Privacy Impact Assessment (PIA) 

for the 

Readiness and Emergency Management for Schools (REMS) 

Technical Assistance (TA) Center 

March 8, 2021 

For PIA Certification Updates Only: This PIA was reviewed on Enter date by Name of reviewer 

certifying the information contained here is valid and up to date. 

Contact Point 

Contact Person/ Title : Brandon Dent 

Contact Email: brandon.dent@ed.gov 

System Owner 

Name/Title: Madeline Sullivan 

Principal Office: OSSS 

Fiscal Year 2021 Privacy Impact Assessment -Page 1 
 

 

 

Please submit completed Privacy Impact Assessments to the Privacy Office at 

privacysafeguards@ed.gov. 

Please complete this Privacy Impact Assessment (PIA) on how personally identifiable 

information (PII) is collected, stored, protected, shared, and managed electronically by your 

system. You may wish to consult with your ISSO in completing this document. 

If a question does not apply to your system, please answer with N/A. 

1. Introduction 

1.1. Describe the system including the name, acronym, and a brief description of the program 

or purpose for the system. 

The Readiness and Emergency Management for Schools (REMS) Technical Assistance 

(TA) Center—administered by the U.S. Department of Education’s (ED) Office of Safe 

and Supportive Schools (OSSS) since 2004—serves two critical functions to help keep 

children, teachers, staff, and others safe. The REMS TA Center: 1) builds the 

preparedness capacity—including mitigation, prevention, protection, response and 

recovery efforts—of schools (private and public), school districts, and institutions of 

higher education (IHE), with their collaborative partners (local and state education 

agencies, first responders, community partners, etc.), at the local, state, and federal 

levels; and 2) serves as a “one-stop shop” for information, resources, training, and 

technical assistance on school and IHE preparedness via the 

REMS TA Center Website, accessible at https://rems.ed.gov. 

The REMS TA Center develops and provides free resources—often in collaboration with 

federal, state, regional, and local partners—training, TA, and support, including: 

• guidance documents and publications (accessible at 

https://rems.ed.gov/REMSPublications.aspx); 

• trainings in the form of online courses (accessible at 

https://rems.ed.gov/trainings/CoursesHome.aspx) and webinars (accessible at 

https://rems.ed.gov/TA_Webinars.aspx); downloadable specialized training packages 

(accessible at https://rems.ed.gov/TrainingPackage.aspx) and on-site Trainings by 

Request (accessible at https://rems.ed.gov/TA_TrainingsByRequest.aspx) at schools, 

districts, or IHEs by subject matter expert trainers; 

• Emergency Operations Plans (EOP) EOP Interactive Tools to assess knowledge of 

concepts fundamental to emergency management, and in creating and evaluating 

EOPs; 

• an online Community of Practice (COP) accessible at ( 

https://rems.ed.gov/COP/Default.aspx) for practitioners to share ideas, experiences, 

and lessons learned; and 

Fiscal Year 2021 Privacy Impact Assessment -Page 1 
 

 

 

 

 

 

 

 

 

 

 

• tailored technical assistance, both written and by phone, 

https://rems.ed.gov/TA_Submissions/TASubmissionForm. 

These resources and support help schools, districts, and IHEs create comprehensive 

EOPs and preparedness programs that address a variety of security, safety, and 

emergency management issues. Specific topics addressed include critical planning 

principles; a process for developing, reviewing, and continually revising an EOP; the 

form, function, and content of EOPs; information on key cross-cutting functions (e.g., 

communications, recovery) and activities that should be addressed in an EOP; and 

information on how to prepare for adversarial, incidental, and human-caused threats 

(e.g., gang violence, cyberthreats), natural hazards (e.g., floods), technological hazards 

(e.g., power failure), and biological hazards (e.g., infectious diseases). 

To keep practitioners informed of the REMS TA Center’s work, information is 

disseminated via social media, newsletters, calls with state practitioners, conference 

presentations and booths, and virtual meetings, among other channels. 

The REMS environment is hosted and operated on a web server and a database server 

that are dedicated to the REMS TA Center. The production servers are hosted at 

American Data Technology Inc. (ADTI), an ED-certified General Support System (GSS) 

server environment. 

1.2. Describe the purpose for which the personally identifiable information (PII)1 is collected, 

used, maintained or shared. 

Information is collected in support of the training, technical assistance and engagement 

services, and the interactive planning tools. 

• Trainings: The REMS TA Center provides live and in-person trainings by 

request to discrete educational communities as well as online training services 

including webinars and online courses. The trainings by request are now done 

virtually due to the COVID-19 pandemic and collect the same information. 

o Virtual/Live Trainings by Request Host Site Application Fields: 

information is collected about the host site to provide a live or virtual 

training on a variety of emergency management topics. REMS TA Center 

formerly conducted in-person trainings by request at the requesting 

1 The term “personally identifiable information” refers to information which can be used to distinguish or trace an 

individual's identity, such as their name, social security number, biometric records, etc. alone, or when combined 

with other personal or identifying information which is linked or linkable to a specific individual, such as date and 

place of birth, mother's maiden name, etc. OMB Circular A-130, page 33 

Fiscal Year 2021 Privacy Impact Assessment -Page 1 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

educational entity’s location, but these have transitioned to a virtual 

environment due to COVID-19. The educational entity is still considered 

the “host site,” though the REMS TA Center creates the virtual training 

environment. 

o Virtual/Live Trainings by Request Registration: information is 

collected on training participants when they register for a live or virtual 

training on a variety of emergency management topics. 

o Webinar Registration: information is collected to provide live webinar 

access information to participants and to better understand the webinar 

audience. 

o Online Course Registration: information is collected to provide login 

credentials to access online courses and track online course progress. 

• Technical Assistance and Engagement Activities: 

o Subject Matter Expert Applications: information is collected on 

potential subject matter experts, who may support training delivery, 

product creation, and other activities. While this database is used to 

support trainings conducted by the REMS TA Center, it is also used to 

source potential Subject Matter Experts (SME) who can support additional 

technical assistance activities such as content development. The primary 

purpose of this database is to have at the ready possible subject matter 

experts to support various activities as well as to ensure that we can 

process invoices for payment for services when rendered. 

o Distribution List: information is collected to create a listserv to 

disseminate announcements raising awareness about key school safety 

initiatives and activities as well as to REMS TA Center events and 

products. Information is collected within a spreadsheet and manually 

updated on a weekly, monthly, and quarterly basis. Users can opt-out of 

receiving emails from the REMS TA Center by sending an email to 

info@remstacenter.org to request removal. 

