+-------------+--------------------------------------------------------+
| ![](m       |                                                        |
| edia/image1 |                                                        |
| .png){width |                                                        |
| ="7.1743055 |                                                        |
| 55555556in" |                                                        |
| height="    |                                                        |
| 1.124305555 |                                                        |
| 5555554in"} |                                                        |
+-------------+--------------------------------------------------------+
| ![](m       | **FARM SERVICE AGENCY**                                |
| edia/image2 |                                                        |
| .png){width | **Privacy Impact Analysis (PIA)**                      |
| ="1.3125in" |                                                        |
| heig        | **for**                                                |
| ht="8.5in"} |                                                        |
|             | **General Sales Manager Systems**                      |
|             |                                                        |
|             | **(GSM)**                                              |
|             |                                                        |
|             | -   General Sales Manager Systems                      |
|             |                                                        |
|             | -   PL480 APLUS                                        |
|             |                                                        |
|             | **FINAL**                                              |
|             |                                                        |
|             | **Update Date: November 26, 2007**                     |
|             |                                                        |
|             | **Accreditation Date: September 28, 2007**             |
|             |                                                        |
|             | ![](media/image3.png){width="0.7791666666666667in"     |
|             | height="0.8229166666666666in"}                         |
|             |                                                        |
|             | **Farm Service Agency**                                |
|             |                                                        |
|             | **ADC/AFAO/AGG**                                       |
|             |                                                        |
|             | **6501 Beacon Drive**                                  |
|             |                                                        |
|             | **Kansas City, MO 64133-4676**                         |
+-------------+--------------------------------------------------------+

![](media/image4.wmf)

**Document Control**

![](media/image4.wmf)

+-----------+-----------+-----------+----------------------------------+
| **Date**  | *         | *         | **Description of Changes**       |
|           | *Source** | *Author** |                                  |
+-----------+-----------+-----------+----------------------------------+
|           |           |           | Original document.               |
+-----------+-----------+-----------+----------------------------------+
| 0         | Template  | Sarita    | Transcribed to new 2007 template |
| 2/01/2007 |           | Gupta,    |                                  |
|           |           | EDS       |                                  |
+-----------+-----------+-----------+----------------------------------+
| 0         | Original  | D. J.     | Update System Documentation --   |
| 2/15/2007 |           | Downing   | Pages 1, 5, 6, 8, 9, 10, 11, 15  |
+-----------+-----------+-----------+----------------------------------+
| 0         | Original  | Donald D. | Table 2 Sections 1, 2a, 2b, 2c,  |
| 2/15/2007 |           | Lewis,    | 2f, and 3a.                      |
|           |           | Jr.       |                                  |
|           |           |           | Table 3 Sections 1, 2, 4, 5a,    |
|           |           |           | 5b, and 6b.                      |
|           |           |           |                                  |
|           |           |           | Table 4 Sections 1, 3a, 3b, and  |
|           |           |           | 4a.                              |
|           |           |           |                                  |
|           |           |           | Table 5 Sections 2a, 3b and 4c.  |
+-----------+-----------+-----------+----------------------------------+
| 0         | GSM -DW   | Phyllis   | Update document for 02/2007      |
| 2/15/2007 |           | Lamers    | changes -- 2.2 overview; Table   |
|           |           |           | 2-2b,2c,3a,3b; Table             |
|           |           |           | 3-1,2,4,5a,5b,6a,6b,6c; Table    |
|           |           |           | 4-1,2b,3a,4a,4c; Table           |
|           |           |           | 5-2a,2d,2e,3a,3b,4b,4c.          |
+-----------+-----------+-----------+----------------------------------+
| 0         | Original  | D. J.     | Change A-Plus to APLUS           |
| 2/21/2007 |           | Downing   |                                  |
+-----------+-----------+-----------+----------------------------------+
| 0         |           |           | C&A Phase 1 System               |
| 3/07/2007 |           |           | Owner approved                   |
+-----------+-----------+-----------+----------------------------------+
| 0         | Chris     | Chris     | C&A Phase 1 SME approved         |
| 3/07/2007 | Hoover    | Hoover    |                                  |
+-----------+-----------+-----------+----------------------------------+
| 3/19/2007 |           | J. Thomas | C&A Phase 1 Point of Contact     |
|           |           |           | approved                         |
+-----------+-----------+-----------+----------------------------------+
| 0         |           | Eric      | C&A Phase 1 ISO approved         |
| 6/05/2007 |           | Miller,   |                                  |
|           |           | ISO       |                                  |
+-----------+-----------+-----------+----------------------------------+
| 0         | J Wagner, | J Wagner, | SORN was answered as "N/A" and   |
| 6/07/2007 | EDS       | EDS       | undetermined. After reviewing    |
|           |           |           | data sharing changed answer to   |
|           |           |           | "No." Question regarding a       |
|           |           |           | change to the SORN was answered  |
|           |           |           | "No." Changed to possibly if     |
|           |           |           | data, record storage location or |
|           |           |           | routine use changes. Changed     |
|           |           |           | update date on cover and header. |
+-----------+-----------+-----------+----------------------------------+
| 0         | OCIO      | J Wagner, | Added Signature Page             |
| 8/07/2007 | Template  | EDS       |                                  |
+-----------+-----------+-----------+----------------------------------+
| 0         | ISO       | E.        | Final C&A Review, Insert faxed   |
| 8/19/2007 |           | Miller,   | signature                        |
|           |           | ISO       |                                  |
+-----------+-----------+-----------+----------------------------------+
| 11/19/07  |           | S         | Added Accreditation Date         |
|           |           | Nuessle,  |                                  |
|           |           | EDS       |                                  |
+-----------+-----------+-----------+----------------------------------+
| 11/26/07  |           | S         | Add Contact Information          |
|           |           | Nuessle,  |                                  |
|           |           | EDS       |                                  |
+-----------+-----------+-----------+----------------------------------+
|           |           |           |                                  |
+-----------+-----------+-----------+----------------------------------+

