CALIFORNIA DEPARTMENT OF JUSTICE (4)

Home Browse Search

California Department of Justice Memorandum of Understanding Exhibit E, Breach Response EXHIBIT E BREACH RESPONSE 1. Discovery of Breach: Agency shall notify DOJ immediately by telephone call and email upon the discovery of any breach of security of any systems and/or files containing classified criminal justice data (in whatever form, paper or electronic) if the data involved was, or is reasonably believed to have been acquired by an unauthorized person, or there is an intrusion, potential loss, actual loss, or unauthorized use or disclosure of the data in violation of this MOU, this provision, or applicable state or federal law. Notification shall be provided to the DOJ Program and Technical Manager, the DOJ Information Security Officer and the DOJ Chief Information Officer. DOJ shall take: Prompt corrective action to mitigate any risks or damages involved with the breach and to protect the operating environment and Any action pertaining to such unauthorized disclosure required by applicable Federal and State laws and regulations. 2. Investigation of Breach. Agency shall immediately investigate such security incident, breach, or unauthorized use or disclosure of criminal justice data or any other confidential data. Within 24 hours of the discovery, Agency shall notify the DOJ Program and Technical Manager, the DOJ Information Security Officer and the DOJ Chief Information Officer of: I. The data elements involved and the extent of the data involved in the breach, II. A description of the unauthorized persons known or reasonably believed to have improperly used or disclosed confidential data, III. A description of where the confidential data is believed to have been improperly transmitted, sent, or utilized, IV. A description of the probable causes of the improper use or disclosure; and V. Whether Civil Code sections 1798.29 or 1798.82 or any other federal or state laws requiring individual notifications of breaches are triggered. VI. Full, detailed corrective action plan, including information on measures that were taken to halt and/or contain the Incident and/or Breach. 3. Written Report. Agency shall provide a written report of the investigation to the DOJ Program and Technical Manager, the DOJ Information Security Office and the DOJ Chief Information Officer within forty-eight (48) hours of the discovery of the breach or unauthorized use or disclosure. The report shall include, but not be limited to, the information specified above, as well as a full, detailed corrective action plan, including Revised 517/2019 Page 1 of 2