Social Security Number Collection and Use Policy

Approval #

The Senior Agency Official for Privacy (SAOP) approves this privacy document. The Chief Information Security Officer (CISO) concurs on the security controls it relies on.

Revision History #

Review cycle: Every year, and after any change in law or federal policy on Social Security numbers.

Mandate. Office of Management and Budget (OMB) Circular A-130, section 5(f)(1)(f), requires every agency to eliminate unnecessary use of Social Security numbers (SSNs). It also requires the agency to explore alternatives to the SSN as a personal identifier. National Institute of Standards and Technology (NIST) SP 800-53 control PT-7(1) sets the same rule for each system that processes SSNs. Each year, the Senior Agency Official for Privacy (SAOP) answers OMB’s privacy metrics under the Federal Information Security Modernization Act (FISMA). The metrics ask for a written policy with criteria for new SSN collections, and a process to confirm that each use stays necessary. This policy meets those requirements. It also gathers in one place every other SSN rule that federal law and OMB set, so a reader does not need another document to learn how the Organization handles SSNs. The table at the end of this policy lists the source of each rule.

1. Scope #

This policy applies to all employees and contractors who collect, use, store, share, or dispose of SSNs for the Organization. It applies to every information system the Organization owns or operates, every system a contractor or shared service provider operates for it, and every paper form.

This policy does not authorize any collection that the Privacy Act or any other law prohibits.

2. When the Organization May Collect or Use an SSN #

Staff must collect or use an SSN only when both of these conditions are met:

1. Legal or mission need. A statute or regulation requires the SSN, or an authorized function needs it and nothing else will work. Examples include tax reporting under 26 U.S.C. 6109, payroll and benefits, and the taxpayer identification number that 31 U.S.C. 7701 requires from people who do business with the Organization.
2. No workable alternative. The System Owner has considered alternatives and found none that works. Alternatives include an identifier the Organization assigns, an Employer Identification Number (EIN) for a business, or a combination of other data, such as name and date of birth.

Staff must collect only as much of the SSN as the function needs. If either condition is not met, staff must not collect or use the SSN.

A truncated SSN, such as the last four digits, reduces exposure but is still personally identifiable information (PII), and staff must still protect it.

3. Rights of People Asked for an SSN #

The Organization must not deny any person a right, benefit, or privilege provided by law because the person declines to give an SSN. Section 7 of the Privacy Act allows only two exceptions. The first is when a federal statute requires the SSN. The second is a system of records that existed and required the SSN under a statute or regulation adopted before January 1, 1975. Office of Personnel Management (OPM) rules apply the same test to personnel records.

Each form or request for an SSN must tell the person:

• Whether giving the SSN is mandatory or voluntary.
• The statute or other authority that allows the Organization to ask for it.
• How the Organization will use it.

When the SSN goes into a Privacy Act system of records, this notice is part of the Privacy Act statement. The Privacy Officer makes sure each Privacy Act statement on a form that asks for an SSN includes it.

4. Taxpayer Identification Numbers From People Doing Business With the Organization #

Federal law requires the Organization to get a taxpayer identification number (TIN) from each person who does business with it. This includes contractors, lenders and borrowers in loan and guarantee programs, insurance applicants, and loan guarantors. For an individual, the TIN is usually the person’s SSN.

When the Organization asks for a TIN, it must tell the person that it may use the number to collect and report any amount the person owes. The Federal Acquisition Regulation (FAR) Taxpayer Identification provision gives this notice in solicitations. The Organization must also include each payee’s TIN on each certified payment voucher.

When an individual gives an SSN as a TIN, every SSN rule in this policy applies to it.

5. Individual Taxpayer Identification Numbers #

The Internal Revenue Service (IRS) issues an Individual Taxpayer Identification Number (ITIN) to a person who cannot get an SSN. Federal law does not treat an ITIN as an SSN. The SSN-only rules in this policy do not apply to ITINs. These include the Privacy Act rights of people who decline to give an SSN, the mailing rule, and the rules on checks and on prisoner access.

The rules that cover all TINs do apply to ITINs. These are the TIN collection, notice, and voucher rules, and the IRS rule on truncated TINs. The Organization protects ITINs as PII under the PII Processing and Transparency Policy (POL-PT).

6. Roles and Responsibilities #

7. Approving and Reviewing SSN Use #

The Organization uses its existing privacy compliance process for SSNs. It does not use a separate approval process.

1. Before a system or form starts collecting SSNs, the System Owner records the need and the alternatives considered in the PTA, and in the PIA when one is required.
2. The SAOP approves the use when approving the PTA or PIA. The SAOP must not approve a use that fails the conditions in this policy.
3. When a PTA or PIA is reviewed or updated, the System Owner confirms that each SSN use still meets this policy and stops any use that does not.
4. Each year, the SAOP records the steps the Organization took to eliminate unnecessary SSN use and to explore alternatives.

