# Presentation: 711464

## National Institutes of Health (NIH)

- Privacy Impact Assessment (PIA) Training

- April, May & June 2008

**Karen Plá**NIH Senior Official for Privacy OD/Office of Management Assessment (OMA)

**Kay Coupe**
- Information Security & Awareness Office
- OD/Office of the Chief Information Officer (OCIO)

## Agenda

- Introduction
- Legislation
- Background
- Process
- SPORT: Basic Functionality
- Frequently Asked Questions
- Summary
- Resources

- April, May & June 2008

## IntroductionOverview

_**Audience**_:  System Owners/Managers, IC Privacy Coordinators, Chief Information Officers (CIOs), Information Systems Security Officers (ISSO)s, Privacy Points of Contact (POCs) and other NIH staff involved in the Privacy Impact Assessment (PIA) process or who have an interest in learning more about them.
_**Purpose**_:  To provide an overview of the HHS requirement to conduct a PIA on IT systems, how to access and use the HHS Security and Privacy Online Reporting Tool (SPORT), the need to monitor and mitigate privacy risks and how to complete a PIA.
_**Duration**_:  3 hours

- April, May & June 2008

## Introduction Course Objectives

- After completing this course, you will be able to:
- Identify the legislative drivers that require the completion of a PIA
- Understand the importance of conducting a PIA
- Identify what triggers the completion of a PIA
- Understand how to complete the PIA forms
- Understand how to use the HHS Online Reporting Tool
- Understand the importance of monitoring systems for change
- Understand the need to mitigate privacy weaknesses
- Identify sources for further information regarding the initiation, completion and submission of PIAs

- April, May & June 2008

## Agenda

- Introduction
- Legislation
- Background
- Process
- SPORT: Basic Functionality
- Frequently Asked Questions
- Summary
- Resources

- April, May & June 2008

## LegislationMandates

- Public Law (P.L.) 93-579, The Privacy Act of 1974
- P.L. 100-503, Computer Matching & Privacy Act of 1988
- P.L. 104-13, Paperwork Reduction Act
- P.L. 107-347, E-Government Act of 2002, Section 208
- P.L. 107-347, E-Government Act of 2002, Title III, Federal Information Security Management Act of 2002 (FISMA)
- Secure One HHS Information Security Privacy Policy
- Circular No. A-130, Management of Federal Information Resources
- P.L. 104-23, Freedom of Information Act

- April, May & June 2008

## LegislationMandates

- Office of Management and Budget (OMB) Memorandum (M)-03-22, *Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002*
- OMB M-04-24, *Expanded Electronic Government portion of the President’s Management Agenda (PMA)*
- OMB M-07-16, *Safeguarding Against and Responding to the Breach of Personally Identifiable Information*
- OMB M-07-19, *FY 2007 Reporting Instructions for the Federal Information Security Management Act and Agency Privacy Management *
- OMB M-08-09, *New FISMA Privacy Reporting Requirements for FY 2008*

- April, May & June 2008

## Legislation NIH PIA Policy and Guidance

- NIH Policy 1745-1, NIH Privacy Impact Assessments:
- Outlines roles and responsibilities in the process of developing, reviewing, promoting, and maintaining accurate PIAs
- _[http://www3.od.nih.gov/oma/manualchapters/management/1745-1/](http://www3.od.nih.gov/oma/manualchapters/management/1745-1/)__ _
- NIH PIA Guide:
- Explains the process of developing a PIA and provides a question-by-question tutorial
**http://oma.od.nih.gov/ms/privacy/NIHPIAGuide.doc**

- April, May & June 2008

## Agenda

- Introduction
- Legislation
- Background
- Process
- SPORT: Basic Functionality
- Frequently Asked Questions
- Summary
- Resources

- April, May & June 2008

## BackgroundWhat is a PIA?

- A means to assure compliance with applicable laws and regulations governing taxpayer and employee privacy
- An analysis of how PII/IIF1 is processed, stored, and transmitted by NIH systems (e.g., network, server, database, software application)
- A tool to identify and evaluate possible privacy and system risks that could allow unauthorized access, modification, or misuse of PII
- A process for documenting data contained in a system

- 1 PII and IIF refer to the same type of information and are used interchangeably.  Information in Identifiable Form (IIF) was the term used originally to refer to Personally Identifiable Information (PII) contained within an IT system.  However, more recently, the term PII has been adopted as the universal term used to refer to personal information, regardless of whether or not it is contained within an IT system.

- April, May & June 2008

## BackgroundWhy Conduct a PIA?

- PIAs are a mechanism to:
- Ensure handling of PII conforms to applicable legal, regulatory, and policy requirements regarding privacy
- Identify the risks of collecting, maintaining, and transmitting PII
- Implement security controls and alternative processes for handling PII to mitigate potential privacy risks

- April, May & June 2008

## BackgroundWhat do PIAs evaluate?

- PIAs evaluate:
- Data in the IT system
- Attributes of the data
- Access to the data
- Information sharing practices
- Web site hosting
- Administrative, technical and physical access controls

- April, May & June 2008

## BackgroundWhich Systems Need a PIA?

- Systems which require the completion of a PIA include:
- Systems operated and maintained by the federal government
- Systems operated and maintained by a contracted company
- Systems that have not been assessed previously
- New systems in development (as part of the certification and accreditation [C&A] process)
- Systems that have a PIA but have undergone a “major change”

- April, May & June 2008

## BackgroundWhat is a Major Change?

- A “major change” is a modification to a system that affects the following:
- Access control
- Type of data collected
- System interconnection
- Information sharing
- Business processes

- April, May & June 2008

## BackgroundExamples of Major Changes

_**Conversions**_**:  When converting paper-based records to electronic systems.**
_**Anonymous to Non-Anonymous**_**:  When functions applied to an existing information collection change anonymous information into PII.**
_**Significant System Management Changes**_**:  When new uses of an existing IT system, including application of new technologies, significantly change how information in identifiable form is managed in the system.**
_**Significant Merging**_**:  When agencies adopt or alter business processes so that government databases holding PII are merged, centralized, matched with other databases, or otherwise significantly manipulated.**
_**New Public Access**_**:  When user-authenticating technology (e.g., password, digital certificate, biometric) is newly applied to an electronic information system’s members of the public access.**
_**Commercial Sources**_**:  When agencies systematically incorporate into existing information systems databases of PII purchased or obtained from commercial or public sources. **
_**New Interagency Uses**_**:  When agencies work together on shared functions involving significant new uses or exchanges of PII, such as the cross-cutting E-Government initiatives; in such cases, the lead agency should prepare the PIA.**
_**Internal Flow or Collection**_**:  When alteration of a business process results in significant new uses or disclosures of information or incorporating additional items of PII into the system.**
_**Alteration in Character of Data**_**:  When new PII added to a collection raises the risks to personal privacy (e.g., the addition of health or financial information).**

- April, May & June 2008

## Background Summary

**Section 208 of the E-Gov Act requires federal agencies to conduct a PIA before developing or procuring IT systems or projects that collect, maintain or disseminate IIF/PII from or about members of the public, **_**OR**_** initiating a new electronic collection of IIF/PII information for 10 or more members of the public**
**OMB M-03-22 requires PIAs to be conducted for electronic information systems and collections and make them publicly available**
**FISMA requires all federal agencies report on the completion of PIAs**
**HHS PIA Guide requires that we complete a PIA for **_**ALL**_** information technology (IT) systems, regardless of whether or not IIF/PII is collected/maintained/disseminated**
**Security and Privacy Online Reporting Tool (SPORT) tool (formerly called ProSight-FISMA) was provided by HHS to assist with PIA completion**
**NIH PIA Policy & Guide are available for use in completing PIAs**

- April, May & June 2008

## Agenda

- Introduction
- Legislation
- Background
- Process
- SPORT: Basic Functionality
- Frequently Asked Questions** **
- Summary
- Resources

- April, May & June 2008

## Who Should Prepare, Review, and Approve PIAs?

- PIAs are completed by a System Owner/Manager in consultation with the IC Privacy Coordinator, CIO, ISSO, OMB Project Clearance Liaison, Records Management Officer and other privacy stakeholders, as applicable, via the Security & Privacy Online Reporting Tool (SPORT), formerly ProSight-FISMA
- PIAs should be reviewed in accordance with IC policy (i.e., by supervisors, Executive Officers, etc.)
- The NIH Senior Official for Privacy (SOP) will review, approve, sign and date each PIA, and promote it to the Department
- HHS will post the PIA Summary on a public website at URL: _[http://www.hhs.gov/pia/nih/index.html](http://www.hhs.gov/pia/nih/index.html)__ _

**PIA Process****Conduct the**** ****PIA**

- April, May & June 2008

## PIA ProcessConduct the PIA

- Identify IT systems that require a PIA
- At the program level where the data is being collected
- Before the development phase of an IT system has begun
- When it is discovered an IT system does not have a PIA
- Contact the NIH ProSight FISMA Accounts email group to establish a new system (ProSight FISMA Accounts - _[psfisma@mail.nih.gov](mailto:psfisma@mail.nih.gov)_)
- Complete only the PIA Summary if the system does not contain PII
- Complete the entire PIA Form if the system contains PII
- Ensure PIA has been distributed through the respective organizational channels for concurrence

- April, May & June 2008

## PIA ProcessStep 1: Access SPORT

- The SPORT tool is the official collection point and repository of NIH’s current fiscal year PIAs.  It is a living resource/database that can be changed on a continuing basis
- Through the SPORT tool, you can:
- Edit, save and submit a current PIA
- View and print current and historical (archived) PIAs
- Contact the NIH ProSight FISMA Accounts email group to:
- Gain access
- Add/Update your system information

**SPORT URL:  **
_**[https://prosight-fisma.hhs.gov/prosight](https://prosight-fisma.hhs.gov/prosight)**__** **_

- April, May & June 2008

## PIA ProcessStep 2: Complete the PIA

- The PIA consists of two parts:
- PIA Summary
- Identifies information collection practices, procedures, and possible privacy weaknesses/vulnerabilities that pose an unacceptable risk of compromising the confidentiality, integrity, or availability of information
- PIA Form
- Ensures that information handling conforms to applicable legal, regulatory, and policy requirements regarding privacy
- Determines the risks and effects of collecting, maintaining, and disseminating PII in an information system

- April, May & June 2008

## PIA ProcessStep 2: Complete the PIA

- PIA Form (continued)
- Examines and evaluates protections and alternative processes for handling information to mitigate potential privacy risks2
- If it is determined that a system contains PII, the entire PIA form must be completed

- 2 Taken from the definition of “PIA” in OMB M-03-22, “*OMB Guidance for Implementing of the Privacy Provisions of the E-Government Act of 2002*,” September 26, 2003

- April, May & June 2008

## PIA ProcessPIA Summary & Approval

**PIA Summary:**
* *
- Required Questions
- Critical system tracking numbers & POC information
- Overview of the system and background information
**Approval/Demotion Page:**
- PIA Reviewer Approval = Promotion or Demotion
- NIH SOP Approval = Promotion or Demotion
- NIH SOP or Designee Approval = Signature
- Department Approval to Publish to the Web

- April, May & June 2008

## PIA ProcessPIA Summary Form

- Question 17: Does/Will the system collect, maintain (store), disseminate and/or pass through IIF/PII within any database(s), record(s), file(s), or website(s) hosted by this system?
-  This crucial question determines if the system owner must move beyond the PIA Summary and fill out the PIA Form
- If the response to Question #17 is “Yes,” the system owner must answer all the questions contained in the PIA Form

- April, May & June 2008

## PIA ProcessComplete PIA Form

- The PIA Form includes the summary, 7 tabs and the approval page:
- Required Information
- System Characterization and Data Categorization
- Information Sharing Practices
- Website Hosting Practices
- Administrative Controls
- Technical Controls
- Physical Access

- April, May & June 2008

## PIA ProcessRequired Information Tab

- The Required Information tab covers the basics of each system including:
- General Information
- System Location
- Point of Contact Information – only name will be made public
- Overview of the System

- April, May & June 2008

## PIA ProcessSystem Characterization Tab

- The System Characterization tab identifies, among other things:
- Who owns and operates the system
- Whether the system is new or existing
- The life-cycle of the system (initiation, development/acquisition, implementation, operations/maintenance)
- Changes that may have occurred to the system
- Whether the system collects, maintains, stores, disseminates and/or passes through IIF/PII within any database, record, file, or website hosted by the system

- April, May & June 2008

## PIA ProcessData Sharing Practices Tab

- The Information Sharing Practices tab:
- Identifies federal agency and third party information sharing practices
- Focuses on how the system uses PII:
- Who sees it
- Where it comes from
- Where it goes
- Questions 30 & 31: Please make sure that all parts of the question are answered to the fullest extent, even if part of the answer is stated elsewhere on the PIA form

- April, May & June 2008

## PIA ProcessWeb Hosting Practices Tab

- The Web Hosting Practices tab:
- Identifies privacy practices for systems that host Web sites
- Seeks to understand whether the system’s Web site complies with federal guidance on Web site operation
- NIH Manual Chapter 2805 Web Page Privacy Policy
- http://www3.od.nih.gov/oma/manualchapters/management/2805/
- Question 32: Does the system host a Web site?
- If the answer to this question is ‘No’, the answers to questions 32 through 40 should be ‘No’ (_IMPORTANT_:  This must be filled in to show 100% PIA completion)

- April, May & June 2008

## PIA ProcessAdministrative Controls Tab

- Administrative Controls ensure proper management and control of information and information systems.  You must indicate whether the following exist:
- Date of Certification & Accreditation
- Security Plan
- Contingency or Backup Plan
- Policies/Manuals/Guides/Procedures
- Contractor Clauses (to protect and safeguard information)
- Access (to ensure least privilege “business need-to-know”)
- Record Retention Policies

- April, May & June 2008

##  PIA ProcessTechnical Controls Tab

- Technical Controls are those that are generally executed by the computer system.  (_Examples_:  User IDs, passwords, firewalls, VPN, encryption, smart cards, biometrics, PKI certificates, etc.)
- Question 51: Are technical controls in place to minimize the possibility of unauthorized access, use, or dissemination of the data in the system?
- If ‘Yes’, select ‘Yes’ or ‘No’ for each type of technical control in place

- April, May & June 2008

## PIA ProcessPhysical Controls Tab

- Physical Access Controls are measures taken to secure the data and protect systems, buildings, and related supporting infrastructure against threats associated with their physical environment. (_Examples_:  Guards, ID badges, key cards, cipher locks, biometrics, CCTV, etc.)
- Question 53: Are physical access controls in place?
- If ‘Yes’, select ‘Yes’ or ‘No’ for each type of access control in place

- April, May & June 2008

## PIA ProcessStep 3: Approval/Demotion

- Once the PIA is completed, it is signed by the designated PIA Promoter (typically the IC Privacy Coordinator) and promoted to the NIH SOP
- Each system PIA will be reviewed by the NIH SOP followed by one of two actions:
- Promotion to the Department Senior Agency Official for Privacy (SAOP) and review for:
- Approval and annual submission to OMB
- Posting to the HHS PIA website
- Demotion to the system owner or PIA author if the NIH SOP determines that any information is incorrect or incomplete

- April, May & June 2008

## PIA ProcessStep 4: Approval/Demotion (con’t)

- Below is a visual description of the information included on the previous page regarding the PIA completion process

- System Owner or PIA Author

- IC PIA Promoter

- NIH SOP

- Promote to Department SAOP

- Yes
- SAOP reviews and approves for annual submission to OMB; PIA is posted to HHS PIA website

- No
- Demote to system owner or PIA author for resubmission if data is incorrect or incomplete

- Promoted

- Demoted

- April, May & June 2008

## PIA Process Summary

**Identify which systems require a PIA**
**Contact NIH ProSight FISMA Accounts email group or ISSO to establish a new system in the SPORT tool and to gain access to the tool**
**Access the PIA section in the SPORT tool**
**Complete the PIA forms, as appropriate**
**PIA Summary **
**PIA Form (if PII is collected/stored/transmitted)**
**Ensure appropriate IC review/concurrence/approval of the PIA**
**Save (submit) the PIA in the SPORT tool**
**Notify your ISSO if a system is taken out of operation and retired so it can be moved to an archived portion of SPORT **
**Save an electronic or paper copy with the system C&A when it’s approved**

- April, May & June 2008

**Notes:**
Click to add notes

## PIA ProcessRisk Mitigation

- PIAs provide a snapshot of privacy efforts and weaknesses at the program and system level
- PIAs should be reviewed to identify areas of weakness in the management, operation, or technical functioning of the system
- Failure to comply with privacy controls present a risk to the organization and could result in unwanted public scrutiny, legal implications or a potential financial penalty

- April, May & June 2008

## PIA ProcessMitigate Weaknesses

- System Owners/Managers should:
- Review PIAs to identify privacy weaknesses in the system’s management, operation, or technical controls
- Prioritize weaknesses by risk
- Include weaknesses in the system’s Plan of Action & Milestones (POA&M) or corrective action plan
- Review PIAs during every stage of the System Development Life Cycle (SDLC) to ensure that privacy controls exist to safeguard the use of PII in the system
- Implement risk mitigation strategies

- April, May & June 2008

## PIA ProcessMitigation Strategies

- For further guidance on mitigation strategies, you can refer to:
*HHS Information Technology Privacy Impact Assessment Guide, Appendix G*
*	****http://intranet.hhs.gov/infosec/docs/policies_guides/PIA/PIA_TOC.htm***
*HHS Plan of Action and Milestones Guide*
- 	**http://intranet.hhs.gov/infosec/docs/policies_guides/POAM/poam_toc.html**

- April, May & June 2008

## PIA ProcessMonitor Negative Implications

- Ensure the system continually meets privacy legislation law and requirements
- Monitor changes in the collection of the data, use of it, and the way in which it is shared or aggregated within the system that may impact privacy
- Update the PIA if the system has undergone a major change
- Review the PIA during every stage of the SDLC
- Ensure privacy controls exist to minimize weaknesses
- Monitor the effectiveness of privacy controls by conducting regular self-assessments, privacy reviews, and audits

- April, May & June 2008

## PIA Process Summary: Rules of the Road

- Know the business objective of the system
- Early in the process, work with system developers and system managers to identify potential privacy & security risks and their negative implications in order to mitigate and monitor them
- Examine all procedures that involve the usage, storage, retrievability, accessibility, retention and disposal of PII through all SDLC phases
- Consult with the IC Privacy Coordinator, Chief Information Officer, Information Systems Security Officer (ISSO), Records Management Officer, OMB Project Clearance Liaison and other privacy stakeholders within the IC on the completion of the PIA
- Know the difference between privacy and security:
*Privacy* ~ How you protect what is inside the system
*Security* ~ How you protect the system from being accessed from the outside

- April, May & June 2008

## Agenda

- Introduction
- Legislation
- Background
- Process
- SPORT: Basic Functionality
- Frequently Asked Questions
- Summary
- Resources

- April, May & June 2008

## SPORT: Basic FunctionalityRequests for New Account

- Requests for user accounts must be requested by the IC Privacy Coordinator, ISSO or senior level administrator, such as an Administrative Officer (AO) or Executive Officer (EO)
- Requests should be sent to the ProSight FISMA Accounts email group in the Global Address List (GAL) which is listed as ProSight FISMA Accounts (psfisma@mail.nih.gov)
- Requests should include the type of role and editing capabilities that the user needs

- April, May & June 2008

## SPORT: Basic FunctionalityPIA Roles

- The IC determines what roles a user should have
- There are 3 types of PIA roles:
**PIA Owner** (User has edit rights)
**PIA Promoter** (User can review and demote or promote to the NIH SOP, no edit rights)
**PIA Reviewer** (User has review rights only)

- April, May & June 2008

## SPORT: Basic FunctionalityAccount Info

- An Active Directory (AD) account is required to access SPORT
- User IDs are matched to a person’s AD account
- Passwords are NOT the same as your AD password
- Passwords need to be 8 characters and include upper and lower case, number and character (please ~ no tildes)
- Passwords need to be changed every 90 days
- Contact the ProSight FISMA Accounts email group via email to have passwords enabled or reset

- April, May & June 2008

## SPORT: Basic FunctionalityAccessing the Application

- URL: _[https://prosight-fisma.hhs.gov/prosight/](https://prosight-fisma.hhs.gov/prosight/)__ _

- April, May & June 2008

## SPORT: Basic Functionality Changing your Password

- Go to the **User** section on the toolbar
- From this drop down you will find the window to change your password

- April, May & June 2008

## SPORT: Basic Functionality Selecting the PIA Form

- Ensure that the **Forms** tab is selected
- Then go to the **ITEM** drop down menu and click on the arrow and a window will open
**NOTE:**  The Workbook & Investor Tabs are not used at NIH

- April, May & June 2008

## SPORT: Basic Functionality Selecting the System

- Click on the + next to your IC Information Systems [Home]
- Select the system name that you want to work on
**Select** the drop down arrow for **FORM**

- The window will refresh and your system name will be listed for the **ITEM**

- April, May & June 2008

## SPORT: Basic Functionality Selecting the Form

- ...and a new window opens with a form list

**Click** on the + next to **“06 PIA”**
**Select “06.1 HHS Privacy Impact Assessment”**

- April, May & June 2008

## SPORT: Basic Functionality PIA Form

- The window will refresh and the PIA form will show in the window.  The form is divided into 9 tabs. Check that you have the correct system listed for the ITEM

- April, May & June 2008

## SPORT: Basic Functionality PIA Scorecard

- Select the **Scorecard** Tab
- Click on the drop down arrow for scorecards

- The drop down box appears.
- Click on the + next to **Privacy Impact Assessment** and
- select the scorecard you want

- April, May & June 2008

## SPORT: Basic Functionality Scorecards

- The **PIA Promotion Progress** Scorecard shows the progress of all your system PIAs

- April, May & June 2008

## SPORT: Basic Functionality Other Features

**The SPORT Tool is accessed through Internet Explorer:**
- You must have Java and Active-X enabled on your desktop, and you must allow pop-up windows in order to use the application.  If you experience a problem using SPORT, you may need to contact your Desktop Support to help you set these up.
**To Print or Export in SPORT:**
- Go to the far left on the toolbar.  It may say **Scorecard **or** Form**.  Click and you will get a drop down menu.  Select **Export** or **Print**.  You may receive a message that you need to allow this action to be performed.  Some computers may require that you hold down the control key.  Ensure that you allow pop-ups from this site.
**To Logout of SPORT:**
- Go to the far left on the toolbar.  It may say **Scorecard **or** Form**.  Click and you will get a drop down menu.  Select **Logout.**

- April, May & June 2008

## If you have questions about the application or need your password reset, send an email to the ProSight FISMA Accounts email group in the GAL (ProSight FISMA Accounts): 
psfisma@mail.nih.gov 

(NOTE:  The ProSight FISMA application is different from the ProSight CPIC (Capital Planning & Investment Control) application.  The User IDs and Passwords for the applications are not the same)

For questions about the PIA and Privacy, contact the NIH Office of the Senior Official for Privacy (OSOP):
privacy@mail.nih.gov 

- _[psfisma@mail.nih.gov](mailto:psfisma@mail.nih.gov)__ _
- (_NOTE_:  The ProSight FISMA application is different from the ProSight CPIC (Capital Planning & Investment Control) application.  The User IDs and Passwords for the applications are not the same)
- For questions about the PIA and Privacy, contact the NIH Office of the Senior Official for Privacy (OSOP):
- _[privacy@mail.nih.gov](mailto:privacy@mail.nih.gov)__ _

**SPORT: Basic Functionality**** **** ****Email Contacts**

- April, May & June 2008

## Agenda

- Introduction
- Legislation
- Background
- Process
- SPORT: Basic Functionality
- Frequently Asked Questions
- Summary
- Resources

- April, May & June 2008

## PIA Frequently Asked Questions

**Who is responsible for completing and promoting PIAs?**
- Staff at the program level where the data are being collected; staff responsible for the development of the system, and/or appropriate operating staff, as designated by the IC
- Those with the most knowledge and insight into a system, its characteristics, and the privacy and security controls in place should complete the PIA. This can include a System Owner/Manager or program official.  PIA authors are encouraged to consult with the IC Privacy Coordinator, CIO, ISSO, OMB Project Clearance Liaison, RMO and others, as applicable
- Remember, the PIA process is a collaborative one, and involves multiple stakeholders
- Once the PIA is completed by the PIA author, it is sent to the PIA Promoter for their review and comments. The PIA Promoter role should be assigned to the IC Privacy Coordinator or a designee. If no revisions are required, the PIA Promoter can promote the PIA to the NIH OSOP
- The OSOP reviews completed PIAs and promotes them to the HHS SAOP, if complete and accurate, or returns the PIA to the IC Privacy Coordinator if it is incomplete or requires changes

- April, May & June 2008

## When do I fill out the entire PIA vs. the PIA Summary?
If the system for which the PIA is being completed collects PII, the entire PIA form must be completed.  If it does NOT collect PII, you only need to complete the PIA Summary tab
NOTE: If you are working to complete the PIA Summary, you must clearly explain why/how the system does not collect PII

- If the system for which the PIA is being completed collects PII, the _entire_ PIA form must be completed.  If it does NOT collect PII, you only need to complete the PIA Summary tab
- _NOTE_: If you are working to complete the PIA Summary, you must clearly explain why/how the system does not collect PII

**PIA Frequently Asked Questions**

- April, May & June 2008

## How do I determine if a system collects PII?
PII is defined as any information about an individual maintained by an agency, including, but not limited to, education, financial transactions, medical history, and criminal or employment history and information which can be used to distinguish or trace an individual's identity, such as their name, social security number, date and place of birth, mother’s maiden name, biometric records, etc., including any other personal information which is linked or linkable to an individual 
If any of these, or any other categories of information that can be linked to an individual, are stored, maintained, passed through, or disseminated by the system, the system collects PII
IC Privacy Coordinators should be able to validate whether or not a system collects PII based on the information provided to them by System Owners/Managers

- PII is defined as any information about an individual maintained by an agency, including, but not limited to, education, financial transactions, medical history, and criminal or employment history and information which can be used to distinguish or trace an individual's identity, such as their name, social security number, date and place of birth, mother’s maiden name, biometric records, etc., including any other personal information which is linked or linkable to an individual
- If any of these, or any other categories of information that can be linked to an individual, are stored, maintained, passed through, or disseminated by the system, the system collects PII
- IC Privacy Coordinators should be able to validate whether or not a system collects PII based on the information provided to them by System Owners/Managers

**PIA Frequently Asked Questions**

- April, May & June 2008

## PIA Frequently Asked Questions

**Is there a list of examples of PII?  No, because the list is endless.  Examples include, but are not limited to:**
- Name (to include initials if they can identify an individual)
- SSN (to include the last 4 digits)
- Date and place of birth
- Mother’s maiden name
- Financial transactions
- Medical, educational, and criminal history
- Biometric records (i.e., fingerprints, identified human subjects material, etc.)
- Photographs
- Other identifiers linked to an individual’s name (Patient #, Principal Investigator #, Vacancy Announcement #, ROC or P.O. #, etc.)

- April, May & June 2008

## What is a Unique Project Identifier (UPI) Number?
The Unique Project Identifier (UPI) Number is used to report IT investments during the budget process and ensure the integration of strategic planning, budgeting, procurement, and the management of IT investments in support of the agency’s mission and business needs.  It reflects information such as the OPDIV and office where the investment project was initiated, the type of investment, and other information.  The UPI is used by OMB to track the system through the PIA, C&A, and POA&M processes.  The number is attached to Exhibit 53s and described in Exhibit 300s, which are submitted to OMB prior to major investment and budget requests.  Ex. 009-25-xx-xx-xx-xxxx-xx-xxx-xxx

	NOTE: Not all systems have UPI numbers.  Some systems are part of larger or umbrella investments and would inherit the UPI number from that investment.  If a UPI number does not exist for an IT system or the system is not covered by an umbrella investment, you must provide an explanation on the PIA form

How can I find a UPI number?
If you are unsure about the UPI, contact the Project Officer.  If he/she is not able to assist you, contact the OCIO IT Policy and Review Office (ITPRO), the OCIO Information Technology Acquisition Services Office (ITASO), or the OCIO Information Security and Awareness Office (ISAO)

- The Unique Project Identifier (UPI) Number is used to report IT investments during the budget process and ensure the integration of strategic planning, budgeting, procurement, and the management of IT investments in support of the agency’s mission and business needs.  It reflects information such as the OPDIV and office where the investment project was initiated, the type of investment, and other information.  The UPI is used by OMB to track the system through the PIA, C&A, and POA&M processes.  The number is attached to Exhibit 53s and described in Exhibit 300s, which are submitted to OMB prior to major investment and budget requests.  Ex. 009-25-xx-xx-xx-xxxx-xx-xxx-xxx
**	**_NOTE_: Not all systems have UPI numbers.  Some systems are part of larger or umbrella investments and would inherit the UPI number from that investment.  If a UPI number does not exist for an IT system _or_ the system is not covered by an umbrella investment, you must provide an explanation on the PIA form
- How can I find a UPI number?
- If you are unsure about the UPI, contact the Project Officer.  If he/she is not able to assist you, contact the OCIO IT Policy and Review Office (ITPRO), the OCIO Information Technology Acquisition Services Office (ITASO), or the OCIO Information Security and Awareness Office (ISAO)

**PIA Frequently Asked Questions**

- April, May & June 2008

## What is a System of Records Notice (SORN) Number?
	It describes the Privacy Act system of records notice which covers the information collection; the categories of information collected, maintained, retrieved, and used within the system.  It provides information to the public on various characteristics of the records system (e.g. purpose, legal authority, routine uses, access and notification, retention and disposal) and how NIH intends to manage and protect the system.  The SORN is also referred to as the Systems Notice. The NIH number appears as 09-25-xxxx.  The HHS number appears as 09-90-xxxx.  Other Office of Personnel Management (OPM) or Office of Government Ethics (OGE SORNs may also cover the applicable records system.       
	NOTE: If the system is subject to the Privacy Act, then a SORN must be cited as an answer in question 4.
To find a list of NIH Privacy Act SORNs, click here:
	http://oma.od.nih.gov/ms/privacy/pa-files/read02systems.htm 
To find a list of IC Privacy Coordinators, click here:
	http://oma.od.nih.gov/about/contact/browse.asp?fa_id=3

- 	It describes the Privacy Act system of records notice which covers the information collection; the categories of information collected, maintained, retrieved, and used within the system.  It provides information to the public on various characteristics of the records system (e.g. purpose, legal authority, routine uses, access and notification, retention and disposal) and how NIH intends to manage and protect the system.  The SORN is also referred to as the Systems Notice. The NIH number appears as 09-25-xxxx.  The HHS number appears as 09-90-xxxx.  Other Office of Personnel Management (OPM) or Office of Government Ethics (OGE SORNs may also cover the applicable records system.
- 	_NOTE_:** **If the system is subject to the Privacy Act, then a SORN must be cited** **as an answer** **in question 4.
**To find a list of NIH Privacy Act SORNs, click here:**
- 	_[http://oma.od.nih.gov/ms/privacy/pa-files/read02systems.htm](http://oma.od.nih.gov/ms/privacy/pa-files/read02systems.htm)_
**To find a list of IC Privacy Coordinators, click here:**
- 	**http://oma.od.nih.gov/about/contact/browse.asp?fa_id=3**

**PIA Frequently Asked Questions**

- April, May & June 2008

## PIA Frequently Asked Questions

- When is a record system subject to the Privacy Act?
- When it is a group of more than one record
- When it contains information about an individual
- When it is designed to be retrieved by a name or other personal identifier assigned to the individual
- _NOTE_:  A single document, or a group of records that contains publicly available information, is not considered to be a Privacy Act system of records.

- April, May & June 2008

## PIA Frequently Asked Questions

**What is an OMB Information Collection Approval Number?**
**	**The OMB Information Collection Approval or Control Number should be identical to the one OMB assigned pursuant to having been filed under the Paperwork Reduction Act (PRA) of 1995 which requires agencies to obtain approval from OMB prior to soliciting and/or obtaining identical information from 10 or more members of the public in multiple forms.  OMB approval is required whether the Federal agency collects the information itself or uses an outside agent or contractor.  OMB requires 90-120 days to approve new information collections and renew existing approvals.  It would only apply if the IT system maintains data as part of an approved OMB information collection from 10 or more members of the general public (i.e., the IT system is associated with a database used to collect survey information)
**To find a list of IC OMB Project Clearance Liaisons, click here:**
**	****http://odoerdb2.od.nih.gov/oer/policies/project_clearance/pcllist.htm**
**	**
**  **

- April, May & June 2008

## PIA Frequently Asked Questions

**Are there policies or guidelines in place with regard to the retention and destruction of IIF/PII?**
**	**Yes, records schedules (sometimes referred to as disposition or retention schedules) document the mandatory instructions for what to do with records no longer needed for current Government business, with provision of authority for the final disposition of records.
**Agency Records Schedule (NIH)** Agency records schedules governing the disposition of program and administrative records specific to that agency  **http://www1.od.nih.gov/oma/manualchapters/management/1743/ **
**General Records Schedule (GRS)** NARA issued schedules governing the disposition of specified series of administrative or housekeeping records common to several or all Federal agencies. (Example: travel, payroll, personnel)
- 	**http://www.archives.gov/records-mgmt/ardor/**
**For Privacy Act systems of records, records retention and disposal procedures are typically reflected in the SORN cited for the system  **
**To find a list of IC Records Management Officers or Liaisons, click here:**
**	****http://oma.od.nih.gov/about/contact/browse.asp?fa_id=2**
**To find a list of NIH Privacy Act SORNs, click here:**
- 	**http://oma.od.nih.gov/ms/privacy/pa-files/read02systems.htm **

- April, May & June 2008

## Must I complete a new PIA for an existing system each year?

A new PIA is not required if information has been previously assessed under a similar evaluation, or if the system has not undergone any major changes 

However, all existing PIAs must be reviewed for accuracy each year during the annual FISMA reporting cycle

- A new PIA is not required if information has been previously assessed under a similar evaluation, or if the system has not undergone any major changes
- However, all existing PIAs must be reviewed for accuracy each year during the annual FISMA reporting cycle

**PIA Frequently Asked Questions**

- April, May & June 2008

## Are there any quick tips that would make PIA completion easier?
Know the business objective of the system
Early in the process, consult with privacy stakeholders as appropriate (e.g. IC Privacy Coordinator, CIO, ISSO and others) when questions arise about PIAs, privacy and security, etc.
Ensure that your answers are accurate and complete (answer all parts of multiple part questions, provide sufficient detail, spell out acronyms, check spelling/grammar, etc.)
Remember ~ the PIA summary will be published to a public website
Avoid contradictory answers.  For example, do not deny that the system collects Social Security Numbers and then later claim that the system retrieves information by a SSN
Know how to protect the privacy of the data in the system as well as how to secure it from unauthorized access 

**Know the business objective of the system**
**Early in the process, consult with privacy stakeholders as appropriate (e.g. IC Privacy Coordinator, CIO, ISSO and others) when questions arise about PIAs, privacy and security, etc.**
**Ensure that your answers are accurate and complete (answer all parts of multiple part questions, provide sufficient detail, spell out acronyms, check spelling/grammar, etc.)**
**Remember ~ the PIA summary will be published to a public website**
**Avoid contradictory answers.  For example, do not deny that the system collects Social Security Numbers and then later claim that the system retrieves information by a SSN**
**Know how to protect the privacy of the data in the system as well as how to secure it from unauthorized access**** **

**PIA Frequently Asked Questions**

- April, May & June 2008

## PIA Frequently Asked Questions

**How do I know what kind of system I own/operate?    **
- Stand-alone:  Not connected to the NIH network or any other system.
- Network-connected:  Connected to the NIH network, another system or the LAN.
- General Support System:  An interconnected set of information resources under the same direct management control, which shares common functionality and provides necessary IT infrastructure support.  A GSS supports multiple applications and normally includes hardware, software, information, data, applications, communications, and people.  Examples include data centers, local area and wide area networks including smart terminals that supports a branch office, an agency-wide backbone, a communications network, a NIH data processing center including its operating system and utilities, a tactical radio network, or a shared information processing service organization (IPSO), and application servers that support multiple applications.   The compromise of a GSS could result in serious, severe, or catastrophic adverse harm (high or moderate impact as defined in FIPS 199) due to the loss of confidentiality, integrity, or availability of information on NIH primary missions, business functionality, public health functions, and/or employee and citizen welfare.   A GSS is subject to security certification and accreditation process.   A GSS would rise to the level of 'major' under FISMA if it is classified as either moderate or high impact as defined in FIPS 199.
- Major Application:  Major applications can be either a major software application or a combination of hardware and software in which the purpose of the system is to support a specific mission-related function, such as a NIH primary mission, business functionality, public health function and/or employee and citizen welfare.  Major applications are subject to the security certification and accreditation process and would be included as part of a system classified as either moderate of high impact as defined in FIPS 199.   Requires special attention to security because of the risk and magnitude of the serious, severe, or catastrophic adverse harm (moderate or high impact as defined in FIPS 199) that can result due to the loss of confidentiality, integrity, or availability of the application.
- Sensitive System:  A system which contains sensitive data.

- April, May & June 2008

## PIA Frequently Asked Questions

**Can we make changes to the PIA Form itself?**
- 	**No, the form was developed for us by HHS.  However, NIH has representation on the HHS FISMA Tool Working Group and continues to make recommendations to improve the form.  **
**Where is the PIA entered and stored?  **
**	****The PIA is entered in the SPORT Tool.  A copy can be saved in the NIH Certification & Accreditation Tool (NCAT) and stored there along with the C&A package.  **

- April, May & June 2008

## Does the SPORT tool inform the OSOP when I update/promote a PIA ?

No. The SPORT does not inform the OSOP when any changes are made to a PIA.  
System Owners/Managers or IC Privacy Coordinators should alert the OSOP when a PIA has been updated/promoted by calling 301-451-3426 or sending an email to privacy@mail.nih.gov 
This will improve the PIA process and increase efficiency

- No. The SPORT does not inform the OSOP when any changes are made to a PIA.
- System Owners/Managers or IC Privacy Coordinators should alert the OSOP when a PIA has been updated/promoted by calling 301-451-3426 or sending an email to _[privacy@mail.nih.gov](mailto:privacy@mail.nih.gov)__ _
- This will improve the PIA process and increase efficiency

**PIA Frequently Asked Questions**

- April, May & June 2008

## PIA Frequently Asked Questions

**What is meant by “Is the website’s privacy policy P3P compliant?”  **
- 	The question springs from the requirement in Section 208 of the E-Gov Act that says The OMB Director “shall issue guidance requiring agencies to translate privacy policies into a standardized machine-readable format.” (§ 208(c)(2)).
- 	Platform for Privacy Preferences (P3P) is a “standardized set of multiple-choice questions covering all the major aspects of a Web site’s privacy policies.”  It means that information placed on a web site is available in a standard, machine-readable format.  Specifically, P3P-enabled browsers can “read” the information automatically and compare it to the consumer’s own set of privacy preferences.
- Refer to the link below for a list of Machine-Readable Frequently Asked Questions:  **http://intranet.hhs.gov/infosec/docs/privacy/MRFAQ/Machine-Readable_Privacy_Policy_FAQs_v2_05_17_05.pdf**

- April, May & June 2008

## PIA Frequently Asked Questions

**Do we need to prepare a PIA for Visual Status of Funds (VSOF), SOFie and the Visual Employee Database (VEDS)? **
- 	Yes, although they are off-the-shelf software, most of the ICs have purchased the software independently and are running those systems separately.

- April, May & June 2008

## PIA Frequently Asked Questions

- Is the NIH Badge an identifier?  No, it’s in the public domain.
- 	_However, the NIH ID number_ (also known as the NED ID) which appears on the badge, _is an identifier_.  The NED ID was designed to replace the SSN.  The number links an individual to a record in the NED system which is covered by the Privacy Act.  The NED record is accessible to AOs, ATs, Supervisors, Crisis Team Members, IT Administrators, Division of Police, DPSAC and others and contains PII such as taxpayer status, home address, methods of contact during an emergency, etc.
- 	In addition, the NIH ID number is now visible to the general public via the NIH and HHS directories.

- April, May & June 2008

## Agenda

- Introduction
- Legislation
- Background
- Process
- SPORT: Basic Functionality
- Frequently Asked Questions
- Summary
- Resources

- April, May & June 2008

## Course Summary

- You should now be able to:
- Identify the PIA legislative drivers
- Understand the importance of conducting a PIA
- Identify what triggers the completion of a PIA
- Understand how to complete the PIA forms
- Understand how to use the SPORT tool
- Understand the importance of monitoring systems for change
- Understand the need to mitigate privacy weaknesses
- Identify sources for further information regarding the initiation, completion and submission of PIAs

- April, May & June 2008

## Contact Information

**Karen Plá**OD / Office of Management AssessmentOffice of the Senior Official for Privacy  6011 Executive Boulevard, Suite 601Rockville, Maryland  20852-7669Phone: 301-402-6201Fax: 301-402-0169_[privacy@mail.nih.gov](mailto:privacy@mail.nih.gov)_

**Kay Coupe**
- OD / Office of the Chief Information Officer
- Information Security and Awareness Office
- 10401 Fernwood Road Room 3G12
- Bethesda, MD 20817
- Phone: 301-594-9848
- Fax: 301-402-4464
- _[psfisma@mail.nih.gov](mailto:psfisma@mail.nih.gov)_

- April, May & June 2008

## Agenda

- Introduction
- Legislation
- Background
- Process
- SPORT: Basic Functionality
- Frequently Asked Questions
- Summary
- Resources

- April, May & June 2008

## ResourcesReferences

- HHS** **PIA Guide _[http://intranet.hhs.gov/infosec/docs/policies_guides/PIA/PIA_Guide.doc](http://intranet.hhs.gov/infosec/docs/policies_guides/PIA/PIA_Guide.doc)_
- HHS Information Security Program Policy _[http://intranet.hhs.gov/infosec/docs/policies_guides/ISPP/Information_Security_Program_Policy.doc](http://intranet.hhs.gov/infosec/docs/policies_guides/ISPP/Information_Security_Program_Policy.doc)__ _
- Information Security Program Privacy Policy (Memorandum) _[http://intranet.hhs.gov/infosec/docs/policies_guides/ISPPM/Infosec_Program_Privacy_Policy_memo.doc](http://intranet.hhs.gov/infosec/docs/policies_guides/ISPPM/Infosec_Program_Privacy_Policy_memo.doc)__ _
- Plan of Action and Milestone (POA&M) Guide _[http://intranet.hhs.gov/infosec/docs/policies_guides/POAM/POAMGuide.doc](http://intranet.hhs.gov/infosec/docs/policies_guides/POAM/POAMGuide.doc)__ _

- April, May & June 2008

## OMB M-03-22, Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002 http://www.whitehouse.gov/omb/memoranda/m03-22.html 
OMB M-04-24, Expanded Electronic Government portion of the President’s Management Agenda (PMA) http://www.whitehouse.gov/omb/memoranda/fy04/m04-24.html 
OMB M-07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information http://www.whitehouse.gov/omb/memoranda/fy2007/m07-16.pdf
OMB M-07-19, FY 2007 Reporting Instructions for the Federal Information Security Management Act and Agency Privacy Management http://www.whitehouse.gov/omb/memoranda/fy2007/m07-19.pdf

- OMB M-04-24, *Expanded Electronic Government portion of the President’s Management Agenda (PMA)* _[http://www.whitehouse.gov/omb/memoranda/fy04/m04-24.html](http://www.whitehouse.gov/omb/memoranda/fy04/m04-24.html)__ _
- OMB M-07-16, *Safeguarding Against and Responding to the Breach of Personally Identifiable Information* _[http://www.whitehouse.gov/omb/memoranda/fy2007/m07-16.pdf](http://www.whitehouse.gov/omb/memoranda/fy2007/m07-16.pdf)_
- OMB M-07-19, *FY 2007 Reporting Instructions for the Federal Information Security Management Act and Agency Privacy Management *_*[http://www.whitehouse.gov/omb/memoranda/fy2007/m07-19.pdf](http://www.whitehouse.gov/omb/memoranda/fy2007/m07-19.pdf)*_

**Resources****References**

- April, May & June 2008

## ResourcesReferences

- P.L. 93-579, Privacy Act of 1974 _[http://www.usdoj.gov/oip/privstat.htm](http://www.usdoj.gov/oip/privstat.htm)_
- P.L. 100-503, Computer Matching and Privacy Act of 1988 _[http://www.usdoj.gov/oip/1974compmatch.htm](http://www.usdoj.gov/oip/1974compmatch.htm)_
- P.L. 104-13, Paperwork Reduction Act http://www.archives.gov/federal-register/laws/paperwork-reduction/
- P.L. 107-347, E-Government Act of 2002, Section 208 _[http://aspe.hhs.gov/datacncl/privacy/titleV.pdf](http://aspe.hhs.gov/datacncl/privacy/titleV.pdf)_
- P.L. 107-347, E-Government Act of 2002, Title III, Federal Information Security Management Act of 2002 (FISMA) _[http://csrc.nist.gov/drivers/documents/FISMA-final.pdf](http://csrc.nist.gov/drivers/documents/FISMA-final.pdf)_
- SPORT Tool _[https://prosight-fisma.hhs.gov/prosight/](https://prosight-fisma.hhs.gov/prosight/)_

