microfilms, photo impressions, or other formats (including tape reformatting or reproduction or conversion to punch cards, digital images or hard copy printout) will be performed pursuant to one of the following procedures: Agency Owned and Operated Facility Processing under this method will take place in a manner that will protect the confidentiality of the information on the electronic media. All safeguards outlined in this publication also must be followed and will be subject to IRS safeguard reviews. Vendor or Agency Shared Facility – Consolidated Data Centers Recipients of FTI are allowed to use a shared facility but only in a manner that does not access to FTI by employees, agents, representatives or Vendors of other agencies using the shared facility. Note: For purposes of applying sections 6103(l), (m) and (n), the term “agent” includes Vendors. Access restrictions pursuant to the IRC authority by which the FTI is received continue to apply. For example, since human services agencies administering benefit eligibility programs may not allow Vendor access to any FTI received, their data within the consolidated data center may not be accessed by any Vendor of the data center. The requirements in Exhibit 7, Contract Language for General Services, must be included in the Contract in accordance with IRC Section 6103(n). The Vendor or agency-shared computer facility is also subject to IRS safeguard reviews. Note: The above rules also apply to releasing electronic media to a private Vendor or other agency office even if the purpose is merely to erase the old media for reuse. Agencies utilizing consolidated data centers must implement appropriate controls to ensure the protection of FTI, including a service agreement (SLA) between the agency authorized to receive FTI and the consolidated data center. The SLA should cover the following: The consolidated data center is considered to be a “Vendor” of the agency receiving FTI. The agency receiving FTI – whether it is a state revenue, workforce, child support enforcement or human services agency – is responsible for ensuring the protection of all FTI received. However, as the “Vendor” for the agency receiving FTI, the consolidated data center shares responsibility for safeguarding FTI as well. Provide written notification to the consolidated data center management that they are bound by the provisions of Publication 1075, relative to protecting all federal tax information within their possession or control. The SLA should also include details concerning the consolidated data center’s responsibilities during a safeguard
review and support required to resolve identified findings. The agency will conduct an internal inspection of the consolidated data center every eighteen months (see section 6.3). Multiple agencies sharing a consolidated data center may partner together to conduct a single, comprehensive internal inspection. However, care should be taken to ensure agency representatives do not gain unauthorized access to other agency’s FTI during the internal inspection. The employees from the consolidated data center with access to FTI, including system administrators and programmers, must receive disclosure awareness training prior to access to FTI and annually thereafter and sign a confidentiality statement. This provision also extends to any Vendors hired by the consolidated data center that has access to FTI. The specific data breach incident reporting procedures for all consolidated data center employees and Vendors. The required disclosure awareness training must include a review of these procedures.
disclosure, release, access, review, destruction; loss, theft or misuse of an information asset. If the Vendor experiences a loss or breach of data, the Vendor shall immediately report the loss or breach to the State. If the State data owner determines that notice to the individuals whose data has been lost or breached is appropriate, the Vendor will bear any and all costs associated with the notice or any mitigation selected by the data owner. These costs include, but are not limited to, staff time, material costs, postage, media announcements, and other identifiable costs associated with the breach or loss of data. The Vendor immediately notify and work cooperatively with the State data owner to respond timely and correctly to public records act requests. The Vendor will dispose of records of State data as instructed by the State during the term of this agreement. No data shall be copied, modified, destroyed or deleted by the Vendor other than for normal operation or maintenance during the Agreement period without prior written notice to and written approval by the State. Remote access to data from outside the territorial United States, including remote access to data by authorized support staff in identified support centers, is prohibited unless approved in advance by the State. The physical location of Vendor’s data center where the Data is stored shall be within the territorial United States.