OSD Records and Declassification Programs

System of Records Notices (SORNs)

• DOD/JOINT STAFF COMPONENT SORNS
• GOVERNMENT-WIDE NOTICES




































































 
•  
•  
•  
•  
•  
•  
•  
•  
•  
•  
•  
•  
•  
•  
•  
•  
•  
•  
•  
•  
•  
•  
•  
•  
•  
•  
•  
•  
•  
•  
•  
•  
•  
•  
•  
•  
•  
•  
•  
•  
•  
•  
•  
•  
•  
•  
•  
•  
•  
•  
•  
•  
•  
•  
•  
•  
•  
•  
•  
•  
•  
•  

1. Log into:

• eCasePortal
• and follow the step-by-step instructions below:
  • Instructions to submit a breach
   

  If you have questions, please reach out to the WHS/RDD Privacy Office at: whs.mc-alex.rsrcmgmt.list.esd-osd-js-privacy-office-mbx@mail.mil or jeanette.s.whiten.civ@mail.mil

  2. Report the Breach to your Senior Component Official for Privacy and OSD/JS Privacy Program.

  If there is a suspected or confirmed Privacy breach, report it immediately, fill out the Form DD 2959, Breach of Personally Identifiable Information (PII) Report.

  After you complete the form, submit it to the DoD Privacy Office within 24 hours after discovery. NOTE: This form should also be used to report updates to previous submissions.

   

  3. Conduct and document an assessment of the risk of harm to individuals potentially affected. If determined and approved by your senior leadership, notify the affected individuals of the breach.

  Notification must be made within 10 days of the discovery of the incident. You will need to have the mailing address for each affected individual and be able to address the unique issue(s) pertaining to each breach. See DoD 5400.11-R, Appendix 2 for a sample notification letter.

  For further information, see DoD 5400.11-R, paragraph C10.6, Lost, Stolen or Compromised Information.

   

  4. Notify the appropriate Congressional Committee pursuant to FISMA no later than seven days after the date on which there is reasonable basis to conclude that a breach that constitutes a “major incident” has occurred.

  A "major incident" is defined as “any incident that is likely to result in demonstrable harm to the national security interests, foreign relations, or economy of the United States or to the public confidence, civil liberties, or public health and safety of the American people.”

  The impacted agency is ultimately responsible for determining if an incident should be designated as major and may consult with US-CERT to make this determination. (See OMB Memorandum M-17-05, dated Nov. 4, 2016).