1 Privacy Impact Assessment (PIA) for the Cyber Security Assessment and Management (CSAM) Certification & Accreditation (C&A) Web (SBU) Department of Justice Information Technology Security Staff (ITSS) April 11, 2007
3 Page 3 Table of Contents Approval Signature Page... 2 Table of Contents... 3 Introduction... 4 C&A Web PIA Framework (short-form PIA)... 5 Section 1.0: The System and the Information Collected and Stored within the System... 6 Section 2.0: The Purpose of the System and the Information Collected and Stored within the System... 6 Section 3.0: Uses of the system and the Information... 7 Section 4.0: Internal Sharing and Disclosure... 8 Section 5.0: External Sharing and Disclosure... 9 Section 6.0: Notice Section 8.0: Technical Access and Security Conclusion Appendix A: References Appendix B: Abbreviations and Acronyms... 21
4 Page 4 Introduction C&A Web provides the DOJ IT Security Program, Program Officials and IT Security managers with a web-based secure network capability to assess, document, manage and report on the status of IT security risk assessments and implementation of Federal and DOJ mandated IT security control standards and policies. FISMA emphasizes the need for each Federal agency to develop, document, and implement an enterprise-wide program to provide information security for the information and information systems that support the operations and assets of the agency including those provided or managed by another agency, contractor, or other sources. The Department s IT Security Program has been elevated and strengthened over the past few years. The DOJ IT Security Program now takes a Department-wide view of its information security program. Fundamental in this initiative was the need to develop and implement a coordinated and effective IT security program that is continuous, interactive, and fully integrated within IT architecture and investment processes. The C&A Web was collaboratively developed to be implemented within DOJ components as a streamlining initiative to achieve FISMA compliance and reporting requirements. C&A Web is a fundamental element of the DOJ IT Security Program enterprise architecture. It is an enterprise-wide tool for leveraging guidance from the National Institute of Standards and Technology (NIST), Office of Management and Budget (OMB), and industry best practices to assist the DOJ components in their IT security self-assessments and support management of FISMA reporting requirements. C&A Web fully supports the implementation of the policy and procedures in Department s IT Security Program. The networked version of the required capability is required to support Department IT security program goals, system inventory and POA&M management process, FISMA reporting, required DOJ OCIO oversight responsibilities, and support of certification and accreditation and continuous monitoring process. With the C&A Web s functionality, system owners are allowed timely access to security information about their systems. The employment of a networked capability for this information posting and retrieval will facilitate access by Department managers. C&A Web is critical to both C&A personnel and DOJ IT Security Program managers. C&A assessors will rely on the delivery of timely, detailed information and policy tool support related to IT Standards implementations. The use of the C&A Web application will enable system owners and security managers to obtain system performance information from a multitude of security related processes, while enabling the department and components to meet mandated enterprise and system reporting requirements.
5 Page 5 C&A Web PIA Framework The C&A Web PIA Framework provides programmatic information associated with the development and management of the C&A Web PIA. Document Compliance This C&A Web PIA complies with the Privacy Impact Assessment Official Guidance issues by the DOJ Privacy and Civil Liberties Office, effective August 7, Document Organization This C&A Web PIA applies the DOJ Privacy Impact Assessment Template (v3) (for a shortform PIA), as follows: Introduction Executive Overview Responses to questions, and summaries requested in Sections 1 through 6 and Section 8 of the afore-referenced template: (questions 1.1, 1.2, 2.1, 3.1, 4.1, 5.1, 6.2, 6.3, 8.9 apply) Conclusion Appendices Document Audience This document is intended for public access in accordance with OMB M Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002, Attachment A/1.A.1. Document Change Control This C&A Web PIA is subject to the ITSS Configuration Control process as documented in the ITSS Configuration Management Plan. C&A Web Contact Information Name: C&A Web-SBU Type System: Major Application System Owner: Lynn Henderson DOJ ITSS PIA Preparer: Ken Gandola DOJ ITSS
6 Page 6 Section 1.0 The System and the Information Collected and Stored within the System. The following questions are intended to define the scope of the information in the system, specifically the nature of the information and the sources from which it is obtained. The requirement to perform a Privacy Impact Assessment (PIA) for the C&A Web application was determined as a result of the Privacy Threshold Analysis (PTA) performed on the system. The PTA identified the requirement for a short-form PIA to be performed. Accordingly, the information follows for the following questions: 1.1, 1.2, 2.1, 3.1, 4.1, 5.1, 6.2, 6.3 and What information is to be collected? C&A Web includes the Information in Identifiable Form (IIF) listed below, as defined in OMB Memorandum M-03-22/Attachment A/II.A.2. Name: Company; Government Staff; Contractor Staff Address: Company; Government Staff; Contractor Staff Telephone Number: Company; Government Staff; Contractor Staff Staff ID: Government Staff; Contractor Staff Government Staff; Contractor Staff 1.2 From whom is the information collected? Information is collected from parties to, or participating in IT Security system assessments and certification activities. Information is also collected from DOJ government and contractor IT security personnel who support the DOJ IT Security Program mission. Section 2.0 The Purpose of the System and the Information Collected and Stored within the System. The following questions are intended to delineate clearly the purpose for which information is collected in the system.
