Privacy Impact Assessment (PIA) 

for the 

Office of English Language Acquisition (OELA) Program Support 

Systems 

March 12, 2021 

For PIA Certification Updates Only: This PIA was reviewed on Enter date by Name of reviewer 

certifying the information contained here is valid and up to date. 

Contact Point 

Contact Person/Title: Andy Simpson, Director of IT 

Contact Email: asimpson@manhattanstrategy.com 

System Owner 

Name/Title: Melissa Escalante 

Principal Office: OELA 

Fiscal Year 2020 Privacy Impact Assessment -Page 1 
 

 

 

 

 

 

 

 

 

 

 

 

Please complete this Privacy Impact Assessment (PIA) on how personally identifiable 

information (PII) is collected, stored, protected, shared, and managed electronically by your 

system. You may wish to consult with your ISSO in completing this document. 

If a question does not apply to your system, please answer with N/A. 

1. Introduction 

1.1. Describe the system including the name, acronym, and a brief description of the program 

or purpose for the system. 

The U.S. Department of Education’s (Department) Office of English Language 

Acquisition (OELA) uses two information systems to fulfill its mission for our English 

learner stakeholders. The National Clearinghouse for English Language Acquisition 

(NCELA), serves and supports our external stakeholders and the Knowledge 

Management System (KMS), serves our program grantees. Since the two systems support 

OELA’s overall objectives and present similar privacy risks, both systems are assessed in 

this document. 

OELA system 1, NCELA, is a public-facing information system that includes a website 

along with software, hardware, and a database, authorized by Section 3202 of Title III of 

the Elementary and Secondary Education Act (ESEA), to support OELA. NCELA 

collects, coordinates, and disseminates a broad range of research and resources in support 

of an inclusive approach to high-quality education for English learners (ELs). NCELA 

supports the dissemination of resources for state-level administrators of Title III 

programs. In addition to State Education Agency (SEA) coordinators, NCELA serves 

other stakeholders involved in EL education, including teachers and other practitioners, 

parents, university faculty, administrators, and federal policymakers. The purpose of 

NCELA is to help increase state capacity to assist districts and schools in improving EL 

student performance, language instruction educational programs, and English language 

proficiency. 

The NCELA website includes the Department’s contact information (e.g., phone, email), 

including staff names, an interface for users to submit remote learning resources, 

questions, comments, and feedback, as well as register for newsletters, search for 

resources using resource library, access factsheets, and access artifacts from meetings and 

conferences. In addition, the system contains point of contact information for the Title III 

state coordinators. The NCELA website utilizes Constant Contact to allow users to 

register for newsletters and includes a “Contact Us” form to allow users to ask general 

questions or receive assistance from the NCELA team. Constant Contact is a third-party 

servicer that supports the Department by distributing a newsletter using an email list. 

OELA system 2, the Knowledge Management System (KMS), is an information system 

that helps OELA to further its mission to promote EL achievement along with the publicfacing NCELA system. The KMS system is a password protected system used only by 

OELA’s program officers and grant directors. The system provides a place to allocate 

Fiscal Year 2020 Privacy Impact Assessment -Page 2 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

budget, monitor performance, and generate reports. Grantees (the legal entity to which a 

grant is awarded and that is accountable to the Federal Government for the use of the 

funds provided) log in to the system to submit grant performance documentation, interact 

with peers through discussion board, and access resources. NCELA and KMS do not 

interact with each other. They are related as they support OELA objectives. 

1.2. Describe the purpose for which the personally identifiable information (PII)1 is collected, 

used, maintained, or shared. 

NCELA 

Contact Us Form 

The Department collects name and contact information from the public through a 

web form when users elect to contact OELA. An email is then generated by the 

website and sent to the NCELA project team. 

Purpose: This information is collected so that the project team can answer 

questions or provide general help about NCELA. 

Title III Office Contact Information 

The Department collects contact information for state-level administrators through the 

Consolidated State Performance Report (CSPR). CSPR data is self-reported performance 

data from each of the SEAs. 

Purpose: Title III grantee office contact’s name and contact information is collected in 

order to communicate with the grantees and the information made available to the public. 

The Title III SEA contact information is provided on each of the SEA’s public websites. 

The Department simply provide the same information in a consolidated location. 

