What does M-06-19 PII Reporting require?

• A. Requires reporting of potential PII data-breach events to Federal CERT within one hour of their discovery
• B. Requires quarterly PII inventories
• C. Requires breach notifications to the agency director within 24 hours
• D. Requires PII encryption across all devices

Answer: (A)

Rapid notification of PII incidents to US-CERT is what M-06-19 requires. When a federal agency discovers a potential PII data-breach event, it must report that event to US-CERT within one hour of discovery so incident responders can begin containment, assessment, and coordination. This one-hour deadline is meant to speed up response, limit exposure, and provide timely government-wide visibility and guidance. The requirement focuses on potential PII breach events, not routine inventories or encryption mandates, so the other options don’t capture what M-06-19 mandates.