7 Page Why is the information being collected? C&A Web fully supports the implementation of the policy and procedures in Department s IT Security Program. This networked application is required to support Department IT security program goals, system inventory and POA&M management process, FISMA reporting, required DOJ OCIO oversight responsibilities, and support of certification and accreditation and continuous monitoring process. With the C&A Web s functionality, system owners are allowed timely access to security information about their systems. The employment of a networked capability for this information posting and retrieval facilitates access by Department C&A testers, supervisors and managers. To adequately document the status of meeting implementation of any security controls, evidentiary data is captured about the testing procedure. This typically involves the collection of information about tester interviewees that will have their name, phone number, position, title, address and building location documented in the system. 2.2 What specific legal authorities, arrangements, and/or agreements authorize the collection of information? 2.3 Privacy Impact Analysis: Given the amount and type of information collected, as well as the purpose, discuss what privacy risks were identified and how they were mitigated. Section 3.0 Uses of the System and the Information. The following questions are intended to clearly delineate the intended uses of the information in the system. 3.1 Describe all uses of the information. The information that C&A Web application processes, stores and transmits is used to support the ITSS mission to implement the DOJ IT Security Program by ensuring the Confidentiality, Integrity and Availability of Information and Information Systems within DOJ. C&A Web stores a body of historic information in SQL databases that are accessible to authorized DOJ users via the Intranet or through tools such as Business Objects.
8 Page Does the system analyze data to assist users in identifying previously unknown areas of note, concern, or pattern? (Sometimes referred to as data mining.) 3.3 How will the information collected from individuals or derived from the system, including the system itself be checked for accuracy? 3.4 What is the retention period for the data in the system? Has the applicable retention schedule been approved by the National Archives and Records Administration (NARA)? 3.5 Privacy Impact Analysis: Describe any types of controls that may be in place to ensure that information is handled in accordance with the above described uses. Section 4.0 Internal Sharing and Disclosure of Information within the System. The following questions are intended to define the scope of sharing both within the Department of Justice and with other recipients.
9 Page With which internal components of the Department is the information shared? ITSS will share the C&A Web data, as appropriate, with the following internal components: Office of the Inspector General, All twenty-four DOJ components (utilizing three different versions of the application: one for SBU systems, one for classified systems, and one for the FBI). A separate PIA will be submitted for each of the three versions or systems. 4.2 For each recipient component or office, what information is shared and for what purpose? 4.3 How is the information transmitted or disclosed? 4.4 Privacy Impact Analysis: Given the internal sharing, discuss what privacy risks were identified and how they were mitigated. Section 5.0 External Sharing and Disclosure The following questions are intended to define the content, scope, and authority for information sharing external to DOJ which includes foreign, Federal, state and local government, and the private sector. 5.1 With which external (non-doj) recipient(s) is the information shared? Information shared with external recipients is high-level statistics data, and not the actual raw data itself (such as the privacy data, such as names, phone numbers, etc.). Information is shared with the following external recipients:
10 Page 10 Office of Management and Budget (OMB) and Congress: OMB and Congress receive the following reports which include high-level statistical information based on information stored and processed by the C&A Web: o Quarterly and annual reporting as required by Federal Information Security Management Act of 2002 (FISMA) o Annual reporting as required by OMB Circular A-123, Management's Responsibility for Internal Control Contractor Operated Systems or Facilities: Contractor or contractor operated facilities that are involved with supporting DOJ systems that contains/processes DOJ data in personally identifiable form shall fall subject to the same technical, administrative and operational security controls as DOJ operated systems or facilities. Hence, applicable contractors are required to access C&A Web for documenting and reporting of IT security implementation status for relevant systems. 5.2 What information is shared and for what purpose? 5.3 How is the information transmitted or disclosed? 5.4 Are there any agreements concerning the security and privacy of the data once it is shared? 5.5 What type of training is required for users from agencies outside DOJ prior to receiving access to the information?
