Careers

Diversity, Equity & Inclusion

Experience

Innovation

Interactive Maps

Locations

About

Pages

Meet our team of innovators
Ask us how we do it

Professionals

Insights

Services

Thompson Hine LLP, a full-service business law firm with approximately 400 lawyers in 8 offices, was ranked number 1 in the category “Most innovative North American law firms: New working models” by The Financial Times and was 1 of 7 firms shortlisted for The American Lawyer’s inaugural Legal Services Innovation Award. The firm has been recognized by the National Law Journal as a Legal Technology Trailblazer and featured by Bloomberg for its innovative service delivery models, which drive accuracy and predictability. The firm’s commitment to innovation is embodied in Thompson Hine SmartPaTHTM – a smarter way to work – predictable, efficient and aligned with client goals. For more information, please visit ThompsonHine.com and ThompsonHine.com/SmartPaTH.

Home | Thompson Hine LLP

Atlanta

Chicago

Cincinnati

Cleveland

Columbus

Dayton

New York

Washington, D.C.

In light of persistent and pervasive high-profile data breaches involving the federal government’s controlled unclassified information (CUI), the U.S. Department of Homeland Security (DHS) amended its contractor acquisition framework to “demonstrate the need to ensure that information security protections are clearly, effectively, and consistently addressed in [DHS] contracts.” Specifically, a new DHS information security and data breach notification<a> </a><a href="https://www.federalregister.gov/documents/2023/06/21/2023-11270/homeland-security-acquisition-regulation-safeguarding-of-controlled-unclassified-information" target="_blank" rel="noreferrer noopener">procurement rule</a> impacting its contractors and subcontractors went into effect on July 21.

contentpilot/introduction

The new DHS rule adds a new clause (Safeguarding of Controlled Unclassified Information) to the Homeland Security Acquisition Regulation (HSAR) that addresses a broad range of information security requirements. Although DHS noted that “there is no ‘true’ way to completely prevent an incident from occurring” and “there is no such thing as an ‘unhackable’ system,” its new rule sets forth information security requirements, including exceptionally stringent data breach notification timelines.

core/paragraph

core/heading

The new HSAR rule primarily applies where private-sector contractor information systems are operated on behalf of a U.S. government entity (such as a <a>DHS Component Agency</a>). In such circumstances, the contractor information system is considered a federal information system and is therefore subject to the same security requirements as federal information systems. Accordingly, the new HSAR rule identifies the security and process requirements such systems must meet before they are able to operate on behalf of an applicable government agency. Importantly, the rule does not identify any security requirements or processes for information systems that are not categorized as federal information systems. In other words, the new HSAR rule “is intentionally silent” on the security requirements that may apply to nonfederal information systems, such as NIST 800-171, because such requirements are being developed through a separate regulatory process.

The HSAR rule defines an “incident” as “an occurrence that (1) [a]ctually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) [c]onstitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.”

Under the new rule, a subset of DHS contractors and subcontractors must report all known or suspected incidents to the DHS Component Security Operations Center (SOC) in accordance with Attachment F, Incident Response, to DHS Policy Directive 4300A, Information Technology System Security Program, Sensitive Systems, or if the Component SOC is not available, to the <a>DHS Enterprise SOC</a>. DHS subcontractors are required to notify the prime contractor that they have reported a known or suspected incident to DHS, and lower-tier subcontractors are required to likewise notify their higher-tier subcontractor until the prime contractor is reached.

In addition, the new HSAR rule requires a subset of DHS contractors to report known or suspected incidents that involve personally identifiable information (PII) and sensitive personally identifiable information (SPII) within one hour of discovery and all other incidents (such as those impacting any other category of CUI) within eight hours of discovery.

PII refers to information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other information that is linked or linkable to a specific individual. SPII is a subset of PII that if lost, compromised, or disclosed without authorization could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. According to DHS, “[c]ertain data elements are particularly sensitive and may alone present an increased risk of harm to the individual,” such as Social Security numbers, driver’s license or state identification numbers, <a>Alien Registration Numbers</a>, financial account numbers, and biometric identifiers.

These DHS contractors must also provide several data elements if available at the time the incident is reported, with any remaining data elements provided within 24 hours of submitting the initial incident report, including (but not limited to):

core/list

In responding to a security incident, certain levels of DHS contractors must “immediately preserve and protect images of known affected information systems and all available monitoring/packet capture data,” and such data must be retained for at least 180 days from submission of the incident report to allow DHS to request the media or decline interest. DHS may, at its sole discretion, obtain assistance from other federal agencies and/or third-party firms to aid in incident response activities.

Incident reporting required by the new HSAR clause does not in any manner rescind the contractor’s responsibility for other incident reporting pertaining to its unclassified information systems or as a result of other applicable statutory or regulatory requirements or other U.S. government requirements.

When data security incidents impact PII or SPII, the new HSAR rule provides that certain contractors mustnotify affected individual within five business days after being directed by the DHS contracting officer, or as otherwise required by applicable law. The method and content of any notification by the contractor shall be coordinated with, and subject to prior written approval by, the <a>DHS contracting officer</a>. However, the contractor may not proceed with notification unless directed in writing by the contracting officer.

The notification method may consist of letters to affected individuals sent by first-class mail, electronic means, or general public notice, as approved by the government. Notification may require the contractor’s use of address verification and/or address location services. At a minimum, the notification shall include:

The DHS contracting officer may direct the contractor to provide credit monitoring services to affected individuals for at least 18 months from the date the individual is notified and may include triple credit bureau monitoring, daily customer service, alerts provided to the individual for changes and fraud, and assistance to the individual with enrollment in the services and the use of fraud alerts. The contractor may also be required to establish a dedicated call center to assist affected individuals with respect to monitoring and enrollment processes and issues.

Upon the conclusion of the contract by expiration, termination, cancellation, or as otherwise indicated in the contract, the contractor shall return all CUI to DHS and/or destroy it physically and/or logically as identified in the contract unless the contract states that return and/or destruction of CUI is not required. According to the new HSAR rule, such destruction shall conform to the guidelines for media sanitization contained in NIST SP 800–88, Guidelines for Media Sanitization. The contractor shall certify and confirm the sanitization of all government and government activity-related files and information.

This advisory bulletin may be reproduced, in whole or in part, with the prior permission of Thompson Hine LLP and acknowledgment of its source and copyright. This publication is intended to inform clients about legal matters of current interest. It is not intended as legal advice. Readers should not act upon the information contained in it without professional counsel.

This document may be considered attorney advertising in some jurisdictions.

https://admin.thompsonhine.com/wp-content/uploads/2023/07/Privacy-Cybersecurity-Update-New-Data-Security-and-Breach-Notification-Obligation-for-DHS-Contractors.pdf

New Data Security and Breach Notification Obligation for DHS Contractors

Services