Constant Contact – Email List Subscription Signup Form 

Visitors may provide contact information to Constant Contact, an email marketing 

service used to send mass communications to lists of subscribers. 

Purpose: Visitors’ contact information is collected on the NCELA website 

through an embedded form provided by Constant Contact to sign up to receive the 

Nexus Newsletter via email. 

1 The term “personally identifiable information” refers to information which can be used to distinguish or trace an 

individual's identity, such as their name, social security number, biometric records, etc. alone, or when combined 

with other personal or identifying information which is linked or linkable to a specific individual, such as date and 

place of birth, mother's maiden name, etc. OMB Circular A-130, page 33 

Fiscal Year 2020 Privacy Impact Assessment -Page 3 
 

 

 

 

 

 

 

 

 

Grant Application 

The grant application provides information about the entity and a point of contact for the 

application. The information shown in the Grant Application documents, is collected 

through the grant application process. The Department collects the data through the 

application process through the G5 system @ www.G5.ed.gov 

Purpose: The grantee office project director’s name and contact information is collected 

in order to communicate with grantees. NCELA links to the OELA.ed.gov grants 

webpage that provides the information approved for public dissemination. 

KMS 

The system collects name and contact information from grantee points of contact. 

Purpose: Grantees provide this information so they can log in to the system with email 

address and password to submit quarterly grant performance documentation, interact with 

peers through discussion board, and access resources that are specific to each program. 

1.3. Is this a new system, or one that is currently in operation? 

Currently Operating System 

1.4. Is this PIA new, or is it updating a previous version? 

New PIA 

NCELA did not require a PIA during the FY19 and FY20 assessment. This is the first 

time that KMS has undergone an ATO review. A new PIA is created to include NCELA 

and KMS. 

1.5. Is the system operated by the agency or by a contractor? 

Contractor 

1.5.1. If the system is operated by a contractor, does the contract or other acquisitionrelated documents include privacy requirements? 

N/A 

Yes 

Fiscal Year 2020 Privacy Impact Assessment -Page 4 
 

 

 

2. Legal Authorities and Other Requirements 

If you are unsure of your legal authority, please contact your program attorney. 

2.1. What specific legal authorities and/or agreements permit and regulate the collection and 

use of data by the system? Please include name and citation of the authority. 

NCELA and KMS are authorized by 20 U.S.C. 6301 section 3131(c)(1)(C) of the 

Elementary and Secondary Education Act of 1965 as amended by the Every Student 

Succeeds Act, and in accordance with the Government Performance Results Act of 1993, 

Section 4 (1115). ESEA law authorizes the systems and allows for EL information 

dissemination. 

The Education Department General Administrative Regulations (EDGAR), 34 CFR 

75.253 and 34 CFR 75.104, requires those applying for grants to comply with the 

Department’s procedural requirements on the submission of applications. 34 CFR 75.253 

and 75.104 authorizes the collection of grant point of contact information. 

SORN 

2.2. Is the information in this system retrieved by an individual’s name or personal identifier 

such as a Social Security Number or other identification? 

No 

2.2.1. If the above answer is YES, this system will need to be covered by Privacy Act 

System of Records Notice(s) (SORN(s)).2 Please provide the SORN name, number, 

Federal Register citation and link, or indicate that a SORN is in progress. 

N/A 

The information is not retrieved by an identifier. 

2.2.2. If the above answer is NO, explain why a SORN was not necessary. For 

example, the information is not retrieved by an identifier, the information is not 

maintained in a system of records, or the information is not maintained by the 

Department, etc. 

N/A 

. 

2 A System of Records Notice (SORN) is a formal notice to the public that identifies the purpose for which PII is 

collected, from whom and what type of PII is collected, how the PII is shared externally (routine uses), and how to 

access and correct any PII maintained by ED. https://connected.ed.gov/om/Documents/SORN-Process.pdf 

Fiscal Year 2020 Privacy Impact Assessment -Page 5 
 

 

 

 

Records Management 

If you do not know your records schedule, please consult with your records liaison or send 

an email to RMHelp@ed.gov 

2.3. What is the records retention schedule approved by National Archives and Records 

Administration (NARA) for the records contained in this system? Please provide all 

relevant NARA schedule numbers and disposition instructions. 