• TA Submission Form: information is collected to respond to an 

individual user’s requests for technical assistance. 

o Community of Practice Registration: information is collected to provide 

login credentials to access the secure, interactive portal within the website 

designed to facilitate collaboration among the practitioners and to share 

best practices, effective strategies, success stories, etc. 

o Tool Box Submission Form: information is collected to garner a user’s 

approval to post a user-created resource to the REMS TA Center’s website 

and a related description of the resource being submitted to the Tool Box, 

a repository of tools, documents, templates, and presentations developed 

Fiscal Year 2021 Privacy Impact Assessment -Page 1 
 

 

 

 

 

and submitted by educational agencies and practitioners in emergency 

management planning. 

• Interactive Planning Tools 

o EOP ASSIST Registration: information is collected to provide 

installation instructions for the web-accessible software application that 

education agencies may download onto their agency’s server to use, 

create, store, and update emergency operations plans. 

o K-12 Emergency Management Virtual Toolkit: information is collected 

to provide installation information for a web tool that allows education 

agencies to populate their agency’s website with continuously up-to-date 

trainings, information, guidance, and tools on emergency management. 

Unlike the Tool Box presented on the REMS TA Center website, the 

Virtual Toolkit is a data-synched tool that practitioners can upload to their 

own state or local servers. The REMS TA Center collects information 

during the registration process so that we may report to ED on the schools, 

school districts, Institutions of Higher Education (IHEs), Local Education 

Agencies (LEAs), and State Education Agencies (SEAs) that are taking 

advantage of the toolkit. 

o Higher Ed Emergency Management Virtual Toolkit: information is 

collected to provide installation information for a web tool that allows 

IHEs to share up-to-date trainings, information, guidance, and tools on 

emergency management. Unlike the Tool Box, which is a tool that 

practitioners can use to submit potential resources for consideration for 

upload to the REMS TA Center site, the Toolkit is a REMS TA Center 

data-synched tool that practitioners can upload to their state or local 

servers. The REMS TA Center collects information during the registration 

process so that we may report to ED on the schools, school districts, IHEs, 

LEAs, and SEAs who are taking advantage of the toolkit. 

o SITE ASSESS Registration: information is collected to gain a better 

understanding of who is using SITE ASSESS, a free and secure mobile 

application that allows emergency management personnel to conduct site 

assessments of their buildings and grounds. 

1.3. Is this a new system, or one that is currently in operation? 

Currently Operating System 

1.4. Is this PIA new, or is it updating a previous version? 

New PIA 

Fiscal Year 2021 Privacy Impact Assessment -Page 1 
 

 

 

 

 

 

A recent review of the system determined that the system maintains PII, as described in 

section 3.1. 

1.5. Is the system operated by the agency or by a contractor? 

Contractor 

1.5.1. If the system is operated by a contractor, does the contract or other acquisitionrelated documents include privacy requirements? 

N/A

Yes 

2. Legal Authorities and Other Requirements 

If you are unsure of your legal authority, please contact your program attorney. 

2.1. What specific legal authorities and/or agreements permit and regulate the collection and 

use of data by the system? Please include name and citation of the authority. 

The program is authorized by Title IV, Part F, Subpart 3 (National Activities for School 

Safety - 20 U.S.C. 7281) of the Elementary and Secondary Education Act (ESEA), as 

amended. The program regulations are in the U.S. Code of Federal Regulations at 34 

CFR 222. These allow for the establishment and maintenance of the program. 

SORN 

2.2. Is the information in this system retrieved by an individual’s name or personal identifier 

such as a Social Security Number or other identification? 

No 

2.2.1. If the above answer is YES, this system will need to be covered by Privacy Act 

System of Records Notice(s) (SORN(s)).2 Please provide the SORN name, number, 

Federal Register citation and link, or indicate that a SORN is in progress. 

☒ N/A 

Click here to enter text. 

2 A System of Records Notice (SORN) is a formal notice to the public that identifies the purpose for which PII is 

collected, from whom and what type of PII is collected, how the PII is shared externally (routine uses), and how to 

access and correct any PII maintained by ED. https://connected.ed.gov/om/Documents/SORN-Process.pdf 

Fiscal Year 2021 Privacy Impact Assessment -Page 1 
 

 

 

 

 

2.2.2. If the above answer is NO, explain why a SORN was not necessary. For 

example, the information is not retrieved by an identifier, the information is not 

maintained in a system of records, or the information is not maintained by the 

Department, etc. 

☒ N/A 

A SORN is not required because the information is not retrieved by a name or other 

personal identifier. 

Fiscal Year 2021 Privacy Impact Assessment -Page 1 
 

 

 

 

Records Management 

If you do not know your records schedule, please consult with your records liaison, or send 

an email to RMHelp@ed.gov 

2.3. What is the records retention schedule approved by National Archives and Records 

Administration (NARA) for the records contained in this system? Please provide all 

relevant NARA schedule numbers and disposition instructions. 

2.3 Retention Schedules 

ED 091, Communications Records, item 3: Printed and electronic publications 

Disposition: Permanent. Cut off at the end of the fiscal year. Transfer to NARA in 5-year 

blocks when the most recent records are 5 years old. 

Covers: Guidance documents, publications, training, website content (including Toolbox 

and Toolkit) and related materials created by or on behalf of the Department for 

customer consumption. 

General Records Schedule (GRS) 3.2, item 030: System access records, systems not 

requiring special accountability for access. 

Disposition: Temporary. Destroy when business use ceases. 

Covers: Records created as part of the user identification and authorization 

process to gain access to systems, such as: user profiles, log-in files, password 

files etc. 

GRS 6.5, item 010: Customer service operations records 

Disposition: Temporary. Destroy 1 year after resolved, or when no longer needed 

for business use, whichever is appropriate. 

Covers: Records from operating a call center or service center providing services 

to the public, includes incoming requests and responses, trouble tickets and 

tracking logs, recordings of call center conversations used for quality control and 

training, system data, evaluations and customer feedback, FAQs and user guides, 

related reports, and complaints and commendation records. 