12 Page 12 Any DOJ intranet or C&A Web user has already become familiar with and understands the Department of Justice (DOJ) Computer System User Information Technology (IT) Security General Rules of Behavior. DOJ Intranet users have agreed to the General Rules of Behavior, along with being familiar with and understanding them. o The current version is Version 2.0 dated May 23, o These rules extend to all DOJ personnel (employees and contractors) and any other persons using DOJ computing resources or accessing DOJ systems under formally established agreements. o All users should be fully aware of, and abide by, DOJ security policies as well as related federal policy contained in the Privacy Act, Freedom of Information Act, and DOJ Records Management Regulations. FOR Personnel with IT Security responsibilities (government employees, government contractors at government facilities or contractor operated facilities): Any individual that is involved in any IT Security responsibilities relating to a DOJ information system is subject to having privacy information about them captured and recorded in the C&A Web database. The individuals may not be aware that the information was captured in this fashion. Typically, anyone performing in an IT Security responsible position is subject to being interviewed during the system assessment procedure. To adequately document the status of meeting implementation of any security controls, evidentiary data is captured about the testing procedure. This could typically involve the collection of information about the tester interviewees that will have their name, phone number, position, title, address and building location documented in the system. If these individuals declined to provide their name, phone number, position, title, address, and building location, it would seriously impact the DOJ s ability to perform its responsibilities for continuous monitoring of security controls and oversight of the Department s IT Security Program.
13 Page Do individuals have an opportunity to consent to particular uses of the information, and if so, what is the procedure by which an individual would provide such consent? For those individuals (as described above), there is no consent to the specific uses of the information captured or maintained in the C&A Web system. The Rules of Behavior that all system users have signed identified the conditions under which access to a DOJ Information system impacts their privacy information and the requirements to properly handle/use and access to privacy information. 6.4 Privacy Impact Analysis: Given the notice provided to individuals above, describe what privacy risks were identified and how you mitigated them. Section 7.0 Individual Access and Redress The following questions concern an individual s ability to ensure the accuracy of the information collected about him/her. 7.1 What are the procedures which allow individuals the opportunity to seek access to or redress of their own information? 7.2 How are individuals notified of the procedures for seeking access to or amendment of their information? 7.3 If no opportunity to seek amendment is provided, are any other redress alternatives available to the individual?
14 Page Privacy Impact Analysis: Discuss any opportunities or procedures by which an individual can contest information contained in this system or actions taken as a result of agency reliance on information in the system. Section 8.0 Technical Access and Security The following questions are intended to describe technical safeguards and security measures. 8.1 Which user group(s) will have access to the system? 8.2 Will contractors to the Department have access to the system? If so, please submit a copy of the contract describing their role with this PIA. 8.3 Does the system use roles to assign privileges to users of the system? 8.4 What procedures are in place to determine which users may access the system and are they documented? 8.5 How are the actual assignments of roles and rules verified according to established security and auditing procedures?
15 Page What auditing measures and technical safeguards are in place to prevent misuse of data? 8.7 Describe what privacy training is provided to users either generally or specifically relevant to the functionality of the program or system? 8.8 Is the data secured in accordance with FISMA requirements? If yes, when was Certification & Accreditation last completed? 8.9 Privacy Impact Analysis: Given access and security controls, what privacy risks were identified and describe how they were mitigated. Threat: Unauthorized Access to the C&A Web system Risk: Low Mitigation/Countermeasures: Security controls. The C&A Web is a web-based system hosted within the Justice Data Center- Washington in a fully Certified and Accredited (C&A) DOJ intranet production environment according to generally accepted DOJ standards and guidelines for C&A of systems and networks for the department. o A total of 74 security controls are applicable for the C&A Web system. o A total of 69 security controls are inherited for the system. o Twenty security controls are not applicable according to the system categorization and scoping of the C&A Web Requirements Traceability Matrix (RTM). o Authentication/Access controls. A total of 10 AC family security controls are applicable for the C&A Web system. A total of 10 other AC family security controls are inherited by the C&A Web system from the GSS production environment. Any C&A Web or intranet user is required to be familiar with the DOJ General Rules of Behavior for information system use. Initial access to the C&A Web online system is limited to authorized users with active C&A Web accounts on various closed Sensitive But
16 Page 16 Unclassified (SBU) local area networks (LAN) amongst the various DOJ components. Multi-layered security is in effect by virtue of the fact that users must first logon to JCON (or other DOJ desktop/intra-networks) and then access the C&A Web after a successful LAN authentication. An unauthorized user would be need to have knowledge of both userid/password combinations in order to gain access to the C&A Web. o Role-based access controls. Access to specific data is restricted by user classification (as assigned by roles and privileges). This procedure enforces access control to information with privacy implication to members of an assigned role as determined appropriate by the user s supervisor and profiled accordingly in the C&A Web system by the system administrator(s). Roles and privileges can be assigned at the component, system, control and user levels. Each user is profiled by approval authorities that then notify the C&A Web system administrator of the appropriate roles and privileges authorized for each individual (user) for proper security settings in the account management function of the C&A Web. C&A User accounts can be created, updated, enabled and disabled only by authorized system administrators, upon receiving input from authorized approval authorities. To perform these functions, the system administrator(s) must be identified and profiled for such privileges in the C&A Web. System Administrators will: Ensure that the certification agent or CA-appointed agent validates system security at least annually. Make the computer(s) available for periodic reviews of the security configuration by independent testers. Ensure that under no circumstances the same person serves as the system administrator and ISSO for the same system. Managers will: Ensure that staff has access to, and sufficient time to complete, the DOJ Computer Security Awareness Training (CSAT), or other annual IT security training offered by offices/bureaus/components not utilizing CSAT. Ensure that staff has access to, and are aware of, all existing DOJ policies and procedures (DOJ Order (series), DOJ IT Security Standards) relevant to the use of DOJ information technology resources. Ensure that staff follows system security policies, guidelines and procedures (DOJ Order (series), DOJ IT Security Standards).
