45 CFR §613.7

1. (a)A document that NSF sends by mail shall not include the Social Security number (SSN) of an individual, except where the NSF Director (or other agency official whom the NSF Director may designate) determines that it is necessary. If so, the SSN must be truncated to the extent feasible, as follows—
   1. (1)The document shall include no more than the last four digits of the SSN; or
   2. (2)If the document needs to include more digits, then only where they are:
      1. (i)Required by law (including, but not limited to, a statute, court order, or other legal mandate);
      2. (ii)Needed to identify a specific individual when no adequate substitute is available; or
      3. (iii)Needed to fulfill some other compelling NSF business need.
2. (b)No portion of an SSN may be visible on the outside of any NSF mailing.
3. (c)For purposes of this section, “mail” and “mailing” means printed documents or correspondence, and does not include emails or any other documents, correspondence, or communications in electronic form.
4. (d)The requirements of this section shall apply to mail sent by NSF, including mailings by a contractor on NSF's behalf, on or after October 24, 2022.