In 2016, the Social Security Administration suddenly began requiring security certification for companies accessing the SSA Death Master File. LBMC Cybersecurity quickly became one of the first companies offering ACAB certification assessments.
Today, we are among the most experienced LADMF certification firms in the nation. We follow the NIST Cybersecurity Framework and the NTIS LADMF Certification Program Publication 100 to meet the rule’s requirements, including:
- Information Secure Storage
- Restricting Access to LADMF Information
- Disposing of Limited Access DMF Information
- Information Security guidance in accordance with ACAB requirements
Additionally, we conduct an initial scoping of the environment to determine, based on how and where the LADMF is handled, the extent to which we can “pull-forward” testing results from any previous assessments. Upon completion of the assessment and the satisfactory completion of any associated remediation efforts, LBMC Cybersecurity submits a completed LADMF ACAB Systems Safeguards Attestation Form (Form NTIS FM100A) in accordance with NTIS procedures, to the NTIS on our client’s behalf.
What is ACAB LADMF?
What is ACAB?
ACAB is an Accredited Conformity Assessment Body that certifies compliance with regulatory standards.
What is LADMF?
LADMF stands for Limited Access Death Master File, a controlled database of death records used to verify deceased individuals and prevent fraud.
What is SSA?
The Social Security Administration (SSA) is the U.S. government agency managing social security programs, including retirement and disability benefits.
What is NTIS?
The National Technical Information Service (NTIS) provides access to government-generated scientific and technical information.
What is NIST?
The National Institute of Standards and Technology (NIST) develops measurement standards to support U.S. industry competitiveness.
ACAB and LADMF Compliance: Rules for Accessing Data of the Deceased
Organizations who utilize government data to monitor and track deaths in the U.S. know it is no longer the simple process it once was. The Death Master File (DMF) data, governed by the U.S. Department of Commerce National Technical Information Service (NTIS), is commonly referenced by healthcare providers, insurance companies, and financial institutions, among others, to identify concerns such as expired account holders and fraudulent activities.
The NTIS cybersecurity standards were called for as part of the 2013 Bipartisan Budget Act and ultimately were established through a final rule published on November 28, 2016. The new rule prohibits the Secretary of Commerce from disclosing DMF information during the three-calendar-year period following an individual’s death LADMF. The only entities who can access this data must be certified to receive that information.
In short, organizations requesting access to LADMF data must:
- Attest to the security of the systems and processes utilized in the acquisition and management of this data.
- Gain an assessment by a reputable independent party, otherwise known as an Accredited Conformity Assessment Body (ACAB), against an established cybersecurity standard.
- The submitted assessment must be in line with security control requirements documented in the LADMF Certification Program (Publication 100). Security controls listed in Publication 100 are “not intended to be prescriptive” and that results of an assessment against other established standards or in the course of satisfying other regulations, can satisfy the LADMF security and safeguard requirements.
- Then the assessor will submit an attestation form to the NTIS on behalf of the applicant after which, subject to acceptance of the attestation and associated fees, the applicant is provided access to LADMF data.
Fortunately, this assessment can be addressed as a component of other security assessment programs and, according to the NTIS website, must only be completed every three years in addition to annual certification and fee requirements.
LBMC Cybersecurity is an Accredited Conformity Assessment Body. To request a private briefing, or for questions about the NTIS LADMF certification program, contact us today.
Executive Team
Drew Hendrickson
Shareholder & Practice Leader, Cybersecurity
Nashville
Nashville