CUI Statistical: Collaborative Efforts of Federal Statistical Agencies

1. CUI Statistical:Collaborative Efforts of Federal Statistical Agencies Eve Powell-Griner National Center for Health Statistics

2. Background • November 2010 – Interagency Council on Statistical Policy (ICSP) suggested a unified federal statistical agency response to EO 13556 • Chief Statistician of OMB established a CUI Taskforce under ICSP auspices

3. Taskforce Membership • Bureau of Economic Analysis • Bureau of Justice Statistics • Bureau of Labor Statistics • Bureau of Transportation Statistics • Census Bureau • Economic Research Service • Energy Information Administration • Office of Environmental Information, EPA • Federal Reserve Board • National Agricultural Statistics Service • National Center for Education Statistics • National Center for Health Statistics • NCSES, National Science Foundation • Office of Management and Budget • Office of Research, Evaluation, and Statistics, SSA • Statistics of Income Division, IRS • Center for Behavioral Health Statistics and Quality, SAMHSA

4. Taskforce Process • Collaborative effort focusing on common objective rather than individual agencies • Regular consultation with Executive Agent, NARA for guidance and concurrence • Provided draft materials to ICSP • Briefed statistical agency heads

5. Taskforce Products • CUI Statistical Matrix • CUI Statistical Best Practices

6. CUI Statistical Matrix • Contents • Definition and description of category • Proposed marking • Authority– statutes citations • Federal Regulation (CFR) • Government-wide policy • Required safeguarding controls • Required dissemination controls

7. Definition of CUI Statistical • Information collected by a Federal statistical agency, unit, or program • for statistical purposes or used for statistical activities • under law, regulation, or Government-wide policy such 'Statistical' CUI requires • (1) protection from unauthorized disclosure • (2) special handling safeguards; and/or • (3) prescribed limits on access or dissemination

8. Authorities • (1) Pub. L. 107-347, Confidential Information Protection and Statistical Efficiency Act of 2002 (CIPSEA), Title V of the E-Government Act of 2002 • (2) 5 USC 552a, Privacy Act of 1974 • (3) 5 USC. 552, exemptions 3, 4, and 6, Freedom of Information Act • (4) 18 USC 1905, Trade Secrets Act • other agency specific items as identified in attachments

9. Government-Wide Policy • OMB Directives, Circulars and Guidance • Release and Dissemination of Statistical Products Produced by Federal Statistical Agencies • Safeguarding Personally Identifiable Information • Implementing the Privacy Provisions of the E-Government Act of 2002 • Reporting Incidents Involving Personally Identifiable Information • Sharing Data While Protecting Privacy • NIST Guidance • SP 800-122, Guide to Protecting the Confidentiality of Personally Identifiable Information (PII)

10. Safeguarding and Dissemination Controls • (1) Federal Register Vol 72 No 115, 06/15/2007 Implementation Guidance for Title V of the E-Government Act, Confidential Information Protection and Statistical Efficiency Act of 2002 • (2) OMB Memorandum M-07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information • (3) NIST SP 800-53, Recommended Security Controls for Federal Information Systems and Organizations • (4) 44 USC 3541,Federal Information Security Management Act of 2002 (FISMA) • Plus other agency specific items as identified in attachments

11. CUI Statistical Best Practices • Memorandum from ICSP to the Executive Agent • Best practices offered as reference to each Executive Agency with a statistical agency/unit • Contents of Document • Purpose • Governance • Policy • Within the agency • With external entities • Training • Technology • Self-Inspection

12. Governance • Designate a person to oversee all procedures for handling CUI statistical • the statistical agency’s point of contact for CUI statistical, • coordinates CUI statistical policies with the Departmental Senior Agency Official for CUI, • responsible for the implementation of the statistical agency’s policies, procedures, training, and compliance with CUI statistical regulations.

13. Policy • Comply with general and agency-specific laws and regulations for CUI statistical, including maintaining confidentiality in a manner consistent with those laws and regulations • Inform those accessing CUI statistical that violations of laws and regulations protecting CUI statistical may subject persons to penalties • Develop CUI statistical access policies, guidelines, and practices addressing internal and external uses of CUI statistical

14. Policy Within the Agency • Secure storage • Safeguarding or dissemination controls • Labeling or markings • Statements describing appropriate safeguards; • Practices and procedures for transmitting & receiving CUI statistical; • Telework policies; • Records management of CUI statistical; and • Procedures for reporting loss or violation of conditions of use of CUI statistical.

15. Policy With External Entities • For permitted external access, require written agreements that include a clear and detailed description of: • the relevant laws and regulations protecting CUI statistical; • the purpose of the information sharing; • how the information will be used; • the timeline for which it will be available; • the process for returning and/or destroying the information at expiration of the agreement; and • the data protection plan, including CUI information transfer and storage processes. • Procedures for inspection of non-governmental external sites granted access to CUI statistical. • Procedures for security certification of governmental external sites granted access to CUI statistical.

16. Agency Personnel Training • CUI statistical training for agency personnel should cover • Labeling of CUI statistical information • Data management procedures • Access agreements with external entities including Interagency Agreements, Licenses, or Designated Agent Agreements. Track completion of training • Track completion of training

17. Training for Data Sharing Partners • CUI statistical training for data sharing partners should cover • Labeling and records management of CUI statistical information • Data management procedures • Description of processes to be followed when CUI statistical information is received from government agencies • Description of processes to be followed when CUI statistical information is destroyed and/or returned to government agencies

18. Technology • Develop and maintain information systems security where CUI statistical is accessed and stored at both the sending agency and receiving partner/agency • Establish appropriate administrative and technical safeguards consistent with FISMA and other controls to ensure the electronic and/or physical security of CUI statistical • Establish process for security breach monitoring and notification

19. Self-inspection • Provide self-inspection guidelines (modify existing guidelines or develop new guidelines) • Frequency • Ensuring purpose and time period for sharing is stated • Ensure general and agency-specific laws are being upheld

20. Challenges • Language in communicating with potential respondents • Effect on data sharing activity among federal agencies • Marking policies • Decontrol • Integrating Statistical CUI with other Agency categories