Physical Safeguards

Physical safeguarding of EIV data refers to steps that must be taken to help ensure the data is safe when stored electronically or in hardcopy and when transmitting data electronically.

1. Storing and Transmitting of Electronic EIV Data

   • a. EIV data stored electronically must be in a restricted access directory or, if placed on portable media, labeled appropriately and encrypted using a NIST compliant vendor. Similarly, all emails containing EIV data must be encrypted using a NIST compliant vendor. A list of compliant vendors can be found at: -

   • http://csrc.nist.gov/groups/STM/cmvp/documents/140 1/1401vend.htm.

   • b. The full nine-digit SSN for a tenant must not be included in emails or other electronic communications.

NOTE: The downloading of EIV data to mobile devices is not allowed for IPAs.

2. Hardcopy EIV Data

EIV data that is printed out must not be left unattended. The documents should be retrieved as soon as they are printed and, if possible, use a restricted printer, copier, or facsimile machine. When faxing EIV data, ensure there is someone waiting and ready to retrieve the fax as soon as it is received (printed). When mailing EIV data, the data must be sent to an office of the owner/management agent. EIV data must not be mailed to Independent Public Auditor offices.

3. Computer Security

The EIV system is set up to time out after 30 minutes of inactivity. This automatic safeguard should not be the only security measure taken. Individuals who use the EIV system should use a password protected screensaver and lock their computer when leaving their workspace. A

HUD Multifamily Occupancy Handbook Chapter 9: Enterprise Income Verification (EIV)

8/13

9-37

Section 6: EIV Resources user should not leave a computer unattended with EIV data displayed on the screen. It is also recommended that the EIV system be exited using the “X” at the top right of the screen which will remove the user from the entire WASS system.

4. Destroying EIV data

EIV data must be destroyed as soon as it has served its purpose as prescribed by HUD’s policies and procedures and in accordance with HUD’s prescribed retention period. Shredding, burning or pulverizing are all examples of acceptable ways to destroy EIV data.