- April, May & June 2008

## ResourcesContact Information

**HHS PIA Internet Site **_**http://www.hhs.gov/pia/index.html**_
**NIH Privacy Web Site http://oma.od.nih.gov/ms/privacy/**
**NIH Policy 1745-1, NIH Privacy Impact Assessments**
**	**_[http://www3.od.nih.gov/oma/manualchapters/management/1745-1/](http://www3.od.nih.gov/oma/manualchapters/management/1745-1/)__ _
**NIH PIA Guide**
**	****http://oma.od.nih.gov/ms/privacy/NIHPIAGuide.doc**
**NIH IC Privacy Coordinators**
**	****http://oma.od.nih.gov/about/contact/browse.asp?fa_id=3**
**NIH Security Web Site http://www.cit.nih.gov/security.html**
**NIH Information Systems Security Officers**
**	****http://irm.cit.nih.gov/nihsecurity/scroster.html**
**NIH IC Records Management Officers/Liaisons**
**	****http://oma.od.nih.gov/about/contact/browse.asp?fa_id=2**
**NIH OMB Project Clearance Liaisons**
**	****http://odoerdb2.od.nih.gov/oer/policies/project_clearance/pcllist.htm**

- April, May & June 2008

## ResourcesAcronym List

- C&A – Certification and Accreditation
- CIO – Chief Information Officer
- CPIC – Capital Planning & Investment Control
- CISO – Chief Information Security Officer
- FISMA – Federal Information Security Management Act
- HHS – Department of Health & Human Services
- IIF – Information in Identifiable Form
- ISAO – Information Security & Awareness Office
- ISSO – Information Systems Security Officer
- IT – Information Technology
- ITPRO – IT Policy and Review Office
- M – Memorandum
- N/A – Not Applicable
- NCAT – NIH Certification & Accreditation Tool
- NIST – National Institute of Standards &  Technology

- OMB – Office of Management and Budget
- OSOP – NIH Office of the Senior Official for Privacy
- PIA – Privacy Impact Assessment
- PII – Personally Identifiable Information
- PL – Public Law
- POA&M – Plan of Action and Milestones
- POC – Points of Contact
- SDLC – System Development Life Cycle
- SAOP – HHS Senior Agency Official for Privacy
- SOP – NIH Senior Official for Privacy
- SORN – System of Records Notice
- SOS – Secure One Support
- SP – Special Publication
- SPORT - Security and Privacy Online Reporting Tool
- UPI – Unique Project Identifier

- April, May & June 2008

## ResourcesDefinitions

_**Accreditation**_:  The official management decision given by a senior agency official to authorize operation of an information system and to explicitly accept the risk to agency operations (including mission, functions, image, or reputation), agency assets, or individuals, based on the implementation of an agreed-upon set of security controls.  (Defined in NIST SP 800-18, Appendix B).
_**Certification**_:  A comprehensive assessment of the management, operational, and technical security controls in an information system, made in support of security accreditation, to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements for the system.  (Defined in NIST SP-37, Appendix B).

- April, May & June 2008

## ResourcesDefinitions

_**Information in Identifiable Form (IIF)**_:  Any representation of information that permits the identity of an individual to whom the information applies to be reasonably inferred by either direct or indirect means.  (Defined in the E-Gov Act of 2002, P.L. 107-347, Title II and III).
- 	Information in an information system or online collection:
- That directly identifies an individual (e.g., name, address, SSN or other identifying number or code, telephone number, email address, etc.); or
- By which an agency intends to identify specific individuals in conjunction with other data elements, i.e., indirect identification.  (These data elements may include a combination of gender, race, birth date, geographic identifier, and other descriptors).  (Defined in OMB Memorandum M-03-22, Guidance for Implementing Privacy Provisions of the E-Government Act of 2002).
- _Note_:  The acronyms IIF and PII are often used interchangeably.

- April, May & June 2008

## ResourcesDefinitions

_**Information System**_**:  **A discrete set of information resources or components (including both information and information technology) organized for the collection, processing, maintenance, use, sharing, dissemination, storage, or disposition of information in accordance with defined procedures, whether automated or manual, to support the NIH mission.
_**Personally Identifiable Information (PII**_**)**: ** **Any information about an individual maintained by an agency, including, but not limited to, education, financial transactions, medical history, and criminal or employment history and information which can be used to distinguish or trace an individual's identity, such as their name, social security number, date and place of birth, mother’s maiden name, biometric records, etc., including any other personal information which is linked or linkable to an individual.  (Defined in OMB M-06-19).
_**Plan of Action and Milestone (POA&M**_**)**:  A tool that identifies tasks that need to be accomplished.  It details resources required to accomplish the elements of the plan, any milestones in meeting the task, and scheduled completion dates for the milestones.  The purpose of the POA&M is to assist agencies in identifying, assessing, prioritizing, and monitoring the progress of corrective efforts for security weaknesses found in programs and systems.  The purpose of the POA&M is to assist agencies in identifying, assessing, prioritizing, and monitoring the progress of corrective efforts for security weaknesses found in programs and systems.  (Defined in OMB M-02-01).

- April, May & June 2008

## ResourcesDefinitions

_**Privacy Act Record**_**:**  “any item, collection, or group of information *about an individual* that is maintained by an agency, including, but not limited to, his *education, financial transactions, medical history, and criminal or employment history* and that contain his *name, or the identifying number, symbol, or other identifying particular* assigned to the individual, such as a finger or voice print or a photograph.”  (Defined in the Privacy Act of 1974, as amended.  (5 U.S.C. Section 552a(a)(4)).
_**Sensitive Information**_:  Information is considered sensitive if the loss of confidentiality, integrity, or availability could be expected to have a serious, severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals.  Further, the loss of sensitive information confidentiality, integrity, or availability might: (i) cause a significant or severe degradation in mission capability to an extent and duration that the organization is unable to perform its primary functions; (ii) result in significant or major damage to organizational assets; (iii) result in significant or major financial loss; or (iv) result in significant, severe or catastrophic harm to individuals that may involve loss of life or serious life threatening injuries.”  (Defined in Federal Information Processing Standard (FIPS) 1999).
_**System**_:  A collection of computing and/or communications components and other resources that support one or more functional objectives of an organization.  IT system resources include any IT component plus associated manual procedures and physical facilities that are used in the acquisition, storage, manipulation, display, and/or movement of data or to direct or monitor operating procedures.  An IT system may consist of one or more computers and their related resources of any size.  The resources that comprise a system do not have to be physically connected.  (Defined in NIST SP 800-16, Appendix C).

- April, May & June 2008

## ResourcesDefinitions

_**System Development Life Cycle**_:  The scope of activities associated with a system, encompassing the system’s initiation, development and acquisition, implementation, operation and maintenance, and ultimately its disposal that instigates another system initiation.  (Defined in NIST SP 800-34, Appendix E).
_**System Owner**_:  The agency official responsible for the overall procurement, development, integration, modification, or operation and maintenance of an information system.
_**Vulnerability (Privacy Weakness)**_:  A flaw or weakness in the design or implementation of an information system (including the security procedures and security controls associated with the system) that could be intentionally or unintentionally exploited to adversely affect an organization’s operations or assets through a loss of confidentiality, integrity, or availability (Defined in NIST SP 800-53, Appendix B).

- April, May & June 2008