Prepared for:

Certification & Accreditation

Farm Service Agency

United States Department of Agriculture

6501 Beacon Dr.

Kansas City, MO 64133

Table of Contents

[1 Purpose of Document 4](#purpose-of-document)

[2 Applicability 5](#applicability)

[2.1 Applicability of System 5](#applicability-of-system)

[2.2 System Overview 5](#system-overview)

[2.2.1 PL480 APLUS system 5](#pl480-aplus-system)

[2.2.2 GSM Web/PC 5](#gsm-webpc)

[2.2.3 GSM Data Warehouse 5](#gsm-data-warehouse)

[3 Contact Information 5](#contact-information)

[3.1 Owner 6](#owner)

[3.2 Security Contact 6](#security-contact)

[3.3 Privacy Officer 6](#privacy-officer)

[USDA PRIVACY IMPACT ASSESSMENT 7](#__RefHeading___Toc183853973)

[PRIVACY IMPACT ASSESSMENT AUTHORIZATION MEMORANDUM
16](#privacy-impact-assessment-authorization-memorandum)

Table of Tables

[Table 1: System Applicability 3](#__RefHeading___Toc175246459)

[Table 2: Data In The System 3](#__RefHeading___Toc175246460)

[Table 3: Access To The Data 3](#__RefHeading___Toc175246461)

[Table 4: Attributes Of The Data 3](#__RefHeading___Toc175246462)

[Table 5: Maintenance Of Administrative Controls
3](#__RefHeading___Toc175246463)

# Purpose of Document

USDA DM 3515-002 states: "Agencies are responsible for initiating the
PIA in the early stages of the development of a system and to ensure
that the PIA is completed as part of the required System Life Cycle
(SLC) reviews. Systems include data from applications housed on
mainframes, personal computers, and applications developed for the Web
and agency databases. Privacy must be considered when requirements are
being analyzed and decisions are being made about data usage and system
design. This applies to all of the development methodologies and system
life cycles used in USDA.

Both the system owners and system developers must work together to
complete the PIA. System owners must address what data are used, how the
data are used, and who will use the data. System owners also need to
address the privacy implications that result from the use of new
technologies (e.g., caller identification). The system developers must
address whether the implementation of the owner's requirements presents
any threats to privacy."

The Privacy Impact Assessment (PIA) document contains information on how
the General Sales Manager affects the privacy of its users and the
information stored within. This assessment is in accordance with NIST SP
800-37 *Guide for the Security Certification and Accreditation of
Federal Information Systems.*

# Applicability

## Applicability of System

The information in this document is applicable to the system and its
subsystems as listed below.