NCELA and KMS 

Database backups and log files are stored on Box.com for Government, a secure cloud 

storage solution that is compliant to standards like Box FedRAMP, ITAR, EAR, DoD 

SRG L4, ISO 27018, HIPAA, and IRS-1075 with a 3-year retention policy as per General 

Records Schedule (GRS) 3.1, item 020. Code versions are stored in Git, source control 

tool Electronic documents or other records are stored on the Department’s internal 

SharePoint system with a 5-year retention policy as per the Department’s Records 

Schedule 66. Grant-related records are retained 10 years after related grant is closed as 

per GRS 1.2, item 020. 

2.4. Is the PII contained in this system disposed of appropriately, and in accordance with the 

timelines in the records disposition schedule? 

Yes 

3. Characterization and Use of Information 

Collection 

3.1. List the specific PII elements (e.g., name, email, address, phone number, date of birth, 

Social Security, etc.) that the system collects, uses, disseminates, or maintains. 

NCELA 

Contact Us Form 

https://ncela.ed.gov/contact 

Full name and email address of the general public submitting a form. 

Title III Office Contact Information 

Grantees’ point of contact information: first name, last name, grantee 

organizations’ name, organization address, organization phone, and email address. 

Constant Contact – Email List Subscription Signup Form 

Fiscal Year 2020 Privacy Impact Assessment -Page 6 
 

https://ncela.ed.gov/ncela-nexus 

Email address of individuals who wish to receive a newsletter. 

Grant Application 

https://ncela.ed.gov/files/uploads/47/T365Z120011.pdf 

Grantee project director’s contact information: first name, last name, 

organization, organization address, organization phone, email address. 

KMS 

Grantees’ point of contact’s first name, last name, and email address. 

The KMS system utilizes ASP.NET Identity for User Management, including 

Authentication and Authorization. ASP.NET Identity is a proven software library 

provided by Microsoft. This framework manages user credentials. No passwords 

are stored in the system. 

Password hashes are stored and encrypted with a Salt as per OWASP specifications. 

Password hashes are a one-way encryption scheme and cannot be reversed. 

3.2. Does the system collect only the minimum amount required to achieve the purpose 

stated in Question 1.2? 

Yes 

NCELA 

Contact Us Form 

The current contact form requires the submitter to provide first name, last name, and 

email address. This is the minimum contact information needed to respond to respond to 

the contact request. 

Title III Office Contact Information 

The information is publicly available on each of the states’ State Education Agency 

website. State’s provide this information; it is posted on the NCELA website for easy 

access should the user want to reach out to the SEA’s. 

Constant Contact – Email List Subscription Signup Form 

Only an email address is required to subscribe to the email-based newsletter system. 

First, last name, are optional/voluntary. 

Grant Application 

Fiscal Year 2020 Privacy Impact Assessment -Page 7 
 

 

 

 

 

 

 

 

Yes, the information is collected through the grantee applications submitted during each 

grant competition as required by EDGAR 34 CFR 75.253 and34 CFR 75.104. All of the 

information is vetted and approved for public consumption and posted on the 

OELA.ed.gov website. https://www2.ed.gov/about/offices/list/oela/programs.html 

KMS 

A grantee’s first name, last name, and email address are the minimum information 

required to submit grant performance documentation, interact with peers through 

discussion board, and access resources. 

3.3. What are the sources of PII collected (e.g., individual, school, another agency, 

commercial sources, etc.)? 

NCELA 

Contact Us Form 

https://ncela.ed.gov/contact 

Source: Individual who wishes to contact OELA. 

Title III Office Contact Information 

The information is publicly available on each of the states’ State Education Agency 

website. 

https://ncela.ed.gov/t3sis/Alabama.php 

Source: Each of the states’ State Education Agency website provides basic 

contact information for user to submit inquiries. . 

Constant Contact – Email List Subscription Signup Form 

https://ncela.ed.gov/ncela-nexus 

Source: Individual who wishes to be sent a newsletter. 

Grant Application – 

The information is collected per 34 CFR 75.253 and34 CFR 75.104 in the Grant 

Application documents. 

https://ncela.ed.gov/files/uploads/47/T365Z120011.pdf 

Source: Publicly available Grant Application documents. 

KMS 

https://kms.manhattanstrategy.com/grantadmin 

Source: Grantee point of contact. 