Evidence: the approved PTAs and PIAs, and the SAOP’s yearly record of reduction steps. OMB does not require a separate SSN inventory, but the Organization must keep enough records to show that it meets these rules.

8. Handling Rules #

Staff and contractors must follow these rules for SSNs:

• Protection. Staff must protect SSNs in storage and in transit under the System and Communications Protection Policy (POL-SC), and must store them only in systems authorized to hold them.
• Mail. Staff must not put an SSN on any document sent by mail unless the head of the agency, or the official the head of the agency names in writing, has determined that it is necessary. An SSN must never be visible on the outside of an envelope or package. A Chief Financial Officers Act agency must also issue regulations that set when an SSN on a mailed document is necessary, with instructions for partial redaction where feasible.
• Checks. The Organization must not display an SSN, or any part of one, on any check it issues for a payment.
• Tax forms. On payee copies of IRS information returns, such as Form 1099, the Organization may show a truncated TIN in the form XXX-XX-1234, as IRS rules allow. It must show the full number on anything filed with the IRS or the Social Security Administration.
• Audit records. A system may record an SSN in its audit records only when its privacy risk assessment identifies the SSN as needed.
• Identity proofing. A system that verifies identity may collect an SSN only when it needs the SSN to tell people apart. Knowing an SSN never proves a person’s identity. A service provider that collects SSNs for the Organization must give the person notice, as the identity proofing volume of NIST SP 800-63-4 requires.
• Federal tax information. If a system receives TINs or other tax data from the IRS, that data is federal tax information. The System Owner must protect it under IRS Publication 1075. TINs that people give the Organization directly are not federal tax information.

9. Breach Reporting #

Anyone who suspects that an SSN has been lost, exposed, or used without authority must report it to the Security Operations Center (SOC) at once. The SOC and the SAOP handle the report under the Incident Response Plan (PLAN-IR-001) and the Breach Response Plan (PLAN-BR-001), which implements OMB Memorandum M-17-12. M-17-12 treats an SSN as a data element that alone can put a person at increased risk of harm. When SSNs are involved, the SAOP uses the Federal Trade Commission’s guidance at IdentityTheft.gov to advise affected people. The SAOP also decides whether the Organization will offer services such as credit monitoring.

10. Compliance and Penalties #

Violations of this policy may lead to disciplinary action. Contractors who violate it may face action under their contract.

Federal law also sets criminal penalties. Federal employees must keep confidential the SSNs they obtain under laws enacted on or after October 1, 1990, and willful unauthorized disclosure is a crime. It is a felony for anyone to disclose, use, or compel the disclosure of an SSN in violation of federal law.

11. Reporting to OMB #

The SAOP answers the SSN questions in the annual FISMA privacy report through CyberScope. OMB asks whether the Organization has a written policy with specific criteria for new SSN collections, and a process to confirm that each use stays necessary. This policy and the PTA and PIA process meet those requirements. This policy is an internal document, and the Organization is not required to post it publicly.

12. Sources of Each Requirement #

13. References #

These are the sources this document cites, with a link to each official text.

• 5 CFR § 293.105: Personnel Records, current text.
• 26 CFR §§ 301.6109-1, 301.6109-4: Taxpayer identifying numbers and truncated TINs, current text.
• Executive Order 9397: Numbering System for Federal Accounts Relating to Individual Persons, November 22, 1943.
• Executive Order 13478: Amendments to Executive Order 9397 Relating to Federal Agency Use of Social Security Numbers, November 18, 2008.
• FAR 52.204-3: Taxpayer Identification, October 1998.
• Federal Acquisition Regulation (FAR), current text.
• Identifying numbers (26 U.S.C. § 6109).
• IRS Publication 1075, Tax Information Security Guidelines for Federal, State and Local Agencies, November 2021.
• NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations, September 2020.
• NIST SP 800-63-4: Digital Identity Guidelines, July 31, 2025.
• OMB Circular A-130: Managing Information as a Strategic Resource, July 28, 2016.
• OMB M-17-12: Preparing for and Responding to a Breach of Personally Identifiable Information, May 22, 2017.
• Privacy Act of 1974 (5 U.S.C. § 552a), December 31, 1974.
• Social Security Act section 205(c)(2)(C): Social Security number confidentiality, and no display on checks or access by prisoners (42 U.S.C. § 405(c)(2)(C)(viii), (xi), (xii); 42 U.S.C. § 408(a)(8)), current text.
• Social Security Number Fraud Prevention Act of 2017 (Pub. L. 115-59), September 15, 2017.
• Taxpayer identifying number from persons doing business with an agency (31 U.S.C. § 7701(c)).
• Vouchers: taxpayer identifying number of each payee (31 U.S.C. § 3325(d)).