[]{#__RefHeading___Toc175246459 .anchor}Table 1: System Applicability

+----------------------------+-----------------------------------------+
| **System**                 | **Subsystem**                           |
+============================+=========================================+
| General Sales Manager      | -   PL480 APLUS                         |
| Systems                    |                                         |
|                            | -   General Sales Manager Systems       |
| (GSM)                      |                                         |
|                            |     -   GSM Sales Manager Export Credit |
|                            |         Guarantee System (Web/PC)       |
|                            |                                         |
|                            |     -   GSM Data Warehouse              |
+----------------------------+-----------------------------------------+

## System Overview

### PL480 APLUS system

The PL 480 APLUS system is a major application that falls under the
broader umbrella of the General Sales Manager System (GSM). The mission
of PL 480 APLUS is to process financial information that results from
selling agriculture products to underdeveloped foreign countries to
assist in economic development.

Through the use of the PL 480 APLUS, data required to verify and
validate the performance indicators for food assistance for
underdeveloped countries is captured. APLUS is maintained by the Farm
Services Agency (FSA) under the auspices of the Commodity Credit
Corporation (CCC) and is jointly used by FSA and the FAS to provide
complete financial management and accounting for this program.

### GSM Web/PC

The General Sales Manager System (GSM) serves as the subsidiary system
program and accounting system for the Farm Service Agency's (FSA)
foreign guarantee programs. The GSM Web/PC is an application base system
that supports both FSA (Farm Service Agency) and FAS (Foreign
Agricultural Services). The application's mission is to provide
financial reporting to the FSA-FMD (Financial Management Division) via
GSM Data Warehouse and to provide application operation support for the
FAS.

### GSM Data Warehouse

The General Sales Manager System (GSM) serves as the subsidiary system
program and accounting system for the Farm Service Agency's (FSA)
foreign guarantee programs. The purpose of the GSM Data Warehouse system
is to streamline the reporting process by implementing a common
computing procedure that accommodates the programming team in performing
maintenance of the financial data collected by the GSM Web PC
application.

# Contact Information

## Owner

> Ethel Anderson
>
> CSO
>
> U.S. Department of Agriculture
>
> Farm Service Agency
>
> 6501 Beacon
>
> Kansas City, MO 64133

(816)926-1923

Ethel.anderson@kcc.usda.gov

## Security Contact 

> Brian Davies
>
> Information System Security Program Manager (ISSPM)
>
> FSA/DAM/ITSD/OTC/ISO
>
> U.S. Department of Agriculture
>
> Farm Service Agency
>
> 1400 Independence Avenue SW
>
> Washington, D.C. 20250
>
> \(202\) 720-2419

brian.davies@wdc.usda.gov

## Privacy Officer 

> Tom Hofeller
>
> USDA/FSA/OA
>
> U.S. Department of Agriculture
>
> Farm Service Agency
>
> 1400 Independence Avenue SW
>
> Washington, D.C. 20250
>
> \(202\) 690-0153
>
> Tom.hofeller@wdc.usda.gov