GRS 6.5, item 020: Customer/client records. 

Disposition: Temporary. Delete when superseded, obsolete, or when customer 

requests the agency to remove the records. 

Covers: Distribution lists used by an agency to deliver specific goods or services 

such as: contact information for customers or clients, subscription databases for 

distributing information produced by agency, files and databases related to 

Fiscal Year 2021 Privacy Impact Assessment -Page 1 
 

 

 

 

 

 

constituent and community outreach or relations, sign-up, request, and opt-out 

forms. 

2.4. Is the PII contained in this system disposed of appropriately, and in accordance with the 

timelines in the records disposition schedule? 

Yes 

All PII is disposed of upon termination of the system and per ED’s Records Disposition 

schedule (see: https://www2.ed.gov/notices/records-management/index.html) 

3. Characterization and Use of Information 

Collection 

3.1. List the specific PII elements (e.g., name, email, address, phone number, date of birth, 

Social Security, etc.) that the system collects, uses, disseminates, or maintains. 

Items marked with an asterisk are required; other items are not. 

Virtual and Live Trainings 

Virtual/Live Trainings by Request Host Site Application: This is required information to 

determine eligibility and to create a working relationship for event planning. 

• * Name 

• Title 

• * Office phone number 

• * Email address 

• * Organization 

Virtual/Live Trainings by Request Registration 

• * Name 

• Title 

• Organization 

• Office phone number for the purpose of providing technical assistance interacting 

with the training (e.g., help connecting) 

• * Email address for the purpose of providing technical assistance during the 

training 

• Special needs information for the purpose of providing related accommodations 

Webinar Registration: Although not required, information is collected to better customize 

the information to the live audience. 

• Name 

• Title 

• Organization 

Fiscal Year 2021 Privacy Impact Assessment -Page 1 
 

 

 

 

 

 

 

 

• Phone number for the purposes of providing technical assistance during the 

webinar 

• * Email address for the purpose of accessing the webinar 

• * Special needs information for the purpose of providing related accommodations 

Online Course Registration 

• * Name for the purpose of customizing the participant’s course completion 

certificate 

• Organization 

• * Email address for the purpose of accessing the system and generating a 

username. 

• Username initially generated by the user and their email address becomes their 

username. Password is initially generated by the system; however, the user then 

creates their own password. 

Technical Assistance and Engagement Activities 

Subject Matter Expert (SME) Applications 

• * Name 

• * Title 

• * Organization 

• * Office phone number 

• * Email address 

Distribution List 

• * Email address 

TA Submission Form 

• * Name 

• Title 

• Organization 

• Affiliation 

• Office phone 

• * Email address 

Community of Practice Registration: The following information is required to 

demonstrate transparency while facilitating relationship building and the sharing of 

information and ideas. 

• * Name 

• * State 

• * City 

• * Email address 

• * Organization 

Fiscal Year 2021 Privacy Impact Assessment -Page 1 
 

 

 

 

 

 

 

 

 

• * Emergency management years of experience 

• * Education years of experience 

• * Username 

• * Password 

Tool Box Submission Form: The following information is requested to facilitate 

communication and planning while garnering approval for inclusion into the Tool Box 

section of the website, as well as to ensure the proper source information of the usergenerated item can be made evident on the site. 

• * Organization 

• Grantee status 

• * Name 

• * Organization 

• * Title 

• * Phone number 

• * Email address 

Planning Tools 

EOP ASSIST Registration information is used to help determine who is using the tool 

and how. 

• Name 

• Title 

• Organization 

• Affiliation 

• Office phone number 

• Email Address 

K-12 Emergency Management Virtual Toolkit information is used to facilitate the 

working relationship with the requestor, their information technology (IT) specialist, and 

the REMS TA Center in case the entity requires technical assistance with installation. 

• * Name 

• * Title 

• * Organization 

• Affiliation 

• Agency address 

• Office phone number 

• * Email address 

Higher Ed Emergency Management Virtual Toolkit information is used to facilitate the 

working relationship with the requestor, their IT specialist, and the REMS TA Center in 

case the entity requires technical assistance with installation. 

Fiscal Year 2021 Privacy Impact Assessment -Page 1 
 

 

 

 

 

 

 

 

• * Name 

• * Title 

• * Organization 

• Affiliation 

• Office phone number 

• * Email address 

SITE ASSESS Registration 

• * Name 

• * Title 

• * Organization 

• Affiliation 

• Office phone number 

• * Email address 

3.2. Does the system collect only the minimum amount required to achieve the purpose 

stated in Question 1.2? 

Yes 

The information collected is the minimum necessary provide the training, technical 

assistance, engagement services, and interactive planning tools found at the REMS TA 

Center. No information is collected that is not required for these purposes. 

3.3. What are the sources of PII collected (e.g., individual, school, another agency, 

commercial sources, etc.)? 

Users provide information to the REMS TA Centers using the subsystems described 

under 3.1. PII sources include individuals, grantees, SEAs, LEAs, IHEs, private and 

charter school representatives, key education community partners, and other key 

stakeholders. Subsystems are not connected, meaning that each subsystem is supported 

by an individual database. User emails submitted through all subsystems are manually 

added to the REMS TA Center distribution list. 

3.4. How is the PII collected from the stated sources listed in Question 3.3 (e.g., paper form, 

web page, database, etc.)? 

Users submit the information via one of the subsystems described above. Names and 

email addresses collected for the distribution list are either collected via the subsystems 

described above or via direct email submission from the user, the REMS TA Center 

Contracting Officer’s Representative (COR), or our federal partners. For subsystems that 

require log-in access, the system generates the password and saves it in the database in 

Fiscal Year 2021 Privacy Impact Assessment -Page 1 
 

 

 

 

an encrypted format. The data are collected using web forms and stored in a backend 

database. 

Virtual and Live Training Systems 

Virtual/Live Trainings by Request Host Site Application Fields 

• Information is collected via a fillable PDF form. 

Virtual/Live Trainings by Request Registration 

• Information is collected via a fillable PDF form. 

Webinar Registration 

• Information is collected via a HTML-based registration form and stored within an 

external database. 

Online Course Registration 

• Information is collected via a HTML-based registration form and stored within an 

external database. 

Technical Assistance and Engagement Activities 

Subject Matter Expert Applications 

• Information is collected via a fillable PDF form. 

Distribution List 

• Information is collecting using a variety of strategies: 

 Emails submitted by ED and federal partners to the REMS TA Center for 

inclusion in the list; 

 Emails received via networking with practitioners and stakeholders during 

live events, including live trainings; national, state, and local conferences; 

and other live event types; and 

 Emails received via information collected within other systems, such as 

those outlined in this document. (For example, all webinar, online course, 

toolkit, tool box, planning tools, and other system registrant types are 

automatically added to the distribution list as a standard practice.) 

TA Submission Form 

• Information is collected via a HTML-based registration form and stored within an 

external database. Information is also collected by telephone and email and stored 

in the same external database. 

COP Registration 

• Information is collected via a HTML-based registration form and stored within 

the COP’s administrative system. 

Fiscal Year 2021 Privacy Impact Assessment -Page 1 
 

 

 

• User ID is displayed in discussion board posts, but no other PII will be posted to 

the REMS public portal for any reason. 

• Since users craft their profile and voluntarily decide what to share in discussion 

board posts, there is a possibility that PII could be exchanged through these posts. 

Tool Box Submission Form 

• Information is collected via a HTML-based registration form and stored in an 

external database. 

Planning Tools 

EOP ASSIST Registration 

• Information is collected via a HTML-based registration form and stored in an 

external database. 

K-12 Emergency Management Virtual Toolkit 

• Information is collected via a HTML-based registration form and stored in an 

external database. 

Higher Ed Emergency Management Virtual Toolkit 

• Information is collected via a HTML-based registration form and stored in an 

external database. 

SITE ASSESS Registration 

• Information is collected via a HTML-based registration form and stored in an 

external database. 

3.5. How is the PII validated or confirmed to ensure the integrity of the information 

collected?3 Is there a frequency at which there are continuous checks to ensure the PII 

remains valid and accurate? 

The system sends a verification email to the email address supplied to verify the contact 

details through a confirmation email. The user is responsible for making updates and 

ensuring the data on the website are correct. The users created accounts on their own 

and validate their own PII by checking it. The users are able to check the data they input 

while registering and by the email confirmation they receive. 

Virtual and Live Training Systems 

Virtual/Live Trainings by Request Host Site Application Fields 

• REMS TA Center staff follow up with the contact to complete next steps to 

support review, approval, and hosting of trainings. Contact information is 

3 Examples include restricted form filling, account verification, editing and validating information as it is collected, 

and communication with the individual whose information it is. 

Fiscal Year 2021 Privacy Impact Assessment -Page 1 
 

 

 

 

 

 

validated at that time and continuous checks are not required, as the information is 

only used to support the individual training. Training host site email addresses are 

also added to the REMS TA Center distribution list, which is checked for 

inoperable email addresses. 

Virtual/Live Trainings by Request Registration 

o The system sends a verification email to the email address supplied to verify the 

contact details provided through a confirmation email. The REMS TA Center 

receives a carbon copy of all registration details provided, which are stored in an 

external database. Continuous checks are not required, as the information is only 

used to support the individual training. Training participant email addresses are 

also added to the REMS TA Center distribution list, which is checked regularly 

for inoperable email addresses. 

Webinar Registration 

o The system sends a verification email to the email address supplied to verify the 

contact details provided through a confirmation email. The REMS TA Center 

receives a carbon copy of all registration details provided, which are stored in an 

external database. Continuous checks are not required, as the information is only 

used to support the individual webinar. Webinar participant email addresses are 

also added to the REMS TA Center distribution list, which is checked regularly 

for inoperable email addresses. 

Online Course Registration 

o The system sends a verification email to the email address supplied to verify the 

username and login details provided through a confirmation email sent only to the 

course registrant. Users can access and update details (username and password) 

using the Forgot Password feature on the Online Courses section of the REMS 

TA Center site. The REMS TA Center can reset passwords for users and confirm 

email addresses and usernames provided along with registration but does not 

conduct continuous checks to ensure information provided is accurate, as that is 

the responsible of each registrant. Online course participant email addresses are 

also added to the REMS TA Center distribution list, which is checked regularly 

for inoperable email addresses. 

Technical Assistance and Engagement Activities 

Subject Matter Expert Applications 

• REMS TA Center staff follow up with the SME to complete next steps to support 

the application approval process, task hiring process, or invoicing process. 

Contact information is validated at that time and continuous checks are performed 

annually, as well during each instance in which a particular SME’s skills are 

required and utilized. SME email addresses are also added to the REMS TA 

Fiscal Year 2021 Privacy Impact Assessment -Page 1 
 

 

 

 

 

 

 

Center distribution list, which is checked following regularly for inoperable email 

addresses. 

Distribution List 

o The REMS TA Center distribution list is checked regularly for inoperable email 

addresses and to validate email addresses provided. This includes following each 

mass distribution, as well as on a quarterly basis. 

TA Submission Form 

o The system sends a verification email to the email address supplied to verify the 

username and login details provided through a confirmation email. The REMS 

TA Center receives a carbon copy of all registration details provided, which are 

stored in an external database. Continuous checks are not required, as the 

information is only used to support the individual TA request. TA requestor email 

addresses are also added to the REMS TA Center distribution list, which is 

checked regularly for inoperable email addresses. 

Collaboration/Information-Sharing Systems 

Community of Practice Registration 

o The system sends a verification email to the email address supplied to verify the 

username and login details provided through a confirmation email sent only to the 

COP member. Users can update access details (username and password) using the 

Forgot Password feature on the COP. The REMS TA Center can reset passwords 

for users and confirm email addresses and usernames provided along with the 

member registration process but does not conduct continuous checks to ensure 

information provided is accurate, as that is the responsible of each member. COP 

member email addresses are also added to the REMS TA Center distribution list, 

which is checked following regularly for inoperable email addresses. 

Tool Box Submission Form 

• Information is collected via a HTML-based registration form and stored in an 

external database. REMS TA Center staff follow up with the contact to complete 

next steps to support review, vetting, and submission to the department for 

review, as well as to complete the required follow up to the submitter before 

posting of submitted resources to the REMS TA Center website. Contact 

information is validated at that time and continuous checks are not required, as the 

information is only used to support the individual task of reviewing, vetting, 

submitting for approval, and follow-up. Tool Box submitter email addresses are 

also added to the REMS TA Center distribution list, which is checked following 

regularly for inoperable email addresses. 

Fiscal Year 2021 Privacy Impact Assessment -Page 1 
 

 

 

 

Planning Tools 

EOP ASSIST Registration 

• The system sends a verification email to the email address supplied to verify the 

contact details provided through a confirmation email. The REMS TA Center 

receives a carbon copy of all registration details provided, which are stored in an 

external database. Continuous checks are not required, as the information is only 

used to support data analysis on tool usage and/or to support the provision of 

individual technical assistance, which is fielded/received through the TA Request 

Submission Form or a direct email or phone call to the REMS TA Center Help 

Desk. EOP ASSIST registrant email addresses are also added to the REMS TA 

Center distribution list, which is checked following regularly for inoperable email 

addresses. 

K-12 Emergency Management Virtual Toolkit 

• The system sends a verification email to the email address supplied to verify the 

contact details provided through a confirmation email. The REMS TA Center 

receives a carbon copy of all registration details provided, which are stored in an 

external database. Continuous checks are not required, as the information is only 

used to support data analysis on tool usage and/or to support the provision of 

individual technical assistance, which is fielded/received through the TA Request 

Submission Form or a direct email or phone call to the REMS TA Center 

HelpDesk. Toolkit registrant email addresses are also added to the REMS TA 

Center distribution list, which is checked following regularly for inoperable email 

addresses. 

Higher Ed Emergency Management Virtual Toolkit 

• The system sends a verification email to the email address supplied to verify the 

contact details provided through a confirmation email. The REMS TA Center 

receives a carbon copy of all registration details provided, which are stored in an 

external database. Continuous checks are not required, as the information is only 

used to support data analysis on tool usage and/or to support the provision of 

individual technical assistance, which is fielded/received through the TA Request 

Submission Form or a direct email or phone call to the REMS TA Center Help 

Desk. Toolkit registrant email addresses are also added to the REMS TA Center 

distribution list, which is checked following regularly for inoperable email 

addresses. 

SITE ASSESS Registration 

• Information is collected via a HTML-based registration form and stored in an 

external database. The system sends a verification email to the email address 

supplied to verify the contact details provided through a confirmation email. The 

REMS TA Center receives a carbon copy of all registration details provided, 

which are stored in an external database. Continuous checks are not required, as 

the information is only used to support data analysis on tool usage and/or to 

support the provision of individual technical assistance, which is fielded/received 

Fiscal Year 2021 Privacy Impact Assessment -Page 1 
 

 

 

 

 

 

 

 

 

 

 

through the TA Request Submission Form or a direct email or phone call to the 

REMS TA Center Help Desk. Toolkit registrant email addresses are also added to 

the REMS TA Center distribution list, which is checked following regularly for 

inoperable email addresses. 

Use 

3.6. Describe how the PII is used to achieve the purpose stated in Question 1.2 above. 

Virtual and Live Training Systems 

Virtual/Live Trainings by Request Host Site Application Fields 

• Information is collected via a fillable PDF form. Information is collected about 

the host site to provide a live or virtual training on a variety of emergency 

management topics. The REMS TA Center uses Adobe Connect and Zoom 

platforms to host virtual trainings. 

Virtual/Live Trainings by Request Registration 

• Information is collected via a fillable PDF form. Information collected is used to 

confirm access to the virtual or live meeting room. The REMS TA Center uses 

Adobe Connect and Zoom platforms to host virtual trainings. 

Webinar Registration 

• Information is collected via a HTML-based registration form and stored within an 

external database. Information is used to provide webinar access information to 

participants and to better understand the webinar audience. The REMS TA Center 

uses Adobe Connect and Zoom platforms to host webinars. 

Online Course Registration 

• Information is collected via a HTML-based registration form and stored within an 

external database. Information is used to provide login credentials to access online 

courses and track online course progress. No third-party system is used to host 

these. 

Technical Assistance and Engagement Activities 

Subject Matter Expert (SMEs) Applications 

• Information is collected via a fillable PDF form and stored within an external 

database. Information is collected on SMEs who may support training delivery, 

product creation, and other activities. Information is used to conduct background 

checks, if necessary, and to complete payments for services rendered. These data 

are stored external to the system outside the web application system boundary and 

are not connected to the REMS web application. 

Fiscal Year 2021 Privacy Impact Assessment -Page 1 
 

 

 

 

 

Distribution List 

• Information is used to disseminate announcements and information related to 

REMS TA Center events and products. Information is disseminated via an HTML 

email that is created by the REMS TA Center. No third-party providers are used 

to create or disseminate the announcement. 

TA Submission Form 

• Information is collected via a HTML-based registration form and stored within an 

external database. Information is used to respond to technical assistance requests. 

Community of Practice Registration 

• Information is collected via a HTML-based registration form and stored within 

the COP’s administrative system. Information is used to provide login credentials 

to access the website, used to disseminate REMS guidance information and 

facilitate collaboration among the practitioners using COP for sharing best 

practices and success stories. 

Tool Box Submission Form 

• Information is collected via a HTML-based registration form and stored in an 

external database. Information is used to contact the submitter who described 

resources submitted to the Tool Box, a repository of tools, documents, templates, 

and presentations used by education agencies and partners in emergency 

management planning. 

Planning Tools 

EOP ASSIST Registration 

• Information is collected via a HTML-based registration form and stored in an 

external database. Information is used to provide installation instructions for the 

web-accessible software application that education agencies may download to 

their server and use to create, update, and store emergency operations plans. This 

web-accessible software app for SEAs, Regional Education Agencies (REAs) 

school districts, and schools to host on their own servers, directs planning team 

members through a process that will result in the output of an EOP according to 

the federal guidelines for developing a high-quality school EOP. EOP ASSIST 

users are prompted through the six-step planning process recommended in the 

School Guide and generates a customized school EOP. The registrant’s server 

has to meet installation requirements, which are provided via an Installation 

Manual. 

K-12 Emergency Management Virtual Toolkit 

Fiscal Year 2021 Privacy Impact Assessment -Page 1 
 

 

 

 

 

 

 

 

 

 

 

 

• Information is collected via a HTML-based registration form and stored in an 

external database. Information is used to provide installation information for a 

web tool that allows education agencies to populate their own website to share upto-date trainings, information, guidance, and tools on emergency management. As 

a web-accessible toolkit to populate their website, it is intended to be installed 

locally on a SEA or LEA server and be made accessible via a designated web 

address to practitioners interested in accessing the latest information, resources 

and training opportunities related to K-12 school emergency management. 

Higher Ed Emergency Management Virtual Toolkit 

• Information is collected via a HTML-based registration form and stored in an 

external database. Information is used to provide installation information for a 

web tool that allows education agencies to create a website to share up-to-date 

trainings, information, guidance, and tools on emergency management. As a webaccessible toolkit, it is intended to be installed locally on a SEA or LEA server 

and be made accessible via a designated web address to practitioners interested in 

accessing the latest information, resources and training opportunities related to 

higher education emergency management. 

SITE ASSESS Registration 

• Information is collected via a HTML-based registration form and stored in an 

external database. Information is collected only to gain a better understanding of 

who is using SITE ASSESS. This mobile application is designed specifically for 

education agencies. It allows personnel to walk around buildings and grounds and 

conduct a site assessment. SITE ASSESS equips practitioners with information 

and knowledge about fundamental site assessment topics, allows users to add 

locality- and state-specific questions and skip entire sections that are not 

applicable to their education agency, and exports site assessment data for data 

aggregation/analysis and recordkeeping. EOP data stored by users are not stored 

by the REMS TA Center; only registration details are stored. 

3.7. . Is the system using PII for testing/researching new applications or information systems 

prior to deployment or for training employees? 

No. We do not collect registration data for application improvement or training 

purposes, only for reporting purposes. An installation manual is provided to support any 

required trainings on use of the application. In addition, users can provide feedback on 

the application, as well as request TA regarding use of the application, by contacting the 

Fiscal Year 2021 Privacy Impact Assessment -Page 1 
 

 

 

 

 

 

 

 

 

 

 

 

REMS TA Center Help Desk. Beta testing of applications is conducted using experts 

sourced via our SME database, or experts approved through collaboration with ED. 

3.7.1. If the above answer is YES, what controls are in place to minimize the risk and 

protect the data? 

☒ N/A 

Click here to enter text. 

Social Security Numbers 

It is the Department’s Policy that, in order to collect Social Security Numbers, the System Owner 

must state the collection is: 1) authorized by law, 2) necessary for an agency purpose, and 3) 

there is no reasonable alternative. 

3.8. Does the system collect Social Security Numbers? Note that if the system maintains 

Social Security Numbers but does not explicitly collect them, answer 3.8.1 to address the 

purpose for maintaining them. 

No 

3.8.1. If the above answer is YES, explain the purpose for its collection, and how the 

SSN will be used. 

☒ N/A 

3.8.2. Specify any alternatives considered in the collection of SSNs and why the 

alternatives were not selected. 

☒ N/A 

Click here to enter text. 

4. Notice 

4.1. How does the system provide individuals with notice about the collection of PII prior to 

its collection (e.g., direct notice, such as a Privacy Act Statement (if applicable) or 

public notice, such as a SORN, PIA,)? If notice is not provided, explain why not. 

The REMS TA Center website is being enhanced to include the Department’s privacy 

policy (accessible at https://www2.ed.gov/notices/privacy/index.html) so that users are 

Fiscal Year 2021 Privacy Impact Assessment -Page 1 
 

 

 

 

 

 

notified as they submit information. The REMS TA Center will align with and integrate 

the Department’s privacy policy with its practices and Website. 

Currently, the REMS COP presents the following privacy policy: “PRIVACY POLICY: 

The U.S. Department of Education and REMS TA Center will not sell any personal 

information about REMS TA Center CoP members to any third parties. The U.S. 

Department of Education and REMS TA Center may use account information generically 

in order to revise its services or present findings from the use of its services.” 

4.2. Provide the text of the notice or the link to the webpage where the notice is posted if 

notice is provided other than by SORN or PIA. 

N/A

The system will present potential submitters with the link to the Department’s privacy 

notice accessible at https://www2.ed.gov/notices/privacy/index.html 

4.3. What opportunities are available for individuals to consent to uses (including new uses 

of previously collected PII), decline to provide PII, or opt out of the project? 

The only new use of PII is the REMS TA Center adds emails to the distribution list. As users 

access those free training and technical assistance services that require an email, the only new 

use would be that the email is then added to the distribution list. 

• There is no automated function adding a user’s email address to the distribution list. 

• Staff add a user’s email address to the distribution list manually. 

• There is no function that allows users to opt out of their email being added to the 

distribution list in advance. 

• Users can email or call to be removed from the distribution list. 

The following services require the submission of an email and result in users being added to the 

distribution list. 

Virtual and Live Training Systems 

• Virtual/Live Trainings by Request Host Site Application Fields 

Virtual/Live Trainings by Request Registration 

Webinar Registration 

Online Course Registration 

Technical Assistance and Engagement Activities 

Fiscal Year 2021 Privacy Impact Assessment -Page 1 
 

 

 

 

 

 

 

Subject Matter Expert Applications 

TA Submission Form 

Community of Practice Registration 

Tool Box Submission Form 

Planning Tools 

EOP ASSIST Registration 

K-12 Emergency Management Virtual Toolkit 

Higher Ed Emergency Management Virtual Toolkit 

SITE ASSESS Registration 

4.4. Is the notice referenced in Question 4.1 reviewed and revised when there are changes in 

the practice, policy, or activities that affect the PII and privacy to ensure that individuals 

are aware of and can consent to, where feasible, these changes? 

Yes 

5. Information Sharing and Disclosures 

Internal 

5.1. Will PII be shared internally with other ED principal offices? If the answer is NO, please 

skip to Question 5.4. 

No 

5.2. What PII will be shared and with whom? 

☒ N/A 

Click here to enter text. 

5.3. What is the purpose for sharing the specified PII with the specified internal 

organizations? 

☒ N/A 

Fiscal Year 2021 Privacy Impact Assessment -Page 1 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Click here to enter text. 

External 

5.4. Will the PII contained in the system be shared with external entities (e.g., another 

agency, school district, the public, etc.)? If the answer is NO, please skip to Question 

6.1. 

No 

5.5. What PII will be shared and with whom? List programmatic disclosures only.4 

Note: If you are sharing Social Security Numbers externally, please specify to 

whom and for what purpose. 

☒ N/A 

Click here to enter text. 

5.6. What is the purpose for sharing the PII with the specified external entities? 

☒ N/A 

Click here to enter text. 

5.7. Is the sharing with the external entities authorized? 

☒ N/A 

Click here to select. 

5.8. Is the system able to provide and retain an account of any disclosures made and make it 

available upon request? 

☒ N/A 

Click here to select. 

5.9. How is the PII shared with the external entity (e.g., email, computer match, encrypted 

line, etc.)? 

☒ N/A 

Click here to enter text. 

5.10. Is the sharing pursuant to a Computer Matching Agreement (CMA), 

Memorandum of Understanding (MOU), or other type of approved sharing agreement 

with another agency? 

☒ N/A 

4 If this information is covered by Privacy Act System of Records Notice (SORN) please list only relevant 

programmatic disclosures listed under the Routine Uses section. 

Fiscal Year 2021 Privacy Impact Assessment -Page 1 
 

 

 

 

 

 

 

 

Click here to select. 

5.11. Does the project place limitation on re-disclosure? 

☒ N/A 

Click here to select. 

6. Redress 

6.1. What are the procedures that allow individuals to access their own information? 

REMS users can create and continually access and edit their CoP profiles once logged in 

to the COP. As for the other forms, users can continually update them and resubmit to 

the REMS TA Center. Users can either access the information directly via the subsystem 

or via the email confirmation sent when uploading a file, registering, or completing 

another subsystem-based action. See details below. 

Virtual and Live Training Systems 

Virtual/Live Trainings by Request Host Site Application Fields 

• Information is collected via a fillable PDF form and only used for the purposes 

outlined. Applicants receive a copy of the form submitted and can also request a 

copy from the REMS TA Center via the Help Desk. 

Virtual/Live Trainings by Request Registration 

• Information is collected via a fillable PDF form and only used for the purposes 

outlined. Applicants receive a copy of the form submitted and can also request a 

copy from the REMS TA Center via the Help Desk. 

Webinar Registration 

• Information is collected via a HTML-based registration form, stored within an 

external database, and only used for the purposes outlined. Individuals receive a 

carbon copy of the registration information inputted during the registration 

process and can request a copy from the REMS TA Center via the Help Desk. 

Online Course Registration 

• Information is collected via a HTML-based registration form, stored within an 

external database, and only used for the purposes outlined. Individuals receive a 

carbon copy of the registration information inputted during the registration 

process and can request a copy from the REMS TA Center via the Help Desk. 

Technical Assistance and Engagement Activities 

Fiscal Year 2021 Privacy Impact Assessment -Page 1 
 

Subject Matter Expert Applications 

• Information is collected via a fillable PDF form and only used for the purposes 

outlined. Individuals receive a carbon copy of the information inputted during the 

application process and can request a copy from the REMS TA Center via the 

Help Desk. 

Distribution List 

• Information is only used for the purposes outlined. They can unsubscribe at any 

time by sending an email to the REMS TA Center Help Desk. 

TA Submission Form 

• Information is collected via a HTML-based registration form, stored within an 

external database, and only used for the purposes outlined. Individuals receive a 

carbon copy of the registration information inputted during the registration 

process and can request a copy from the REMS TA Center via the Help Desk. 

Community of Practice Registration 

• Information is collected via a HTML-based registration form and stored within 

the CoP’s administrative system. Individuals receive a carbon copy of the 

information inputted during the registration process and can request support with 

resetting their password in order to access information inputted by contacting the 

REMS TA Center via the Help Desk. Users create their profile and may access 

and edit their user profile information using the account login details created 

during the registration process. 

Tool Box Submission Form 

• Information is collected via a HTML-based registration form and stored in an 

external database. Individuals receive a carbon copy of the information inputted 

during the application process and can request a copy from the REMS TA Center 

via the Help Desk. 

Planning Tools 

EOP ASSIST Registration 

• Information is collected via a HTML-based registration form and stored in an 

external database. Individuals receive a carbon copy of the information inputted 

during the application process and can request a copy from the REMS TA Center 

via the Help Desk. 

K-12 Emergency Management Virtual Toolkit 

• Information is collected via a HTML-based registration form and stored in an 

external database. Individuals receive a carbon copy of the information inputted 

during the application process and can request a copy from the REMS TA Center 

via the Help Desk. 

Fiscal Year 2021 Privacy Impact Assessment -Page 1 
 

 

 

Higher Ed Emergency Management Virtual Toolkit 

• Information is collected via a HTML-based registration form and stored in an 

external database. Individuals receive a carbon copy of the information inputted 

during the application process and can request a copy from the REMS TA Center 

via the Help Desk. 

SITE ASSESS Registration 

• Information is collected via a HTML-based registration form and stored in an 

external database. Individuals receive a carbon copy of the information inputted 

during the application process and can request a copy from the REMS TA Center 

via the Help Desk. 

6.2. What procedures are in place to allow the subject individual to correct inaccurate or 

erroneous information? 

REMS users have access to their profiles, as well as the forms submitted through our 

subsystems. They can either access the information directly via the subsystem or via the 

email confirmation sent when uploading a file, registering, or completing another 

subsystem-based action to correct that information or contact technical support to make 

changes to the information they provided. 

6.3. How does the project notify individuals about the procedures for correcting their 

information? 

Guidance for correcting information is provided on the website. Contact information for 

support is provided on the website. 

7. Safeguards 

If you are unsure which safeguards will apply, please consult with your ISSO. 

7.1. Does the principal office work with their CSO/ISSO to build privacy & security into the 

system and build privacy extensions to the extent feasible? 

Yes 

7.2. Is an Authority to Operate (ATO) required? 

Fiscal Year 2021 Privacy Impact Assessment -Page 1 
 

 

 

 

 

 

Yes 

7.3. Under NIST FIPS Pub. 199, what is the security categorization of the system: Low, 

Moderate, or High? 

N/A

Low 

7.4. What administrative, technical, and physical safeguards are in place to protect the 

information? 

The REMS TA Center is administered through a contract with the Office of Safe and 

Supportive Schools within the Office of Elementary and Secondary Education. REMS 

administrative access is only available to authorized users of the contracted service 

provider. 