Fiscal Year 2020 Privacy Impact Assessment -Page 8 
 

 

 

 

3.4. How is the PII collected from the stated sources listed in Question 3.3 (e.g., paper form, 

web page, database, etc.)? 

NCELA 

Contact Us Form 

https://ncela.ed.gov/contact 

Collection Method: This information is collected via an online form on a 

webpage. 

Title III Office Contact Information 

https://ncela.ed.gov/t3sis/Alabama.php 

Collection Method: The Department collects the state data through the CSPR). 

CSPR data is self-reported performance data from each of the SEAs. The SEA 

contact information is provided on the SEA’s public-facing website. 

Constant Contact – Email List Subscription Signup Form 

https://ncela.ed.gov/ncela-nexus 

Collection Method: Embedded form provided by Constant Contact and visible on 

the NCELA website. 

Grant Application 

https://ncela.ed.gov/files/uploads/47/T365Z120011.pdf 

Collection Method: The Department collects the data through the CSPR). CSPR data is 

self-reported performance data from each of the SEAs. 

KMS 

https://kms.manhattanstrategy.com/grantadmin 

Collection Method: This information is collected from an online form on a webpage. 

The information is collected through the grantee applications submitted during each grant 

competition. All of the information is vetted and approved for public consumption and 

posted on the OELA.ed.gov website: 

https://www2.ed.gov/about/offices/list/oela/programs.html 

3.5. How is the PII validated or confirmed to ensure the integrity of the information 

collected?3 Is there a frequency at which there are continuous checks to ensure the PII 

remains valid and accurate? 

3 Examples include restricted form filling, account verification, editing and validating information as it’s collected, 

and communication with the individual whose information it is. 

Fiscal Year 2020 Privacy Impact Assessment -Page 9 
NCELA 

Contact Us Form 

No validation is necessary for this information, as it is only an email contact form. The 

individual provides the information themselves. If a person requests help and does not 

get it because they provided incorrect information, they can resubmit a form. 

Title III Office Contact Information 

This information is publicly available, the SEA’s are responsible for updating their 

information. We do not provide notice because we do not collect the information. The 

information is approved for public consumption and posted on the OESE.ed.gov 

website: https://oese.ed.gov/offices/office-of-formula-grants/school-support-andaccountability/english-language-acquisition-state-grants/ 

Constant Contact – Email List Subscription Signup Form 

Users are able to enter any first name, last name, and email address when signing up for 

the email subscriber list. The individual provides the information themselves. If a person 

requests a newsletter and does not get it because they provided incorrect information, 

they can resubmit request it again with the correct information. 

Grant Application 

The information is collected through the grantee applications submitted during each 

grant competition. Grantees are responsible for updating any contact information 

through G5 on annual basis. The information is vetted and approved for public 

consumption and posted on the OELA.ed.gov website: 

https://www2.ed.gov/about/offices/list/oela/programs.html 

KMS 

The information is collected through the grantee applications submitted during each 

grant competition. All the information is vetted and approved for public consumption 

and posted on the OELA.ed.gov website: 

https://www2.ed.gov/about/offices/list/oela/programs.html 

Use 

3.6. Describe how the PII is used to achieve the purpose stated in Question 1.2 above. 

NCELA 

Contact Us Form 

This form allows OELA to provide assistance to website users via email. 

Title III Office Contact Information 

Fiscal Year 2020 Privacy Impact Assessment -Page 10 
 

 

 

 

 

Contact information is provided to the user for ease of access should they need to contact 

a state’s Title III Office. 

Constant Contact – Email List Subscription Signup Form 

This form allows OELA to disseminate information via email newsletter to keep the 

field informed of NCELA information, news, and announcements. 

Grant Applications 

A project director’s organization contact information is collected and displayed, per 

EDGAR 34 CFR 75.253 and34 CFR 75.104. The information is used to communicate 

with the grantees. 

KMS 

A grantee’s first name, last name, and email address are required to create accounts and 

log in to submit grant quarterly performance documentation, interact with peers through 

discussion board, and access resources specific to each program. 

3.7. Is the system using PII for testing/researching new applications or information systems 

prior to deployment or for training employees? 

No 

3.7.1. If the above answer is YES, what controls are in place to minimize the risk and 

protect the data? 