[]{#__RefHeading___Toc183853973 .anchor}**USDA PRIVACY IMPACT
ASSESSMENT**

[]{#__RefHeading___Toc175246460 .anchor}Table 2: Data In The System

+------------------------------+---------------------------------------+
| **DATA IN THE SYSTEM**       |                                       |
+==============================+=======================================+
| > 1\. Generally describe the | **PL 480 APLUS System:**              |
| > information to be used in  |                                       |
| > the system in each of the  | Creditor -- Billing & receipt of      |
| > following categories:      | collections                           |
| > Customer, Employee, and    |                                       |
| > Other.                     | Customer -- Purchase authorizations   |
|                              | for commodities, freight, and ocean   |
|                              | freight differential                  |
|                              |                                       |
|                              | FAS -- Program Administrator          |
|                              |                                       |
|                              | FMD -- Accounting, reporting,         |
|                              | disbursement                          |
|                              |                                       |
|                              | **GSM Web/PC System**                 |
|                              |                                       |
|                              | Customer -- Tax Payer Identification  |
|                              | Number, Evidence of export, Notice Of |
|                              | Default, Notice Of Assignment,        |
|                              | claims, recoveries, fees, guarantee   |
|                              | bank name, payment bank name, payment |
|                              | bank account number                   |
|                              |                                       |
|                              | Employees -- Interest rates, bank and |
|                              | country limits                        |
|                              |                                       |
|                              | **GSM Data Warehouse**                |
|                              |                                       |
|                              | Customer -- Evidence of export, NOD,  |
|                              | NOA, claims, fees, guarantee bank     |
|                              | name, account number                  |
|                              |                                       |
|                              | Employees -- Interest rates, bank and |
|                              | country limits                        |
+------------------------------+---------------------------------------+
| 2a. What are the sources of  | **PL 480 APLUS System**               |
| the information in the       |                                       |
| system?                      | Information is obtained from          |
|                              | agreements, payment schedules,        |
|                              | exports, shipments, disbursements,    |
|                              | and cash receipts.                    |
|                              |                                       |
|                              | **GSM Web/PC System**                 |
|                              |                                       |
|                              | Customer, Foreign banks, U.S.         |
|                              | Financial Institutions, Exporters and |
|                              | Treasury Department                   |
|                              |                                       |
|                              | **GSM Data Warehouse**                |
|                              |                                       |
|                              | Customer, banks, Treasury Department  |
+------------------------------+---------------------------------------+
| 2b. What USDA files and      | **PL 480 APLUS System**               |
| databases are used? What is  |                                       |
| the source agency?           | FAS & FSA                             |
|                              |                                       |
|                              | **GSM Web/PC System**                 |
|                              |                                       |
|                              | GSM Production database - Source      |
|                              | agencies are: Treasury Department,    |
|                              | State Department, FAS, FSA            |
|                              |                                       |
|                              | **GSM Data Warehouse**                |
|                              |                                       |
|                              | Treasury Department, State            |
|                              | Department, FAS, FSA                  |
|                              |                                       |
|                              | FAS, and FSA both own portions of the |
|                              | database data.                        |
+------------------------------+---------------------------------------+
| 2c. What Federal Agencies    | **PL 480 APLUS System**               |
| are providing data for use   |                                       |
| in the system?               | FAS & FSA                             |
|                              |                                       |
|                              | **GSM Web/PC System**                 |
|                              |                                       |
|                              | Treasury Department, State            |
|                              | Department, FAS, FSA                  |
|                              |                                       |
|                              | **GSM Data Warehouse**                |
|                              |                                       |
|                              | Treasury Department, State            |
|                              | Department, FAS, FSA                  |
+------------------------------+---------------------------------------+
| 2d. What State and Local     | N/A                                   |
| Agencies are providing data  |                                       |
| for use in the system?       |                                       |
+------------------------------+---------------------------------------+
| 2e. From what other third    | **PL 480 APLUS System**               |
| party sources will data be   |                                       |
| collected?                   | Data may be collected from exporters, |
|                              | suppliers, finance ministries, and    |
|                              | other debtors.                        |
|                              |                                       |
|                              | **GSM Web/PC System**                 |
|                              |                                       |
|                              | Treasury Department                   |
|                              |                                       |
|                              | **GSM Data Warehouse**                |
|                              |                                       |
|                              | Treasury Department                   |
+------------------------------+---------------------------------------+
| 2f. What information will be | **PL 480 APLUS System**               |
| collected from the           |                                       |
| customer/employee?           | Information collected includes        |
|                              | Agreement, Disbursement, Collection,  |
|                              | and Reference information.            |
|                              |                                       |
|                              | **GSM Web/PC System**                 |
|                              |                                       |
|                              | Customer -- Tax Payer Identification  |
|                              | Number, Evidence of export, Notice Of |
|                              | Default, Notice Of Assignment,        |
|                              | claims, fees, guarantee bank name,    |
|                              | Payment Bank Name, Payment Bank       |
|                              | account number                        |
|                              |                                       |
|                              | Employees -- Interest rates, bank and |
|                              | country limits                        |
|                              |                                       |
|                              | **GSM Data Warehouse**                |
|                              |                                       |
|                              | Customer -- Evidence of export, NOD,  |
|                              | NOA, claims, fees, guarantee bank     |
|                              | name, account number                  |
|                              |                                       |
|                              | Employees -- Interest rates, bank and |
|                              | country limits                        |
+------------------------------+---------------------------------------+
| 3a. How will data collected  | Reconciliation and Review             |
| from sources other than the  |                                       |
| USDA records and the         |                                       |
| customer be verified for     |                                       |
| accuracy?                    |                                       |
+------------------------------+---------------------------------------+
| 3b. How will data be checked | Reconciliation and Review             |
| for completeness?            |                                       |
+------------------------------+---------------------------------------+

[]{#__RefHeading___Toc175246461 .anchor}Table 3: Access To The Data

+-------------------------------+--------------------------------------+
| **ACCESS TO THE DATA**        |                                      |
+===============================+======================================+
| 1\. Who will have access to   | **PL 480 APLUS System**              |
| the data in the system        |                                      |
| (Users, Managers, System      | -   Washington, DC User -- Update    |
| Administrators, Developers,   |     Access                           |
| Other)?                       |                                      |
|                               | -   KC/IT User -- Read Only Access   |
|                               |                                      |
|                               | **GSM Web/PC System**                |
|                               |                                      |
|                               | Customers, USDA employees have       |
|                               | Update Access, Exporters may submit  |
|                               | data online and by request through   |
|                               | FAS or FSA, OIG and Congress may     |
|                               | receive reports.                     |
|                               |                                      |
|                               | **GSM Data Warehouse**               |
|                               |                                      |
|                               | e-authentication                     |
+-------------------------------+--------------------------------------+
| 2\. How is access to the data | **PL 480 APLUS System**              |
| by a user determined? Are     |                                      |
| criteria, procedures,         | Requests for access for specific     |
| controls, and                 | functions are approved by a manager  |
| responsibilities regarding    | and granted by a security officer.   |
| access documented?            |                                      |
|                               | **GSM Web/PC System**                |
|                               |                                      |
|                               | Determined by need to know.          |
|                               |                                      |
|                               | Security requests are approved by    |
|                               | management and granted by security   |
|                               | officials. Access is role based.     |
|                               |                                      |
|                               | **GSM Data Warehouse**               |
|                               |                                      |
|                               | Determined by need to know.          |
|                               |                                      |
|                               | Security requests are approved by    |
|                               | management verified by WDC security  |
|                               | and KC's GSM Data Warehouse lead,    |
|                               | and granted by security officials.   |
+-------------------------------+--------------------------------------+
| 3\. Will users have access to | Users will have restricted access to |
| all data on the system or     | system data based on business needs, |
| will the user's access be     | and restricted by discretionary      |
| restricted? Explain.          | access control methods.              |
+-------------------------------+--------------------------------------+
| 4\. What controls are in      | **PL 480 APLUS System**              |
| place to prevent the misuse   |                                      |
| (e.g. browsing, unauthorized  | IT Security limits access to APLUS   |
| use) of data by those having  | system components based on the       |
| access?                       | DC/User's business needs.            |
|                               |                                      |
|                               | **GSM Web/PC System**                |
|                               |                                      |
|                               | Access Security requirements are     |
|                               | established for the system. Access   |
|                               | is need to know role based.          |
|                               |                                      |
|                               | **GSM Data Warehouse**               |
|                               |                                      |
|                               | Security is set up in the system to  |
|                               | have level II e-authentication; to   |
|                               | be approved by the supervisor of the |
|                               | system ownership; to be verified by  |
|                               | WDC security; to be followed up by   |
|                               | the DW lead, and to be granted       |
|                               | access to the box/software and web   |
|                               | page via ID's/passwords and roles.   |
+-------------------------------+--------------------------------------+
| 5a. Do other systems share    | **PL 480 APLUS System**              |
| data or have access to data   |                                      |
| in this system? If yes,       | No                                   |
| explain.                      |                                      |
|                               | **GSM Web/PC System**                |
|                               |                                      |
|                               | Yes -- CCC administers the GSM       |
|                               | application , financial reporting    |
|                               | via CORE                             |
|                               |                                      |
|                               | **GSM Data Warehouse**               |
|                               |                                      |
|                               | No - CCC, CORE Data is used by the   |
|                               | same users as the system owners of   |
|                               | the GSM DW.                          |
+-------------------------------+--------------------------------------+
| 5b. Who will be responsible   | **PL 480 APLUS System**              |
| for protecting the privacy    |                                      |
| rights of the customers and   | N/A                                  |
| employees affected by the     |                                      |
| interface.                    | **GSM Web/PC System**                |
|                               |                                      |
|                               | DAA is FSA/DAM/FMD                   |
|                               |                                      |
|                               | **GSM Data Warehouse**               |
|                               |                                      |
|                               | E-auth; system owners; WDC/KC        |
|                               | security and all staff that have     |
|                               | access to the system.                |
+-------------------------------+--------------------------------------+
| 6a. Will other agencies share | **PL 480 APLUS System**              |
| data or have access to data   |                                      |
| in this system                | Different levels of financial data   |
| (International, Federal,      | are reported to Treasury, USAID,     |
| State, Local, Other)?         | Commerce Department, State           |
|                               | Department, Congress, and Paris      |
|                               | Club.                                |
|                               |                                      |
|                               | **GSM Web/PC System**                |
|                               |                                      |
|                               | Data is reported to Treasury         |
|                               | Department, State Department, USAID, |
|                               | Congress, and Paris Club             |
|                               |                                      |
|                               | **GSM Data Warehouse**               |
|                               |                                      |
|                               | Data is reported to Treasury         |
|                               | Department, State Department, USAID, |
|                               | Congress, and Paris Club; however,   |
|                               | it is shared via reports passed from |
|                               | the system owners rather than the    |
|                               | other agencies having access to the  |
|                               | system.                              |
+-------------------------------+--------------------------------------+
| 6b. How will the data be used | **PL 480 APLUS System**              |
| by the agency?                |                                      |
|                               | APLUS is the subsidiary ledger for   |
|                               | this program.                        |
|                               |                                      |
|                               | **GSM Web/PC System**                |
|                               |                                      |
|                               | This data is used to administer theM |
|                               | program                              |
|                               |                                      |
|                               | **GSM Data Warehouse**               |
|                               |                                      |
|                               | To administer the GSM program        |
+-------------------------------+--------------------------------------+
| 6c. Who is responsible for    | **PL 480 APLUS System**              |
| assuring proper use of the    |                                      |
| data?                         | FMD management                       |
|                               |                                      |
|                               | **GSM Web/PC System**                |
|                               |                                      |
|                               | FMD management                       |
|                               |                                      |
|                               | **GSM Data Warehouse**               |
|                               |                                      |
|                               | FMD/FAS management                   |
+-------------------------------+--------------------------------------+

[]{#__RefHeading___Toc175246462 .anchor}Table 4: Attributes Of The Data

+------------------------------+---------------------------------------+
| **ATTRIBUTES OF THE DATA**   |                                       |
+==============================+=======================================+
| 1\. Is the use of the data   | **PL 480 APLUS System**               |
| both relevant and necessary  |                                       |
| to the purpose for which the | Yes                                   |
| system is being designed?    |                                       |
|                              | **GSM Web/PC System**                 |
|                              |                                       |
|                              | Tax Payer Identification Number for   |
|                              | treasury reporting. Payment Bank      |
|                              | Name, Address and Account Number in   |
|                              | order to process payments.            |
|                              |                                       |
|                              | **GSM Data Warehouse**                |
|                              |                                       |
|                              | Yes -- data reported is tied to       |
|                              | actual legal documents secured by the |
|                              | system owners.                        |
+------------------------------+---------------------------------------+
| 2a. Will the system derive   | No                                    |
| new data or create           |                                       |
| previously unavailable data  |                                       |
| about an individual through  |                                       |
| aggregation from the         |                                       |
| information collected?       |                                       |
+------------------------------+---------------------------------------+
| 2b. Will the new data be     | N/A                                   |
| placed in the individual's   |                                       |
| record (customer or          |                                       |
| employee)?                   |                                       |
+------------------------------+---------------------------------------+
| 2c. Can the system make      | N/A                                   |
| determinations about         |                                       |
| customers or employees that  |                                       |
| would not be possible        |                                       |
| without the new data?        |                                       |
+------------------------------+---------------------------------------+
| 2d. How will the new data be | N/A                                   |
| verified for relevance and   |                                       |
| accuracy?                    |                                       |
+------------------------------+---------------------------------------+
| 3a. If data is being         | N/A                                   |
| consolidated, what controls  |                                       |
| are in place to protect the  |                                       |
| data from unauthorized       |                                       |
| access or use?               |                                       |
+------------------------------+---------------------------------------+
| 3b. If processes are being   | **PL 480 APLUS System**               |
| consolidated, are the proper |                                       |
| controls remaining in place  | N/A                                   |
| to protect the data and      |                                       |
| prevent unauthorized access? | **GSM Web/PC System**                 |
| Explain.                     |                                       |
|                              | No consolidation. Roles, privileges   |
|                              | and separation of duties              |
|                              |                                       |
|                              | **GSM Data Warehouse**                |
|                              |                                       |
|                              | Yes                                   |
+------------------------------+---------------------------------------+
| 4a. How will the data be     | **PL 480 APLUS System**               |
| retrieved? Can it be         |                                       |
| retrieved by personal        | APLUS data is NOT retrieved by        |
| identifier? If yes, explain. | personal identifiers.                 |
|                              |                                       |
|                              | **GSM Web/PC System**                 |
|                              |                                       |
|                              | Data is retrieved in a variety of     |
|                              | ways, usually by user id or name but  |
|                              | never by tax payer identification     |
|                              | number.                               |
|                              |                                       |
|                              | **GSM Data Warehouse**                |
|                              |                                       |
|                              | Data is retrieved in a variety of     |
|                              | ways -- the data is not put into an   |
|                              | individual table to easily access an  |
|                              | identifier; however, the combination  |
|                              | of the tables/data might give a link  |
|                              | to identify data if the person using  |
|                              | the data knew how to link the tables  |
|                              | and how to relate the identifiers.    |
+------------------------------+---------------------------------------+
| 4b. What are the potential   | N/A                                   |
| effects on the due process   |                                       |
| rights of customers and      |                                       |
| employees of:                |                                       |
|                              |                                       |
| -   consolidation and        |                                       |
|     linkage of files and     |                                       |
|     systems;                 |                                       |
|                              |                                       |
| -   derivation of data       |                                       |
|                              |                                       |
| -   accelerated information  |                                       |
|     processing and decision  |                                       |
|     making;                  |                                       |
|                              |                                       |
| -   use of new technologies. |                                       |
+------------------------------+---------------------------------------+
| 4c. How are the effects to   | **PL 480 APLUS System**               |
| be mitigated?                |                                       |
|                              | N/A                                   |
|                              |                                       |
|                              | **GSM Web/PC System**                 |
|                              |                                       |
|                              | N/A                                   |
|                              |                                       |
|                              | **GSM Data Warehouse**                |
|                              |                                       |
|                              | Authentication and security           |
|                              | Identifiers are in place to have      |
|                              | tracking done on access to the Data   |
|                              | Warehouse.                            |
+------------------------------+---------------------------------------+

