Commissioned Corps BulletinNovember 22, 2016

Extended Deadlines due to CCMIS Outage

Letter to the Corps from DCCPR Director, RADM Joan Hunter

Dear Commissioned Corps Officers,

As you may know, on Friday, November 18, we safely restored access to the Commissioned Corps Management Information System (CCMIS) available at https://dcp.psc.gov/ccmis. The system had been disabled while we made technical fixes and rigorously test those fixes following a security issue we confirmed in October.

While CCMIS remains online and is secure, users are experiencing difficulty logging onto the system due to high volume and demand. We are taking a number of steps to mitigate this issue by increasing capacity and decreasing immediate demand on the system. Accordingly, we are further extending COERs deadlines to allow officers additional time to submit this information. Revised deadlines are outlined in the table below. Officers will not be penalized for missing previous document submission deadlines or readiness checks due to inaccessibility of the system. Officers eligible for promotion should see a notification in the officer secure area of CCMIS.

Additionally, we have updated the FAQs on this issue, which are below and available at https://www.surgeongeneral.gov/ccinfo. If you have additional questions or feedback, please use the dedicated email address for this issue: CCinfo@hhs.gov.

Thank you for your patience and professionalism while we continue to improve CCMIS.

Sincerely,

RADM Joan Hunter, BSN, RN, MSW
Director, Division of Commissioned Corps Personnel and Readiness
U.S. Public Health Service (USPHS) Commissioned Corps

Extended deadlines for human resources-related requirements in CCMIS

Frequently Asked Questions about the Commissioned Corps Management Information System

Q. I am having difficulty logging onto CCMIS because of capacity issues. What if I am not able to submit my information by the deadline?
A. We are aware that CCMIS users are experiencing difficulty logging onto the system, and we are taking steps to increase capacity and decrease immediate demand on the system. We are further extending COERs deadlines to allow officers additional time to submit this information. Revised deadlines are outlined in the table below. Officers will not be penalized for missing previous document submission deadlines or readiness checks due to inaccessibility of the system.

Q. How should I manage my human resources responsibilities now that the system is back online?
A. The Commissioned Corps Management Information System (CCMIS) is now operational and available for your use at https://dcp.psc.gov/ccmis. The process for completing and submitting Commissioned Officer's Effectiveness Reports (COERS), processing personnel orders including onboarding, transfers, and retirement, and uploading documents including vaccination records into your eOPF has not changed. Due to the disruption in availability of CCMIS we have extended deadlines for completing human resources responsibilities, which are outlined in the table below. Officers will not be penalized for missing previous document submission deadlines or readiness checks due to inaccessibility of the system. Leave request submissions continue to be completed via Direct Access.

Q. Is the system now secure?
A. Since we disabled the CCMIS website in September, we have been working to make technical fixes to the system and rigorously test those fixes. Following these fixes and testing, we are satisfied that the system has the security measures in place to safely restore access to CCMIS. We sincerely appreciate your patience while we worked to secure the system and bring it back online.

Q. Now that CCMIS is back online, will I be able to access information resources such as protocols, guidance documents, training modules, and my previous COERs?
A. Now that access to CCMIS is restored, most information is available. Portions of the Officer Secure Area are still undergoing revision. The public content on CCMIS (areas not requiring a login) is available. Location of this information on the website has not changed. If you have any questions, please submit your request to CCinfo@hhs.gov. We will be in touch with you as soon as possible.

Q. Will this impact my readiness status?
A. The next readiness check deadline is January 31, 2017. All basic readiness documents are required to be uploaded via eDOC-U by January 31, 2017.

Q. What steps are you taking to protect employees? Will you provide us access to identity protection services? Will my dependents, including my children under age 18, also be provided services?
A. We are committed to protecting the privacy of Corps officers and their family members. Any issue of this kind is one issue too many. We took prompt action to address the issue, including by disabling the website. Because we take the need to protect your personally identifiable information very seriously, we are working to finalize plans to offer services for affected individuals. Once those plans are finalized, we will provide you with further information about those services. We will continue to communicate with you as we have additional information to share.