N/A 

Click here to enter text. 

Social Security Numbers 

It is the Department’s Policy that, in order to collect Social Security Numbers, the System Owner 

must state the collection is: 1) authorized by law, 2) necessary for an agency purpose, and 3) 

there is no reasonable alternative. 

3.8. Does the system collect Social Security Numbers? Note that if the system maintains 

Social Security Numbers but does not explicitly collect them, answer 3.8.1 to address the 

purpose for maintaining them. 

No 

3.8.1. If the above answer is YES, explain the purpose for its collection, and how the 

SSN will be used. 

Fiscal Year 2020 Privacy Impact Assessment -Page 11 
 

 

 

 

 

 

 

 

N/A 

Click here to enter text. 

3.8.2. Specify any alternatives considered in the collection of SSNs and why the 

alternatives were not selected. 

N/A 

Click here to enter text. 

4. Notice 

4.1. How does the system provide individuals with notice about the collection of PII prior to 

its collection (e.g., direct notice, such as a Privacy Act Statement (if applicable) or 

public notice, such as a SORN, PIA,)? If notice is not provided, explain why not. 

NCELA 

Contact Us Form 

The website has a Privacy Policy available from any page on the website. 

https://ncela.ed.gov/ncela-privacy-policy 

Related section of privacy policy: 

Information Collected from Interactive Forms 

On some of our web pages we offer interactive forms that let you voluntarily submit personal 

information (such as your e-mail address, name, or organization). We will use all submitted 

information only for the purpose stated on the form (e.g. to collect your information in order to 

send publications you request). The information is only made available to NCELA staff or as 

required by law. 

Title III Office Contact Information 

This information is publicly available, the SEAs are responsible for updating their 

information. We do not provide notice because we do not collect the information. 

Constant Contact – Email List Subscription Signup Form 

The embedded sign-up form contains a notice of collection, shown below: 

By submitting this form, you are consenting to receive NCELA announcements, news, 

and resources from: National Clearinghouse for English Language Acquisition (NCELA), 

4340 East-West Highway, Suite 1100, Bethesda, MD, 20814, US, http://ncela.ed.gov. 

You can revoke your consent to receive emails at any time by using the 

SafeUnsubscribe® link, found at the bottom of every email. Emails are serviced by 

Constant Contact. Our Privacy Policy. 

Fiscal Year 2020 Privacy Impact Assessment -Page 12 
 

 

 

 

 

 

 

Grant Application 

Grantees are responsible for updating any contact information through G5 on annual 

basis. Notice is provided to grantees in G5 @ www.G5.ed.gov. 

KMS 

4.2. Provide the text of the notice or the link to the webpage where the notice is posted if 

notice is provided other than by SORN or PIA. 

N/A 

NCELA Website: https://ncela.ed.gov/ncela-privacy-policy 

Constant Contact: https://www.constantcontact.com/legal/privacy-notice 

KMS: https://ncela.ed.gov/ncela-privacy-policy 

4.3. What opportunities are available for individuals to consent to uses (including new uses 

of previously collected PII), decline to provide PII, or opt out of the project? 

NCELA 

Contact Us Form 

Users use the contact form to contact project staff with questions. The users enter their 

name and email address if they need an answer to their question. Users fill this 

information on their own. 

Title III Office Contact Information 

We do not have any control over consent, that under the domain of the SEA’s. 

Constant Contact – Email List Subscription Signup Form 

Users may use the “unsubscribe” feature within Constant Contact or email the NCELA 

help desk to be removed from the email subscribers list. 

Grant Application 

Grantees provide consent at the point of grant application submission in the G5 system. 

This information is authorized per EDGAR 34 CFR 75.253 and34 CFR 75.104. 

KMS 

Grantees are required by EDGAR 34 CFR 75.253 and34 CFR 75.104, to submit 

information as part of the grant monitoring process. Grantees can update their contact 

information from the KMS website. 

Fiscal Year 2020 Privacy Impact Assessment -Page 13 
 

 

 

 

 

 

 

 

 

4.4. Is the notice referenced in Question 4.1 reviewed and revised when there are changes in 

the practice, policy, or activities that affect the PII and privacy to ensure that individuals 

are aware of and can consent to, where feasible, these changes? 