17 Page 17 o Audit controls. A total of 6 AU family security controls are applicable for the C&A Web system. C&A Web data input/changes can be tracked through database logging and auditing functions. Auditing logs are designed to be checked on a routine basis and monitored by system administrators. Access and changes to C&A Web data is captured in audit logs that are assigned to privileged individuals with appropriate system roles to monitor the audit logs. Threat: Remote Access to the C&A Web system data Risk: Low Mitigation/Countermeasures: Selectively authorized and established remote access accounts for any remote C&A Web system access follow established DOJ policies and procedures for issuance of individual JSRA accounts. Remote access is only permitted with valid authorization by supervisors and issuance of a JSRA account authorizing remote access privileges. Remote users are informed that they too must have a responsibility to take measures to protect the C&A Web system data they access from their remote site. Remote users must do everything they can to protect data from being compromised or captured on their computers, especially when using personal computers at home. These precautions may include: o Installation of operating system and application software (i.e. Internet Explorer) updates regularly. Many of these updates are issued to fix security problems which have been identified. o Install and use anti-virus software and personal firewalls and keep this software updated. o Do not store your various User-IDs and passwords in files on your computer. o After using your browser (e.g. Internet Explorer, etc.) to access a site where you process sensitive information close all of your browser windows and restart a new browser session. Sometimes the browser can hold that information in memory (e.g. cache, etc.) and some websites know where to look to find it. o Be very careful when installing software that gives others access to your computer. Remote service software or peer-to-peer software used for file sharing can create unintended openings into your computer that outsider can use if the software is not configured correctly.
18 Page 18 Threat: Unauthorized Disclosure of the C&A Web system data Risk: Low Mitigation/Countermeasures: Reports can only be printed by authorized users and authorized users have accepted rules of behavior, which includes the proper handling of sensitive system security paperwork for SBU system data, whether it is a physical printout or access to the system. Section 9.0 Technology The following questions are directed at critically analyzing the selection process for any technologies utilized by the system, including system hardware, RFID, biometrics and other technology. 9.1 Were competing technologies evaluated to assess and compare their ability to effectively achieve system goals? 9.2 Describe how data integrity, privacy, and security were analyzed as part of the decisions made for your system. 9.3 What design choices were made to enhance privacy? Conclusion The C&A Web application is used to process, store, and transmit information that supports the DOJ IT Security program. Securing this information and assuring its proper use is critical to the success of this DOJ and ITSS mission and related operations. The C&A Web is secured via access authorization, authentication rules, and audit controls. These technical controls are supplemented by procedural controls such as Account Management Reviews, Rules of Behavior, Confidentiality Agreements, and Security Awareness and Training to mitigate risks regarding unauthorized access and subsequent potential privacy
19 Page 19 violations. The proposed Defense-in-Depth implementation will increase the robustness of C&A Web security services, i.e., access controls, confidentiality, integrity, and non-repudiation. ITSS has consistently regarded the privacy ramifications of information that is processed, stored, and transmitted in the C&A Web application as critical in supporting the DOJ IT Security Program. The C&A Web solution is aligned with supporting all of DOJ s security objectives via application of FISMA requirements and industry Best Practices. Management review, continual enhancement, and FISMA-mandated continuous monitoring of C&A Web technical and procedural controls are of the utmost importance in maintaining application hardening and continuity of operations.
