The Associated Press (AP) is reporting the Personnel Department of the State of Nevada has lost track of at least 470 compact discs (CDs) containing the social security numbers and payroll information for state employees during the past three years. The Personnel Department has sent more than 13,000 CDs to 80 agencies for processing every-two week pay period during the past three years.
The State of Nevada is enacting changes to ensure this type of data loss does not happen again including:
- Discs will be signed for and returned to the Personnel Department after every pay period
- Passwords will be required to read data stored on CDs
- State employee information will be correlated to unique employee ID numbers instead of social security numbers
In my opinion, these public relation driven policy changes are window dressing rather than substantive data security, access, and audit controls to prevent the misuse of sensitive personal and financial information for state employees.
It is time government agencies do a better job of protecting our personal and financial information.
Jaime G. Chanaga, CISSP, CISA is founder and CEO of The CSO Board, a management consulting firm dedicated to helping leaders and organizations solve critical strategic issues make lasting substantial improvements in their performance. He is also an Editorial Advisory Board Member for 
