Breach Response Plan

Approval #

The Senior Agency Official for Privacy (SAOP) approves this privacy document. The Chief Information Security Officer (CISO) concurs on the security controls it relies on.

Revision History #

Review cycle: Every year at the end of the fiscal year, with the yearly tabletop exercise that Office of Management and Budget (OMB) M-17-12 requires.

Mandate. OMB M-17-12 requires each agency to keep a breach response plan for breaches of personally identifiable information (PII). This plan covers the required elements in the order the memorandum lists them. National Institute of Standards and Technology (NIST) SP 800-53 IR-8(1) requires the incident response plan to cover breaches. This plan works alongside the Incident Response Plan. The SAOP activates it for any suspected or confirmed breach of PII, whatever the severity of the security incident.

1. Definitions and Activation #

M-17-12 defines a breach as the loss of control, compromise, unauthorized disclosure, or unauthorized acquisition of PII. It also covers any similar event in which someone other than an authorized user accesses, or may access, PII. Any person who suspects a breach reports it at once through the incident reporting channels, whether the breach is suspected or confirmed and whatever the medium: paper, spoken, or electronic. The Security Operations Center (SOC) notifies the SAOP without delay, and the SAOP decides whether to activate this plan.

Entry criteria: Someone suspects or confirms a breach of PII.

Exit criteria: The SAOP activated this plan and convened the team, or recorded why the event is not a breach.

Evidence: the incident ticket in the ticketing system, with the time of the notice to the SAOP, the activation decision, and the team roster.

2. Breach Response Team #

M-17-12 names the members the team must have at a minimum. The SAOP chairs the team and adds members a breach calls for. The SAOP convenes the full team for any breach that may be a major incident.

3. Privacy Compliance Documentation #

When the team responds to a breach, the SAOP identifies every privacy compliance document that covers the affected information. These include the system of records notices (SORNs), privacy impact assessments (PIAs), and privacy notices. The SAOP uses them to learn what information the system holds, who may receive it, and what the Organization told the people affected. The SAOP records any document that needs an update after the breach.

4. Information Sharing to Respond to a Breach #

The SAOP makes sure every SORN carries the two routine uses M-17-12 requires. One permits disclosure to respond to a breach of the Organization’s own records. The other permits disclosure to help another agency respond to a breach of its records. The SAOP adds the routine uses to any SORN that lacks them at its next review. The team shares information with CISA, law enforcement, and other agencies only as the Privacy Act and these routine uses allow.

5. Reporting #

The SOC is the Organization’s principal security operations center for breach reporting, as M-17-12 requires the plan to name. The incident ticket in the ticketing system is the record of each report.

• The SOC Manager reports a suspected or confirmed breach to CISA within 1 hour of the SOC identifying it, as the CISA Federal Incident Notification Guidelines require. The SOC Manager uses the CISA Incident Reporting Form at https://myservices.cisa.gov/irf and the steps in the Incident Response Plan.
• The SOC Manager records the CISA incident ID in the ticket. As facts become known, the SOC Manager updates the report with the number of people whose PII was accessed, the types of PII, and whether people were notified or offered services.
• The SOC keeps the SAOP informed of each report and each change in what is known.
• The SAOP coordinates notice to law enforcement, the Inspector General, and General Counsel with the officials the Incident Response Plan names. The CISO notifies the Inspector General. The CISO refers a possible crime to law enforcement through General Counsel.
• When a breach calls for a report to law enforcement, the CISO makes it promptly, even if the breach is not yet confirmed.
• A breach that involves the PII of 100,000 or more people is always a major incident under OMB’s current Federal Information Security Modernization Act (FISMA) guidance, M-25-04. The SAOP leads the major incident determination for every breach and records its date.
• When a breach is a major incident, the CISO reports it to CISA and OMB within 1 hour of the determination. The SOC and the SAOP track and document it together.
• When a breach is a major incident, the legislative affairs official notifies the appropriate congressional committees, and the CISO notifies the Inspector General, within 7 days. The 7 days start when the Organization has a reasonable basis to conclude that a major incident occurred.
• The legislative affairs official sends Congress a report within 30 days of discovering a major breach, as FISMA 2014 requires. The report says how the breach happened, how many people it affected, the assessed risk of harm, and whether and when the Organization will notify them.
• The CISO includes each breach in the Organization’s annual FISMA report, as OMB’s current FISMA guidance requires.

Evidence: the incident ticket with the CISA incident ID, each update to CISA, the major incident determination, and the notices to Congress, the Inspector General, and law enforcement.

6. Assessing the Risk of Harm #

For each breach, the team assesses the risk of harm to the people affected. The team weighs the factors M-17-12 sets: the nature and sensitivity of the PII, the likelihood that someone will access and use it, and the type of breach. The team records the assessment and its conclusion. The assessed risk guides whether to notify and how to reduce harm.

Entry criteria: The SAOP activated this plan.

Exit criteria: The team recorded the risk of harm and its reasons.

Evidence: the facts of the breach and the risk of harm decision in the incident ticket, and the list of privacy documents.

7. Mitigating the Risk of Harm #

The team chooses the steps that reduce harm to the people affected. Steps include taking down exposed information, recalling or destroying disclosed material, resetting credentials, and giving people guidance on how to protect themselves. The SAOP recommends services such as credit monitoring or identity protection when the assessed risk calls for them. The Agency Head makes the final decision on services. The Contracting Officer buys identity protection services through the government-wide blanket purchase agreements that OMB M-16-14 directs agencies to use. The CISO corrects the control failure that allowed the breach and tracks the correction as a plan of action and milestones (POA&M) item.