The administrative access includes administrative access to COP, TA submissions, site 

access registrations and course registrations. Administrator access is limited to REMS 

system administrators who are designated users approved by ED. The number of 

personnel who have administrative access is restricted to only those who perform 

specific functions that require access. Administrative access allows the system 

administrators to generate reports that are required for analytical purposes. 

REMS only supports communication using the latest secured Transport Layer Security 

protocols. The system is independent; it does not collect data from other systems or 

share data with other systems. All personnel working with REMS must agree to 

established rules of behavior. REMS TA Center contracted personnel in system 

administration and support roles must complete personnel background screening and 

complete additional training including role-based, incident response, and disaster 

recovery training. 

Physical security is maintained in accordance with National Institute of Standards and 

Technology (NIST) guidelines for information security. REMS technical and 

administrative controls comply with the Federal Information Security Modernization Act 

requirements and with NIST standards. 

7.5. Is the information in the system appropriately secured in accordance with the IT 

security requirements and procedures as required by Federal law and policy? 

Fiscal Year 2021 Privacy Impact Assessment -Page 1 
 

 

 

 

 

 

 

 

Yes 

7.6. Has a risk assessment been conducted where appropriate security controls to protect 

against that risk have been identified and implemented? 

Yes 

7.7. Please describe any monitoring, testing or evaluation conducted on a regular basis to 

ensure the security controls continue to work properly at safeguarding the PII. 

The system undergoes monthly scans and annual security assessment reviews and is 

continuously monitored using endpoint protection tools. 

8. Auditing and Accountability 

8.1. How does the system owner assess and ensure that the PII is used in accordance with 

stated practices in this PIA? 

The REMS system owner ensures that the information is used following stated practices 

in this PIA through several methods. One method is completing ED’s Risk Management 

Framework process and receiving an authorization to operate. Under this process, a 

variety of controls are assessed by an independent assessor to ensure the REMS website 

and application and the data residing within are appropriately secured and protected. 

One-third of all NIST security controls are tested each year, and the entire system’s 

security is re-evaluated regularly. The PIA is reviewed and updated on an as-needed 

basis and, at a minimum, biennially. These methods help to ensure that the information 

is used within the stated practices outlined in this PIA. 

8.2. Does the system owner continuously monitor and audit the privacy controls to ensure 

effective implementation? 

Yes 

8.3. What are the privacy risks associated with this system and how are those risks 

mitigated? 

This PIA details the privacy controls and safeguards implemented for this system to 

mitigate privacy risk. These controls and safeguards work to protect the data from 

privacy threats and mitigate the risks to the data. Additionally, privacy risks have been 

Fiscal Year 2021 Privacy Impact Assessment -Page 1 
 

 

 

 

 

 

 

 

 

 

reduced by only collecting the minimum PII necessary and by not collecting any 

sensitive PII. 

Role-based access controls are implemented to ensure access to data are restricted to 

authorized users only. Access to monitoring- and auditing-related documents are limited 

to ED employees with appropriately approved access authorization. 

As part of the COP only, user ID is displayed in discussion board posts, but no other PII 

will be posted to the REMS public portal for any reason. Since users craft their profile 

and voluntarily decide what to share in discussion board posts, there is a possibility that 

PII could be exchanged through these posts. 

The privacy risk associated with the system is minimal. The system only maintains the 

minimal amount of information needed for maintaining the login credentials and 

performing the other services described in this PIA. The following additional mitigation 

strategies are employed: 

• The REMS TA Center personnel continuously monitors the COP page for any 

questionable posts as well as ensures that all features comply with IT 

requirements. Moderation includes identifying questionable posts; removing 

questionable posts (after consultation with ED personnel); and removing users 

who continually do not adhere to the rules of behavior (and after consultation with 

ED personnel.). 

• The COP Rules page includes: 

 Privacy Policy: “The U.S. Department of Education and REMS TA Center 

will not sell any personal information about REMS TA Center CoP 

members to any third parties. The U.S. Department of Education and 

REMS TA Center may use account information generically in order to 

revise its services or present findings from the use of its services.” 

 Notice of how account information is used: “The U.S. Department of 

Education and REMS TA Center will not sell any personal information 

about REMS TA Center CoP members to any third parties. The U.S. 

Department of Education and REMS TA Center may use account 

information generically in order to revise its services or present findings 

from the use of its services.” 

• REMS TA Center Community Rules 

• Codes of Conduct, which includes details on the following: 

o Think twice before posting confidential or sensitive information; 

o You are accountable for messages posted to the COP; 

o A strong and diverse community requires mutual respect. 

• Terms of Use: 

Fiscal Year 2021 Privacy Impact Assessment -Page 1 
 

 

 

o ED and the REMS TA Center do not guarantee or warrant that any information 

posted by individuals on these pages is correct and disclaim any liability for any 

loss or damage resulting from reliance on any such information. ED and the 

REMS TA Center may not be able to verify, do not warrant or guarantee, and 

assume no liability for anything posted on this website by any other person. ED 

and the REMS TA Center do not endorse, support, or otherwise promote any 

private or commercial entity or the information, products, or services contained 

on those web sites that may be reached through links on our web site. Opinions 

and comments that appear in the CoP belong to the individuals who expressed 

them. They do not belong to or represent views of ED or the REMS TA Center. 

o These pages may not be used for the submission of any claim, demand, informal 

or formal complaint, or any other form of legal and/or administrative notice or 

process, or for the exhaustion of any legal and/or administrative remedy. 

o REMS TA Center COP members are solely responsible for ensuring that they do 

not act in any manner that constitutes or forms a part of a course of conduct 

amounting to a violation of any state, federal, international, or other applicable 

law. This includes, but is not limited to, posting of content in violation of the 

copyright on that content. 

o The REMS TA Center does not allow content that is abusive, vulgar, racist, 

sexist, slanderous, harassing, misleading, or otherwise objectionable. We also do 

not allow content that promotes the selling of products, goods, and services. 

Content of this nature will be screened and removed. 

• Termination: 

o The U.S. Department of Education and REMS TA Center may terminate or 

suspend your access to all or part of the REMS TA Center CoP, including but 

not limited to any discussion forums on its site, for any reason, including breach 

of the Terms of Use or Codes of Conduct. If you are unsatisfied with the 

services provided by the REMS TA Center, please 

email info@remstacenter.org to terminate your membership. 

Fiscal Year 2021 Privacy Impact Assessment -Page 1