Stay Informed
of New Reports
Twitter
Where To Report Waste
Fraud, Abuse, Or Retaliation
Where To Report Waste Fraud, Abuse, Or Retaliation

Report of Investigation Regarding the 2019 Clearinghouse Data Breach

Related Open Recommendations

Recommendation Number Recommendation Status Significant Recommendation Additional Details
1 Open Yes
Reconvene the BRT to assess the full extent of the breach, and base its response on the totality of the breach.
2 Open No
Establish blanket purchase agreements for identity monitoring, credit monitoring, and other related services for data breach victims.
3 Open No
Complete and publish a document describing lessons learned after the BRT completes its work related to this breach.
4 Open No
Complete and document annual tabletop exercises. The tabletop exercises test the breach response plan and help ensure that members of the team are familiar with the plan and understand their specific roles. Tabletop exercises should be used to practice a coordinated response to a breach, to further refine and validate the breach response plan, and to identify potential weaknesses in the agency's response capabilities.
5 Open No
Conduct an annual Breach Response Policy plan review.
6 Open No
Establish and complete an annual schedule to review blanket purchase agreements for adequacy, complete and document the tabletop exercise, and publish the updated annual Breach Response Policy plan review.
12 Open Yes
Review all available data and establish an accurate identification of all data inadvertently released, internally and externally, from 2010 to 2019.
13 Open Yes
Obtain an independent review of a sample of Clearinghouse responses prior to 2010 to determine the need for an expanded scope of the review.
14 Open Yes
Establish policies and procedures to ensure that when the agency reports data related to a data breach or other violation of law or regulation, the reported data has been independently verified by a person outside of the responsible organization.
15 Open Yes
Establish a process for communicating and enforcing the implementation of recommendations previously agreed to by management, as required by law.

Pages

Displaying 10 of 27 Recommendations