h. Section 508 of the Rehabilitation Act (1998) (continued) All Federal public websites must continue to comply with the requirements of Section 508 of the Rehabilitation Act (29 USC §794d), designed to make online information and services fully available to individuals with disabilities. References: i. Executive Order 13166: Improving Access to Services for Persons With Limited English Proficiency (August 11, 2000) VA must comply with existing requirements of Executive Order 13166, "Improving Access to Services for People with Limited English Proficiency," based on Title VI of the Civil Rights Act of 1964, which bans discrimination on the basis of national origin. VA Web content managers must follow this guidance by determining if any documents on their VA websites require translation by basing this determination on a discernable pattern of recurring, specific requests from the public to provide a translated version of a specific document or documents posted to their respective VA websites. Continued on next page 1. Federal Requirements, Continued i. Executive Order 13166: Improving When high demand indicates that a document requires translation and its translation will serve VA’s mission, the Web content manager should take
p. Security Protocols to Protect Information Under the Act of 2002 All Federal public websites must comply with Section 207(f)(1)(b)(iv) of the E–Gov Act of 2002, which requires organizations to have security protocols to protect information. References: Continued on next page 1. Federal Requirements, Continued q. OMB Memorandum 07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information (2007) Promulgated May 22, 2007, this directive renewed emphasis on fair information principles of data minimization, data quality and transparency. As part of the work of the Identity Theft Task Force, this memorandum requires agencies to develop and implement a breach-notification policy within 120 days. Breaches subject to notification requirements include both electronic systems as well as paper documents. In short, agencies are required to report on the security of information systems in any formant (e.g., paper, electronic, etc.) Agencies were also required to: Review holdings of identifying information for accuracy, relevance, timeliness and completeness; Reduce the collection and use of social security numbers (SSNs), developing a plan to eliminate unnecessary SSNs in collections; Participate in government-wide efforts to explore alternatives to agency use of Social Security Numbers as a personal identifier for both Federal employees and in Federal programs (e.g., surveys, data calls, etc.); Adhere to five requirements derived from existing security policy and NIST guidance: Encryption. Encrypt, using only NIST certified cryptographic modules, Government
all data on mobile computers/devices carrying agency data unless the data is determined not to be sensitive, in writing, by your Deputy Secretary or a senior-level individual he/she may designate in writing; Control Remote Access. Allow remote access only with two-factor authentication where one of the factors is provided by a device separate from the computer gaining access; Time-Out Function. Use a “time-out” function for remote access and mobile devices requiring user re-authentication after thirty minutes of inactivity; Log and Verify. Log all computer-readable data extracts from databases holding sensitive information and verify each extract, including whether sensitive data has been erased within 90 days or its use is still required; and Continued on next page 1. Federal Requirements, Continued q. OMB Memorandum 07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information (2007) (continued) Ensure Understanding of Responsibilities. Ensure all individuals with authorized access to personally identifiable information and their supervisors sign at least annually a document clearly describing their responsibilities; Implement a correction process for problematic holdings; Reduce data in systems to minimum necessary for proper performance of the documented agency function ; and Develop policy to ascertain data quality at point of decision-making Reference: r. Open Directive: Guidance for Agency Web and New Media Teams (2009) The Office of Management and Budget (OMB) issued the Open Directive (OGD) on December 8, 2009. Each agency is required to create a webpage at http://www.[agency].gov/open to serve as a gateway to activities related to the Directive. This document serves as a guideline for the content, format and function of those web pages, thereby ensuring a consistent user experience across agency sites. Agencies were required to publish their Open Plans on their gov/open web pages. References: