Ask an Assessor: Death Master File

The Death Master File (DMF) is a protected file that includes information regarding the deceased such as:

• Name
• Date of Birth
• Date of Death
• Social Security Number

Since November 28, 2016, organizations have faced a stricter certification process to be granted access to the DMF. In that time, A-LIGN has served as an Accredited Conformity Assessment Body (ACAB) that has submitted written attestation to validate that the appropriate controls are in place to maintain the confidentiality and security of DMF information. Senior Manager, Sue Wells, took the time to discuss the challenges that organizations face when seeking DMF certification and how A-LIGN can help.

Death Master File FAQ

What lessons have we learned from our DMF successes, as assessors, that we can utilize to help future clients that require DMF access?

Some of our DMF clients have never had any type of audit before, so there is a learning curve for those organizations to understand the process, such as document requests. For organizations that have never been certified before, they need to understand the steps to achieve certification:

1. A-LIGN conducts testing against the approved standard.
2. Once testing is complete, organizations must go to the National Technical Information Service (NTIS) website to pay the required fees. Organizations pay $1,575 annually for certification to NTIS, and an additional $525 every 3 years when 3^rd party certification must be completed again. These fees are separate from those paid to the ACAB for attestation, as they are paid directly to NTIS. Once fees are paid, the organization will be provided a processing number.
3. From there, organizations must obtain the attestation form from the NTIS website and provide A-LIGN with the processing number to complete the attestation.
4. A-LIGN files the attestation documentation.

What information do companies seeking DMF certification need to know regarding their vendors and how they may impact their ability to be certified?

If significant technical safeguards used to protect the DMF are provided by a third-party, they may have to obtain information directly from that third party to provide to A-LIGN, as the DMF attestation form does not provide for the ability to carve-out other organizations. In this event, the technical safeguards would need to be verified.

What standards can organizations certify against?

Since 2015, A-LIGN has successfully helped several organizations achieve certification by certifying against standards such as SOC 2, PCI DSS, and NIST 800-53.

Helping You Achieve DMF Certification

NTIS can conduct both scheduled and unscheduled compliance audits, and organizations that fail to comply with the set provisions may be subject to fines of up to $250,000 per year. As an ACAB, A-LIGN can attest to your organization’s ability to protect DMF information. We have extensive experience in testing the required controls and can guide your organization through the certification process with ease.