Reevaluate the risk determination for the Veterans Health Administration Geographic Information System and determine if the system should be set to a security categorization level of “moderate” based on the personally identifiable information and other sensitive data maintained in the system.
Ensure the Data Breach Response Service director instructs staff associated with the incident response process that each security and privacy incident that occurs must be captured on a separate Privacy Security Events Tracking System ticket, confirms document investigation details are accurate, and reassesses whether the security incidents were a breach.