[]{#__RefHeading___Toc175246463 .anchor}Table 5: Maintenance Of
Administrative Controls

+------------------------------+---------------------------------------+
| **MAINTENANCE OF             |                                       |
| ADMINSTRATIVE CONTROLS**     |                                       |
+==============================+=======================================+
| 1a. Explain how the system   | N/A                                   |
| and its use will ensure      |                                       |
| equitable treatment of       |                                       |
| customers and employees.     |                                       |
+------------------------------+---------------------------------------+
| 2a. If the system is         | **PL 480 APLUS System**               |
| operated in more than one    |                                       |
| site, how will consistent    | N/A                                   |
| use of the system and data   |                                       |
| be maintained in all sites?  | **GSM Web/PC System**                 |
|                              |                                       |
|                              | FAS and FSA have separate locations   |
|                              | within WDC. The exporters and U.S.    |
|                              | Financial Institutions may view and   |
|                              | submit information via the web. All   |
|                              | transactions including view are       |
|                              | processed in one location using one   |
|                              | database.                             |
|                              |                                       |
|                              | **GSM Data Warehouse**                |
|                              |                                       |
|                              | Web access via Eauth                  |
+------------------------------+---------------------------------------+
| 2b. Explain any possibility  | N/A                                   |
| of disparate treatment of    |                                       |
| individuals or groups.       |                                       |
+------------------------------+---------------------------------------+
| 2c. What are the retention   | **PL 480 APLUS System**               |
| periods of data in this      |                                       |
| system?                      | N/A                                   |
|                              |                                       |
|                              | **GSM Web/PC System**                 |
|                              |                                       |
|                              | Permanent retention is required at    |
|                              | this time.                            |
|                              |                                       |
|                              | **GSM Data Warehouse**                |
|                              |                                       |
|                              | Permanent                             |
+------------------------------+---------------------------------------+
| 2d. What are the procedures  | **PL 480 APLUS System**               |
| for eliminating the data at  |                                       |
| the end of the retention     | N/A                                   |
| period? Where are the        |                                       |
| procedures documented?       | **GSM Web/PC System**                 |
|                              |                                       |
|                              | N/A                                   |
|                              |                                       |
|                              | **GSM Data Warehouse**                |
|                              |                                       |
|                              | N/A -- there currently is no          |
|                              | expiration to the data being stored.  |
+------------------------------+---------------------------------------+
| 2e. While the data is        | **PL 480 APLUS System**               |
| retained in the system, what |                                       |
| are the requirements for     | N/A                                   |
| determining if the data is   |                                       |
| still sufficiently accurate, | **GSM Web/PC System**                 |
| relevant, timely, and        |                                       |
| complete to ensure fairness  | N/A                                   |
| in making determinations?    |                                       |
|                              | **GSM Data Warehouse**                |
|                              |                                       |
|                              | The schema is saved with the data     |
|                              | stored. The data is saved/updated on  |
|                              | a nightly basis.                      |
+------------------------------+---------------------------------------+
| 3a. Is the system using      | **PL 480 APLUS System**               |
| technologies in ways that    |                                       |
| the USDA has not previously  | No                                    |
| employed (e.g. Caller-ID)?   |                                       |
|                              | **GSM Web/PC System**                 |
|                              |                                       |
|                              | A web portal is being added for       |
|                              | external users to access data.        |
|                              | However, exploitation of this         |
|                              | technology for the purposes of        |
|                              | compromising privacy is not           |
|                              | anticipated as being a probably       |
|                              | outcome of using this technology.     |
|                              |                                       |
|                              | **GSM Data Warehouse**                |
|                              |                                       |
|                              | A web interface was added and the     |
|                              | users are required to have level II   |
|                              | e-authentication; and associated      |
|                              | roles to be able to access the report |