Entry criteria: The team recorded the risk of harm.

Exit criteria: Each mitigation step is done or has a ticket, and the control failure has a POA&M item.

Evidence: the mitigation tickets, the recommendation and the Agency Head’s decision on services, the order, and the POA&M item in the GRC system.

8. Notifying the People Affected #

The SAOP advises the Agency Head, who makes the final decision on whether to notify the people affected. The Agency Head may designate a senior official in writing to decide. The assessed risk of harm informs the decision. When the team notifies people, it follows these rules:

• Source. Notice comes from the Agency Head or the designated senior official. For a breach that affects few people and carries a low risk of harm, the SAOP may send the notice.
• Timing. Notice goes out without unreasonable delay. The team weighs the needs of law enforcement and national security, and steps to contain the breach, before it notifies.
• Content. Notice is short and uses plain language. Every notice covers these points:
  • what happened, the date of the breach, and the date it was found;
  • the types of PII involved;
  • whether the PII was encrypted or otherwise protected;
  • the steps people can take to protect themselves;
  • what the Organization is doing about the breach;
  • a contact point for questions.
• Method. First-class mail to the last known address is the default method. The team does not rely on email alone. When the team lacks current addresses, it may use substitute notice, such as a website posting and media notice.
• Language and accessibility. When the people affected do not speak English, the team gives notice in the languages they use, where feasible. The team makes notice usable by people who are blind or deaf or have low vision or hearing loss.

Entry criteria: The team recorded the risk of harm.

Exit criteria: The Agency Head decided, and any notice went out.

Evidence: the recommendation, the signed decision, the approved notice, and the mailing record.

9. Contractors and Grant Recipients #

Contracting Officers include in each contract that involves PII the terms the Organization needs to respond to a breach. The terms require the contractor to:

• report a suspected or confirmed breach in any medium to the Organization’s SOC at once;
• notify the people affected when the Organization directs it;
• cooperate with the Organization’s investigation and response, and give access to its staff, records, and systems as the response needs;
• train its staff to recognize and report a breach.

The terms also state that a report of a breach does not, by itself, show that the contractor failed to protect the information. Grants officers include terms that require each grant recipient that handles PII to have breach response procedures and to notify the Organization of a breach.

10. Training and Rules of Behavior #

Every person completes privacy and security awareness training before receiving access to the Organization’s information or systems. The training teaches people how to recognize a breach and that they must report a suspected breach, not only a confirmed one. The general and privileged Rules of Behavior require breach reporting and state the consequences of breaking the rules.

11. Tracking and Documenting Each Breach #

The SOC keeps a formal process to track and document each breach. The process makes sure the SAOP learns of each report without delay. For each breach, the record shows:

• what happened, and the risk assessment;
• the number of people affected and the types of PII involved;
• whether the people affected were notified;
• whether services were offered;
• whether the breach was reported to CISA or to Congress, with the CISA incident ID.

The SOC keeps this record in the incident ticket in the ticketing system. Each quarter, the SOC sends the SAOP a status report on every open breach. The SOC keeps the records with the incident records.

Entry criteria: The SOC opened the incident ticket.

Exit criteria: The breach is closed.

Evidence: the ticket history, the CISA incident ID and updates, and the quarterly status reports.

12. Closing a Breach #

The SAOP closes a breach only when the response is complete.

Entry criteria: Every notice, service, and mitigation step the team decided on is done.

Exit criteria: The SAOP approved the closure, CISA has the final update, and the ticket is closed.

Evidence: the closure checklist, the final CISA update, the item number for the control failure, the SAOP’s closure approval, and the closed ticket in the ticketing system.

13. Lessons Learned #

After the Organization reports a breach to Congress, the SAOP convenes the team to review the response and record lessons learned. The SAOP may do the same after any other breach. The team turns lessons into specific steps that prevent a repeat. The SAOP records each resulting change to this plan, to policies, or to training.

14. Tabletop Exercise and Annual Review #

The SAOP convenes the team for a tabletop exercise at least once a year to test this plan. The exercise may run with the incident response exercise. At the end of each fiscal year, the SAOP reviews the SOC’s breach reports and this plan and confirms the plan is current. The SAOP updates the plan where needed, records the date of the review, and sends the plan to OMB when asked during FISMA reporting.

15. References #

These are the sources this document cites, with a link to each official text.

• CISA Incident Reporting System: Incident Reporting Form (CISA Services Portal): Incident Reporting Form (CISA Services Portal), August 29, 2024.
• Federal Incident Notification Guidelines, April 1, 2017.
• Federal Information Security Modernization Act of 2014 (44 U.S.C. § 3551 et seq.), December 18, 2014.
• OMB M-16-14: Category Management Policy 16-2: Providing Comprehensive Identity Protection Services, Identity Monitoring, and Data Breach Response, July 1, 2016.
• OMB M-17-12: Preparing for and Responding to a Breach of Personally Identifiable Information, May 22, 2017.
• OMB M-25-04: FY 2025 Guidance on Federal Information Security and Privacy Management Requirements, January 15, 2025.
• Privacy Act of 1974 (5 U.S.C. § 552a), December 31, 1974.