20 Page 20 Appendix A: References E-Government Act of 2002, Public Law , Section 208(b) Freedom of Information Act (FOIA) (as amended), 5 U.S.C. 552 Privacy Act (PA) of 1974 (as amended), 5 U.S.C. 552a OMB Circular A-130, Management of Federal Information Resources, Appendix III, Security of Federal Automated Information Resources OMB Memorandum M FY 2006 Reporting Instructions for the Federal Information Security Management Act and Agency Privacy Management (17 Jul 2006) OMB Memorandum M Protection of Sensitive Agency Information (23 June 2006) OMB Memorandum M Safeguarding Personally Identifiable Information (22 May 2006) FIPS 200 Minimum Security Requirements for Federal Information and Information Systems FIPS 199 Standards for Security Categorization of Federal Information and Information Systems NIST SP Recommended Security Controls for Federal Information Systems NIST SP Guide to the Security Certification and Accreditation of Federal Information Systems NIST SP Risk Management Guide for Information Technology Systems NIST SP Rev 1 Guide to System Security Plans for Federal Information Systems DOJ Order A Compliance with the Privacy Requirements of the Privacy Act, The E- Government Act, and the FISMA DOJ Privacy Impact Assessment Official Guidance Manual August 7, 2006 DOJ Memorandum issued on 10-July-2006, Privacy and Safeguarding of Personally Identifiable Information
21 Page 21 Appendix B: Abbreviations and Acronyms CSAM Cyber Security Assessment and Management C&A Certification & Accreditation DBA Database Administrator DOJ Department of Justice FEA Federal Enterprise Architecture FIPS Federal Information Processing Standard FISMA Federal Information Security Management Act FTC Federal Trade Commission GSS General Support System ITSS Information Technology Security Staff JMD Justice Management Division MA Major Application MIS Management Information Systems NIST National Institute of Standards and Technology OMB Office of Management and Budget PIA Privacy Impact Assessment POA&M Plan of Action and Milestones PTA Privacy Threshold Analysis SBU Sensitive But Unclassified SC Security Category SDLC System Development Life Cycle SORN System of Records Notification SP Special Publication SSP System Security Plan UPI Unique Project Identifier
Privacy Impact Assessment for the Web Time and Attendance October 31, 2006 Contact Point Mr. Mark Danter Bureau of Alcohol, Tobacco, Firearms and Explosives Office of Management/ Financial Management Division
Federal Bureau of Prisons Privacy Impact Assessment for TRUFONE Inmate Telephone System Issued by: Sonya D. Thompson Reviewed by: Approved by: Vance E. Hitch, Chief Information Officer, Department of Justice
Technology, Planning, Architecture, & E-Government Version: 1.1 Date: April 14, 2011 Prepared for: USDA OCIO TPA&E Privacy Impact Assessment for the April 14, 2011 Contact Point Charles McClam Deputy Chief
Privacy Impact Assessment for the Standardized Tracking and Accounting Reporting System- Financial Management System (STARS-FMS) United States Marshals Service Contact Point William E. Bordley Associate
for the Homeland Security Virtual Assistance Center November 3, 2008 Contact Point Donald M. Lumpkins National Preparedness Directorate (FEMA) (202) 786-9754 Reviewing Official Hugo Teufel III Chief Privacy
I. U.S. Government Privacy Laws A. Privacy Definitions and Principles a. Privacy Definitions i. Privacy and personally identifiable information (PII) b. Privacy Basics Definition of PII 1. Office of Management
Justice Management Division Privacy Impact Assessment for the Consolidated Debt Collection System Issued by: Barbara Bush, JMD Acting General Counsel Reviewed by: Approved by: Vance E. Hitch, Chief Information
for the Crew Member Self Defense Training (CMSDT) Program February 6, 2008 Contact Point Michael Rigney Federal Air Marshal Service Flight Programs Division Michael.Rigney@dhs.gov Reviewing Officials Peter
Federal Bureau of Prisons Privacy Impact Assessment for the HR Automation System Issued by: Sonya D. Thompson Deputy Assistant Director/CIO Reviewed by: Approved by: Eric Olson, Acting Chief Information
Federal Bureau of Prisons Privacy Impact Assessment for the SENTRY Inmate Management System Issued by: Sonya D. Thompson Deputy Assistant Director/CIO Reviewed by: Approved by: Luke McCormack, Chief Information
for the Directory Services and Email System (DSES) Contact Point James Kief Functional Area Manager Department of Homeland Security/US Coast Guard (304) 264-2573 Reviewing Official Hugo Teufel III Chief
For Person Authentication Service (PAS) Date: January 9, 2015 Point of Contact and Author: Hanan Abu Lebdeh Hanan.Abulebdeh@ed.gov System Owner: Ganesh Reddy Ganesh.Reddy@ed.gov Office of Federal Student