|                              | data.                                 |
+------------------------------+---------------------------------------+
| 3b. How does the use of this | **PL 480 APLUS System**               |
| technology affect            |                                       |
| customer/employee privacy?   | N/A                                   |
|                              |                                       |
|                              | **GSM Web/PC System**                 |
|                              |                                       |
|                              | Security will limit access to         |
|                              | customers and employees. This is role |
|                              | and a need to know basis.             |
|                              |                                       |
|                              | **GSM Data Warehouse**                |
|                              |                                       |
|                              | Security will limit access- via       |
|                              | IDs/roles.                            |
+------------------------------+---------------------------------------+
| 4a. Will this system provide | **PL 480 APLUS System**               |
| the capability to identify,  |                                       |
| locate, and monitor          | No                                    |
| [individuals]{.underline}?   |                                       |
| If yes, explain.             | **GSM Web/PC System**                 |
|                              |                                       |
|                              | N/A                                   |
|                              |                                       |
|                              | **GSM Data Warehouse**                |
|                              |                                       |
|                              | N/A                                   |
+------------------------------+---------------------------------------+
| 4b. Will this system provide | **PL 480 APLUS System**               |
| the capability to identify,  |                                       |
| locate, and monitor [groups  | No                                    |
| of people]{.underline}? If   |                                       |
| yes, explain.                | **GSM Web/PC System**                 |
|                              |                                       |
|                              | N/A                                   |
|                              |                                       |
|                              | **GSM Data Warehouse**                |
|                              |                                       |
|                              | The Group/role and associated         |
|                              | ID/passwords could be tracked by      |
|                              | security with administrative rights.  |
+------------------------------+---------------------------------------+
| 4c. What controls will be    | **PL 480 APLUS System**               |
| used to prevent unauthorized |                                       |
| monitoring?                  | N/A                                   |
|                              |                                       |
|                              | **GSM Web/PC System**                 |
|                              |                                       |
|                              | Access is based on role and need to   |
|                              | know basis. Web users are level 2     |
|                              | E-Auth. And USDA employees only have  |
|                              | access during CORE working hours.     |
|                              |                                       |
|                              | **GSM Data Warehouse**                |
|                              |                                       |
|                              | Roles are in place.                   |
+------------------------------+---------------------------------------+
| 5a. Under which Systems of   | None, the GSM system contains         |
| Record notice (SOR) does the | information on businesses, not        |
| system operate? Provide      | individuals.                          |
| number and name.             |                                       |
+------------------------------+---------------------------------------+
| 5b. If the system is being   | Possibly if the modification results  |
| modified, will the SOR       | in data, record storage location, or  |
| require amendment or         | routine use that is not covered by    |
| revision? Explain.           | the SORN.                             |
+------------------------------+---------------------------------------+

#  PRIVACY IMPACT ASSESSMENT AUTHORIZATION MEMORANDUM {#privacy-impact-assessment-authorization-memorandum .unnumbered}

I have carefully assessed the Privacy Impact Assessment for the

  -----------------------------------------------------------------------
  General Sales Manager Systems (GSM)

  (System Name)
  -----------------------------------------------------------------------

This document has been completed in accordance with the requirements of
the EGovernment Act of 2002.

We fully accept the changes as needed improvements and authorize
initiation of work to proceed. Based on our authority and judgment, the
continued operation of this system is authorized.

![](media/image5.jpeg){width="6.993055555555555in"
height="1.0145833333333334in"}

+-----------------------------------------------------+---+------------+
|                                                     |   |            |
+-----------------------------------------------------+---+------------+
| Agency's Chief FOIA officer                         |   | Date       |
|                                                     |   |            |
| OR Senior Official for Privacy                      |   |            |
|                                                     |   |            |
| OR Designated privacy person                        |   |            |
+-----------------------------------------------------+---+------------+
|                                                     |   |            |
+-----------------------------------------------------+---+------------+
| Agency CIO                                          |   | Date       |
+-----------------------------------------------------+---+------------+