Q. Will this impact my pay?
A. This issue did not affect our ability to process September, October, or November payroll and we do not expect it to affect our electronic processing of payroll moving forward.

Q. Who is affected?
We received questions from people in specific circumstances trying to confirm whether they are affected by this issue, including: “Does this apply to civil servant supervisors of Commissioned Officers who are responsible for granting leave? If I served in the Corps over 20 years ago, is it likely that my data was compromised? How will I know if I or my family member was I impacted by this issue?”
A. The issue relates to an application on a website that exclusively serves the Commissioned Corps and their unique needs, and the database contains Personally Identifiable Information (PII) information related to current, retired, and former Commissioned Corps officers and their dependents. We have confirmed that unauthenticated users could access names, Social Security numbers, and dates of birth, but we see no evidence that unauthenticated users could have accessed any additional information.

Q. If I did not receive an email, does that mean I am not affected?
A. Through our email on October 3 and subsequent follow up emails, we intended to reach as many Corps officers as possible who may have been affected, but we were only able to send email notifications to current, former, and retired Corps officers who have a current email address on file with us. If you did not receive an email or if you know a retired officer or dependent who would like to be added to our email list, please send a request to CCinfo@hhs.gov.

Q. What types of information was involved and what happened in the system?
We received several questions asking about specific types of information and any activities by potential bad actors, including, “Did unauthorized user(s) actually access the system?” and “Were bank account numbers accessed?”
A.We have confirmed that unauthenticated users could access names, Social Security numbers, and dates of birth, but we see no evidence that unauthenticated users could have accessed any additional information. We are not able to determine whether unauthenticated users other than the Corps officers who reported the issue to us accessed this information.

Q. Is this issue different from breaches of government data sources such as OPM?
A. Commissioned Corps Headquarters (CCHQ) has confirmed that unauthenticated users could access personally identifiable information (PII) in the Commissioned Corps Management Information System (CCMIS), which is used to manage some human resources functions and payroll for the Commissioned Corps. We have confirmed that unauthenticated users could access names, Social Security numbers, and dates of birth, but we see no evidence that unauthenticated users could have accessed any additional information. We are not able to determine whether unauthenticated users other than the Corps officers who reported the issue to us accessed this information. If you have questions about the OPM breach, please visit www.opm.gov.

Q. Does this issue affect the Direct Access system as well?
A.We are not aware of any evidence that the issue affecting the Commissioned Corps Management Information System (CCMIS) impacts the Direct Access system managed by the U.S. Coast Guard. The issue relates to an application on a website that exclusively serves the Commissioned Corps and their unique needs, and the database contains information related to current, retired, and former Commissioned Corps officers and their dependents.

Q. What was the “test” email I received on October 2, 2016?
A. The “test” email sent on the evening of October 2, 2016 was the USPHS testing its email listserv.

Q. What should I do now?
A. You may wish to review your credit reports for any information that you do not recognize or that is incorrect. You may request a free credit report from one or more of the three national credit bureaus:

Each consumer is entitled to one free credit report per year from each of the three national credit bureaus. You may want to stagger your requests, requesting one from a different credit bureau every 4 months to have a better chance of finding any potential problem. You may ask for credit reports at https://www.annualcreditreport.com. This is the only authorized Web site for getting your free annual credit report under Federal law.

• Review your account statements.
  Review and monitor your financial accounts, including bank accounts and credit card statements. If you see any unusual or suspicious activity, report it promptly to your financial institution.
  
• Contact the Federal Trade Commission (FTC).
  You may contact the FTC for more information about protecting your credit, including how to place a "fraud alert" or "security freeze" on your credit account, by calling its toll-free number at (877) 438-4338 or by visiting FTC's Web site at www.consumer.gov/idtheft.
  
• Contact your State's Attorney General.
  In addition to the FTC, you may obtain information about preventing identity theft from your state's attorney general.
  
• Lookout for scammers.
  We will not contact you to confirm any personal information. If you or a family member are contacted by anyone asking for your personal information in relation to this situation, do not provide it and please report the incident to CCinfo@hhs.gov.

Newer articles Earlier articles