United States Department of State (PIA) Waiver Review System (WRS) Version 03.06.01.01 Last Updated: December 2, 2013 Bureau of Administration 1. Contact Information Department of State Privacy Coordinator
Federal Trade Commission Privacy Impact Assessment Conference Room Scheduling PIA July 2014 1. System Overview The Federal Trade Commission (FTC) uses conference spaces in various FTC facilities and FTC-leased
United States Trustee Program Privacy Impact Assessment for the Credit Counseling/Debtor Education System (CC/DE System) Issued by: Larry Wahlquist, Privacy Point of Contact Reviewed by: Approved by: Vance
U.S. OFFICE OF PERSONNEL MANAGEMENT OFFICE OF THE INSPECTOR GENERAL OFFICE OF AUDITS Final Audit Report Subject: AUDIT OF THE INFORMATION TECHNOLOGY SECURITY CONTROLS OF THE U.S. OFFICE OF PERSONNEL MANAGEMENT'S
1. Contact Information A/GIS/IPS Director Department of State SharePoint Server PIA Bureau of Administration Global Information Services Office of Information Programs and Services 2. System Information
POSTAL REGULATORY COMMISSION OFFICE OF INSPECTOR GENERAL FINAL REPORT INFORMATION SECURITY MANAGEMENT AND ACCESS CONTROL POLICIES Audit Report December 17, 2010 Table of Contents INTRODUCTION... 1 Background...1
for the Information System (IFMIS) Merger DHS/FEMA/PIA-020 December 16, 2011 Contact Point Michael Thaggard Office of Chief Financial Officer (202) 212-8192 Reviewing Official Mary Ellen Callahan Chief
United States Department of State Global Financial Management System (GFMS) Privacy Impact Assessment CGFS/DCFO/GFMS 1. Contact Information Privacy Impact Assessment (PIA) Department of State Privacy Coordinator
OFFICE OF THE CHIEF INFORMATION OFFICER Date of Issuance: May 22, 2009 Effective Date: May 22, 2009 Review Date: Section I. PURPOSE II. AUTHORITY III. SCOPE IV. DEFINITIONS V. POLICY VI. RESPONSIBILITIES
United States Department of State (PIA) Consular Affairs Enterprise Service Bus (CAESB) 01.00.00 Last Updated: May 1, 2015 Bureau of Administration 1. Contact Information A/GIS/IPS Director Bureau of Administration
UNITED STATES DEPARTMENT OF STATE AND THE BROADCASTING BOARD OF GOVERNORS OFFICE OF INSPECTOR GENERAL AUD-IT-15-17 Office of Audits October 2014 Audit of the Department of State Information Security Program
U.S. Securities and Exchange Commission Office of Information Technology Alexandria, VA PRIVACY IMPACT ASSESSMENT (PIA) GUIDE Revised January 2007 Privacy Office Office of Information Technology PRIVACY
Privacy Impact Assessment For Management Information System (MIS) Date: September 4, 2015 Point of contact: Hui Yang firstname.lastname@example.org System Owner: Wanda Scott email@example.com Author: Oscar Rosario firstname.lastname@example.org
For Personnel Development Program Data Collection System (DCS) Date: June 1, 2014 Point of Contact: Marlene Simon-Burroughs Marlene.Simon-Burroughs@ed.gov System Owner: Bonnie Jones Bonnie.Jones@ed.gov
Federal Trade Commission Privacy Impact Assessment for the: StenTrack Database System September, 2011 1 System Overview The Federal Trade Commission (FTC) protects America s consumers. As part of its work
for the Background Check Service Contact Point Elizabeth Gaffin USCIS Privacy Officer United States Citizenship and Immigration Services 202-272-1400 Reviewing Official Hugo Teufel III Chief Privacy Officer
Privacy Impact Assessment for the Remedy System November 15, 2006 Contact Point Luis Vega, 202-648-9411 Chief, Operations Performance Management Section Information Services Division (ISD) Office of Science
Justice Management Division Privacy Impact Assessment for the Personal Identity Verification (PIV) Card System Issued by: Stuart Frisch, Senior Component Official for Privacy Reviewed by: Vance E. Hitch,
for Threat Assessments for Access to Sensitive Security Information for Use in Litigation December 28, 2006 Contact Point Andrew Colsky Sensitive Security Information (SSI) Office SSI@dhs.gov Reviewing
Federal Trade Commission Privacy Impact Assessment for the: Secure File Transfer System June 2011 1 System Overview The Federal Trade Commission (FTC, Commission or the agency) is an independent federal
For TeamMate Audit Management System (TeamMate) Date: July 9, 2014 Point of Contact: Hui Yang Hui.Yang@ed.gov System Owner: Wanda Scott Wanda.Scott@ed.gov Author: Mike Burgenger Office of the Inspector
The Bureau of the Fiscal Service Privacy Impact Assessment The mission of the Bureau of the Fiscal Service (Fiscal Service) is to promote the financial integrity and operational efficiency of the federal
for the United States Citizenship and Immigration Services (USCIS) June 22, 2007 Contact Point Harry Hopkins Office of Information Technology (OIT) (202) 272-8953 Reviewing Official Hugo Teufel III Chief
