In the past couple of months, the Department of Veterans Affairs, the Internal Revenue Service and the Federal Trade Commission have grappled with laptops that have gone missing that contained large amounts of private data.

As a consequence, the Executive Office of the President, Office of Management and Budget (OMB), has issued new security guidelines to address and compensate for the lack of physical security controls when information is removed from or accessed from outside of federal department and agency locations.

Specifically, the OMB recommends that all departments and agencies:

1. Encrypt all data on mobile computers/devices that carry governmental data unless the data is determined to be non-sensitive;
2. Allow remote access only with "two-factor" authentication where one of the factors is provided by a device separate from the computer gaining access;
3. Use a "time-out" function for remote access and mobile devices that requires user re-authentication after 30 minutes of inactivity; and
4. Log all computer-readable data extracts from databases holding sensitive information, and verify that each extract including sensitive data has been erased within 90 days or that its use is still required.

The purpose of the foregoing, as stated by OMB, is "to properly safeguard our information assets while using information technology." While stopping short of issuing requirements, and instead promulgating recommendations, OMB nevertheless asks that the above safeguards be put in place within 45 days by federal departments and agencies.

Hopefully, the expression "good enough for government work" soon will include federal action with respect to OMB's recommendations, and we will stop hearing about misplaced government laptops that contain easily accessible sensitive data.

Biography

Eric Sinrod is a partner in the San Francisco office of Duane Morris. His focus includes information technology and intellectual property disputes. To receive his weekly columns, send an e-mail to with the word "Subscribe" in the subject line.

Disclaimer: This column is prepared and published for informational purposes only and should not be construed as legal advice. The views expressed in this column are those of the author and do not necessarily reflect the views of the author's law firm or its individual partners.

Reprinted with permission of Findlaw.com