both Personally Identifiable Information (PII) and Sensitive Personally Identifiable Information (SPII). PII refers to information that can be used to distinguish or trace an individual's identity, either alone, or when combined with other information that is linked or linkable to a specific individual; and SPII is a subset of PII that if lost, compromised, or disclosed without authorization could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. To determine whether information is PII, the DHS will perform an assessment of the specific risk that an individual can be identified using the information with other information that is linked or linkable to the individual. In performing this assessment, it is important to recognize that information that is not PII can become PII whenever additional information becomes available, in any medium or from any source, that would make it possible to identify an individual. Certain data elements are particularly sensitive and may alone present an increased risk of harm to the individual.                                  (1) Examples of stand-alone PII that are particularly sensitive include: Social Security numbers (SSNs), driver's license or State identification numbers, Alien Registration Numbers (A-numbers), financial account numbers, and biometric identifiers.                                  (2) Multiple pieces of information may present an increased risk of harm to the individual when combined, posing an increased risk of harm to the individual. SPII may also consist of any grouping of information that contains an individual's name or other unique identifier plus one or more of the following elements:                                  (i) Truncated SSN (such as last 4 digits);                                  (ii) Date of birth (month, day, and year);                                  (iii) Citizenship or immigration status;                                  (iv) Ethnic or religious affiliation;                                  (v) Sexual orientation;                                  (vi) Criminal history;                                  (vii) Medical information; and                                  (viii) System authentication information, such as mother's birth name, account passwords, or personal identification numbers (PINs).                                  (3) Other PII that may present an increased risk of harm to the individual depending on its context, such as a list of employees and their performance ratings or an unlisted home address or phone number. The context includes the purpose for which the PII was collected, maintained, and used. This assessment is critical because the same information in different contexts can reveal additional information about the impacted individual.                                  (b) *PII and SPII Notification Requirements.*          (1)  			No later than 5 business days after being directed by the Contracting Officer, or as otherwise required by applicable law, the Contractor shall notify any individual whose PII or SPII was either under the control of the Contractor or resided in an information system under control of the Contractor at the time the incident occurred. The method and content of any notification by the Contractor shall be coordinated with, and subject to prior written approval by, the Contracting Officer. The Contractor shall not proceed with notification unless directed in writing by the Contracting Officer.                                  (2) All determinations by the Department related to notifications to affected individuals and/or Federal agencies and related services (*e.g.,* credit monitoring) will be made in writing by the Contracting Officer.                                  (3) Subject to government analysis of the incident and direction to the Contractor regarding any resulting notification, the notification method may consist of letters to affected individuals sent by first-class mail, electronic means, or general public notice, as approved by the Government. Notification may require the Contractor's use of address verification and/or address location services. At a minimum, the notification shall include:                                  (i) A brief description of the incident;                                  (ii) A description of the types of PII or SPII involved;                                  (iii) A statement as to whether the PII or SPII was encrypted or protected by other means;                                  (iv) Steps individuals may take to protect themselves;                                  (v) What the Contractor and/or the Government are doing to investigate the incident, mitigate the incident, and protect against any future incidents; and                                  (vi) Information identifying who individuals may contact for additional information.                                  (c) *Credit Monitoring Requirements.* The Contracting Officer may direct the Contractor to:                                  (1) Provide notification to affected individuals as described in paragraph (b).                                  (2) Provide credit monitoring services to individuals whose PII or SPII was under the control of the Contractor or resided in the information system at the time of the incident for a period beginning the date of the incident and extending not less than 18 months from the date the individual is notified. Credit monitoring services shall be provided from a company with which the Contractor has no affiliation. At a minimum, credit monitoring services shall include:                                  (i) Triple credit bureau monitoring;                                  (ii) Daily customer service;                                  (iii) Alerts provided to the individual for changes and fraud; and                                  (iv) Assistance to the individual with enrollment in the services and the use of fraud alerts.                                  (3) Establish a dedicated call center. Call center services shall include:                                  (i) A dedicated telephone number to contact customer service within a fixed period;                                  (ii) Information necessary for registrants/enrollees to access credit reports and credit scores;                                  (iii) Weekly reports on call center volume, issue escalation (*i.e.,* those calls that cannot be handled by call center staff and must be resolved by call center management or DHS, as appropriate), and other key metrics;                                  (iv) Escalation of calls that cannot be handled by call center staff to call center management or DHS, as appropriate;                                  (v) Customized Frequently Asked Questions, approved in writing by the Contracting Officer in coordination with the Component or Headquarters Privacy Officer; and                                  (vi) Information for registrants to contact customer service representatives and fraud resolution representatives for credit monitoring assistance.                               (End of clause)    **Parent topic:**  Subpart 3052.2—Text of Provisions and Clauses
« PreviousNext »
FavoriteX

      HSAR Parts
            Regulations Hsar Menu
  

        
      Index
                              3000
                              3001
                              3002
                              3003
                              3004
                              3005
                              3006
                              3007
                              3008
                              3009
                              3010
                              3011
                              3012
                              3013
                              3014
                              3015
                              3016
                              3017
                              3018
                              3019
                              3022
                              3023
                              3024
                              3025
                              3026
                              3027
                              3028
                              3029
                              3030
                              3031
                              3032
                              3033
                              3034
                              3035
                              3036
                              3037
                              3038
                              3039
                              3040
                              3041
                              3042
                              3043
                              3044
                              3046
                              3047
                              3048
                              3049
                              3050
                              3051
                              3052
                              3053
                              30203021
                              30543099

      ×
        Data Initiatives
                                                              Regulations
                                                              Tools
                                              Archives
                                                              Smart Matrix
                                                              Regulations Search
                                                              Acquisition Regulation Comparator (ARC)
                                                              Policy Network
                                              CAO.gov
                                                        CAO Home
                                                              Council Member
                                                                    Large Agencies
                                                              Small Agencies
                                                              Council Defining Documents
                                                                    CAOC History
                                                              CAOC Charter
                                                              Civilian Agency Acquisition Council (CAAC)
                                                              Federal Acquisition Regulatory Council
                                                              Interagency Suspension and Debarment Committee (ISDC)
                                                              Search
 ˄ Top Sign up for FAR News

                            Share the FAR
                        Upper Footer Menu
  

        
      Useful Links
                              FAR Resources
                              Training
                              Acquisition Systems
            
                            **Contact Us/FAQs**
                        **Privacy and Security Notice**
                        **Accessibility Aids**
                        **Last Updated 03/29/2024**
 ACQUISITION.GOV
                An official website of the General Services Administration About GSA
                Accessibility support
                FOIA requests
                No FEAR Act data
                Office of the Inspector General
                Performance reports
                Privacy policy Looking for U.S. government information and services?
            Visit USA.gov
 «
    
    Tt