OFFICE OF THE CHIEF INFORMATION OFFICER NETWORK AND AIS AUDIT, LOGGING, AND MONITORING POLICY OCIO-6011-09 Date of Issuance: May 22, 2009 Effective Date: May 22, 2009 Review Date: TABLE OF CONTENTS Section
Privacy Impact Assessment For: Education Investigative Tracking System (EDITS) Date: April 10, 2013 Point of Contact: Hui Yang System Owner: Wanda A. Scott Author: William Hamel Office of Inspector General
U.S. DEPARTMENT OF COMMERCE UNITED STATES PATENT AND TRADEMARK OFFICE Privacy Impact Assessment Employee Relation and Labor Relation Case Management System (ERLRCSMS) PTOC-031-00 May 11, 2015 Privacy Impact
United States Department of State (PIA) Consular Data Information Transfer System (CDITS) Version 02.00.00 Last Updated: April 15, 2014 Bureau of Administration 1. Contact Information Department of State
for the E-Mail Secure Gateway (EMSG) DHS/MGMT/PIA-006 March 22, 2012 Contact Point David Jones MGMT/OCIO/ITSO/ESDO DHS HQ (202) 447-0167 Reviewing Official Mary Ellen Callahan Chief Privacy Officer Department
Federal Bureau of Prisons Privacy Impact Assessment for the Forensic Laboratory Issued by: Sonya D. Thompson, Senior Component Official for Privacy, Sr. Deputy Assistant Director/CIO Approved by: Erika
EVALUATION REPORT Weaknesses Identified During the FY 2014 Federal Information Security Management Act Review March 13, 2015 REPORT NUMBER 15-07 EXECUTIVE SUMMARY Weaknesses Identified During the FY 2014
Federal Bureau of Prisons Privacy Impact Assessment for the Correspondence Tracking System (CTS) Issued by: Sonya D. Thompson Sr. Deputy Assistant Director/CIO Reviewed by: Approved by: Luke J. McCormack,
Name of System/Application: LAN/WAN PRIVACY IMPACT ASSESSMENT U. S. Small Business Administration LAN/WAN FY 2011 Program Office: Office of the Chief Information Officer A. CONTACT INFORMATION 1) Who is
Federal Trade Commission Privacy Impact Assessment for the: Analytics Consulting LLC Claims Management System and Online Claim Submission Website January 2015 Page 1 of 14 1 System Overview The Federal
Office of Inspector General DEPARTMENT OF HOMELAND SECURITY U.S. Department of Homeland Security Washington, DC 20528 Office of Inspector General Security Weaknesses Increase Risks to Critical DHS Databases
1. Contact Information Department of State Privacy Coordinator Margaret P. Grafeld Bureau of Administration Global Information Services Office of Information Programs and Services 2. System Information
NATIONAL CREDIT UNION ADMINISTRATION OFFICE OF INSPECTOR GENERAL INDEPENDENT EVALUATION OF THE NATIONAL CREDIT UNION ADMINISTRATION S COMPLIANCE WITH THE FEDERAL INFORMATION SECURITY MANAGEMENT ACT (FISMA)
1. Contact Information DoS Privacy Coordinator Margaret P. Grafeld Bureau of Administration Global Information Services Office of Information Programs and Services 2. System Information (a) Date PIA was
FHFA Privacy Impact Assessment Template FM: SYSTEMS (SYSTEM NAME) This template is used when the Chief Privacy Officer determines that the system contains Personally Identifiable Information and a more
United States Department of State Privacy Impact Assessment Risk Analysis and Management Bureau of Administration 1. Contact Information Risk Analysis and Management (RAM) PIA Department of State Privacy
for the DHS / UKvisas Project November 14, 2007 Contact Point Elizabeth Gaffin Associate Counsel United States Citizenship and Immigration Services 202-272-1400 Reviewing Official Hugo Teufel III Chief
Federal Trade Commission Privacy Impact Assessment for the: W120023 ONLINE FAX SERVICE December 2012 1 System Overview The Federal Trade Commission (FTC, Commission or the agency) is an independent federal
for the Integrated Digitization Document Management Program January 5, 2007 Contact Point Elizabeth Gaffin Privacy Officer U.S. Citizenship and Immigration Services (USCIS) (202) 272-1400 Reviewing Official
for the 9/11 Heroes Stamp Act of 2001 File System Contact Point Elizabeth Edge US Fire Administration Federal Emergency Management Agency (202) 646-3675 Reviewing Official Nuala O Connor Kelly Chief Privacy
Federal Trade Commission Privacy Impact Assessment for: DCBE Websites and Blogs Consumer.ftc.gov, Consumidor.ftc.gov, OnGuardOnline, AlertaenLinea, Consumer.gov, Consumidor.gov and the BCP Business Center
for the Automated Threat Prioritization Web Service DHS/ICE/PIA-028 June 6, 2011 Contact Point Luke McCormack Chief Information Officer U.S. Immigration and Customs Enforcement (202) 732-3100 Reviewing
Fiscal Year 2015 Information Security for Managers Introduction Information Security Overview Enterprise Performance Life Cycle Enterprise Performance Life Cycle and the Risk Management Framework Categorize
U.S. ELECTION ASSISTANCE COMMISSION OFFICE OF INSPECTOR GENERAL FINAL REPORT: U.S. Election Assistance Commission Compliance with the Requirements of the Federal Information Security Management Act Fiscal
Review of the SEC s Systems Certification and Accreditation Process March 27, 2013 Page i Should you have any questions regarding this report, please do not hesitate to contact me. We appreciate the courtesy
Federal Trade Commission Privacy Impact Assessment for the: Gilardi & Co., LLC Claims Management System and Online Claim Submission Website January 2015 Page 1 of 14 1 System Overview The Federal Trade
for the Stakeholder Engagement Initiative: December 10, 2009 Contact Point Christine Campigotto Private Sector Office Policy 202-612-1623 Reviewing Official Mary Ellen Callahan Chief Privacy Officer Department
Department of the Interior August 15, 2014 Name of Project: email Enterprise Records and Document Management System (eerdms) Bureau: Office of the Secretary Project s Unique ID: Not Applicable A. CONTACT
U.S. DEPARTMENT OF COMMERCE UNITED STATES PATENT AND TRADEMARK OFFICE Privacy Impact Assessment Enterprise Software Services PTOI-020-00 July 8, 2015 Privacy Impact Assessment This Privacy Impact Assessment
Issued by the EPA Chief Information Officer, Pursuant to Delegation 1-19, dated 07/07/2005 INFORMATION SECURITY INTERIM MAINTENANCE PROCEDURES V1.8 JULY 18, 2012 1. PURPOSE The purpose of this procedure
INTERNational Connections Privacy Impact Assessment 1. Contact Information Department of State Privacy Coordinator Margaret P. Grafeld Bureau of Administration Global Information Services Office of Information
NATIONAL CREDIT UNION ADMINISTRATION OFFICE OF INSPECTOR GENERAL FY 2015 INDEPENDENT EVALUATION OF THE EFFECTIVENESS OF NCUA S INFORMATION SECURITY PROGRAM UNDER THE FEDERAL INFORMATION SECURITY MODERNIZATION
Corporate Property Automated Information System CPAIS Privacy Impact Assessment May 2003 CONTENTS Background...3 Access to the Data...5 Maintenance of Administrative Controls...9 1 Introduction The Office
1. Contact Information Department of State Privacy Coordinator Margaret P. Grafeld Bureau of Administration Global Information Services Office of Information Programs and Services 2. System Information
1. Contact Information Department of State Privacy Coordinator Margaret P. Grafeld Bureau of Administration Global Information Services Office of Information Programs and Services 2. System Information
Justice Management Division Privacy Impact Assessment for the Justice Unified Telecommunications Network (JUTNet) Voice Services System Issued by: Arthur E. Gary, General Counsel and Senior Component Official
for the (CWS System) DHS/TSA/PIA-036 January 13, 2012 Contact Point Carolyn Y. Dorgham Program Manager, National Explosives Detection Canine Team Program Carolyn.Dorgham@dhs.gov Reviewing Official Mary
OFFICE OF INSPECTOR GENERAL Special Report Catalyst for Improving the Environment Fiscal Year 2007 Federal Information Security Management Act Report Status of EPA s Computer Security Program Report No.
NOTE: The following reflects the information entered in the PIAMS website. A. SYSTEM DESCRIPTION Authority: Office of Management Budget (OMB) Memorandum (M) 03-22, OMB Guidance for Implementing the Privacy
VA Office of Inspector General OFFICE OF AUDITS & EVALUATIONS Department of Veterans Affairs Federal Information Security Management Act Audit for Fiscal Year 2013 May 29, 2014 13-01391-72 ACRONYMS AND
NIST 800-53A: Guide for Assessing the Security Controls in Federal Information Systems Samuel R. Ashmore Margarita Castillo Barry Gavrich CS589 Information & Risk Management New Mexico Tech Spring 2007
for the ICE Pattern Analysis and Information Collection (ICEPIC) January 25, 2008 Contact Point Marcy Forman Director Office of Investigations U.S. Immigration and Customs Enforcement (202) 514-0078 Reviewing
for the National Flood Insurance Program (NFIP) Modernization /Business Process Improvement/Systems Engineering Management Support (NFIP Information Technology Systems/NextGen) November 26, 2008 Contact
for the Conversion to 10-Fingerprint Collection for the United States Visitor and Immigrant Status Indicator Technology Program (US-VISIT) November 15, 2007 Contact Point Barbara M. Harrison, Acting Privacy
Cybersecurity Risk Management Activities Instructions Fiscal Year 2015 An effective risk management program and compliance with the Federal Information Security Management Act (FISMA) requires the U.S.
for the Federal Protective Service Dispatch and Incident Record Management Systems September 16, 2009 Contact Point Gary Schenkel Director, Federal Protective Service U.S. Immigration and Customs Enforcement
U.S. Securities and Exchange Commission (MPTS) PRIVACY IMPACT ASSESSMENT (PIA) February 24, 2013 General Information 1. Name of Project or System. (MPTS) 2. Describe the project and its purpose or function