Yes 

5. Information Sharing and Disclosures 

Internal 

5.1. Will PII be shared internally with other ED principal offices? If the answer is NO, please 

skip to Question 5.4. 

No 

5.2. What PII will be shared and with whom? 

N/A 

Click here to enter text. 

5.3. What is the purpose for sharing the specified PII with the specified internal 

organizations? 

N/A 

Click here to enter text. 

External 

5.4. Will the PII contained in the system be shared with external entities (e.g. another agency, 

school district, the public, etc.)? If the answer is NO, please skip to Question 6.1. 

No 

5.5. What PII will be shared and with whom? List programmatic disclosures only.4 

Note: If you are sharing Social Security Numbers externally, please specify to 

whom and for what purpose. 

N/A 

Click here to enter text. 

4 If this information is covered by Privacy Act System of Records Notice (SORN) please list only relevant 

programmatic disclosures listed under the Routine Uses section. 

Fiscal Year 2020 Privacy Impact Assessment -Page 14 
 

 

 

 

 

 

 

 

 

5.6. What is the purpose for sharing the PII with the specified external entities? 

N/A 

Click here to enter text. 

5.7. Is the sharing with the external entities authorized? 

N/A 

Click here to select. 

5.8. Is the system able to provide and retain an account of any disclosures made and make it 

available upon request? 

N/A 

Click here to select. 

5.9. How is the PII shared with the external entity (e.g. email, computer match, encrypted 

line, etc.)? 

N/A 

Click here to enter text. 

5.10. Is the sharing pursuant to a Computer Matching Agreement (CMA), 

Memorandum of Understanding (MOU), or other type of approved sharing agreement 

with another agency? 

N/A 

Click here to select. 

5.11. Does the project place limitation on re-disclosure? 

N/A 

Click here to select. 

6. Redress 

6.1. What are the procedures that allow individuals to access their own information? 

NCELA 

Contact Us Form 

Users will not have access to their own information. This information is not required to 

be updated. It’s a one-time submission of a form that sends an email to project staff. 

Title III Office Contact Information 

Fiscal Year 2020 Privacy Impact Assessment -Page 15 
 

 

 

 

 

 

 

This information is publicly available and can be accessed on the SEA’s public-facing 

website. 

Constant Contact – Email List Subscription Signup Form 

Email list subscribers can access and update their profile information by clicking the 

“update profile” link in the emails received through their subscription. 

Grant Application 

Grant application information is available to the grantees through the G5 system and it is 

also publicly available. 

KMS 

Grantees can view and update their contact information from within the profile page of 

the KMS. 

6.2. What procedures are in place to allow the subject individual to correct inaccurate or 

erroneous information? 

NCELA 

Contact Us Form 

This information is not required to be updated. It’s a one-time submission of a form that 

sends an email to project staff. 

Title III Office Contact Information 

This information is publicly available; however SEA’s are responsible for updating their 

own contact information. 

Constant Contact – Email List Subscription Signup Form 

Email list subscribers can update their profile information by clicking the “Update 

profile” link in the emails received through their subscription. 

Grant Application 

The application is static, however if point of contact updates were required, a grantee 

would need to update the contact information via G5 and then contact their OELA 

program officer to notify them of the update. 

KMS 

Fiscal Year 2020 Privacy Impact Assessment -Page 16 
 

 

 

 

 

 

Grantees can update their profile information from with the KMS website at any time, 

after logging in with their email address and password. 

6.3. How does the project notify individuals about the procedures for correcting their 

information? 

NCELA 

Contact Us Form 

This information is not required to be updated. It’s a one-time submission of a form that 

sends an email to project staff and is not stored. 

Title III Office Contact Information 

The SEA’s are responsible for updating their contact information. We do not notify an 

SEA. 

Constant Contact – Email List Subscription Signup Form 

All emails sent via Constant Contact have a footer that includes an unsubscribe and 

update profile link. 

Grant Application 

Grantees are responsible for updating the contact information via G5 on an annual basis. 

KMS 

Authenticated grantees have access to their profile page from within the KMS website 

and can update the information on a quarterly basis when submitting their quarterly 

progress reports. 

7. Safeguards 

If you are unsure which safeguards will apply, please consult with your ISSO. 

7.1. Does the principal office work with their CSO/ISSO to build privacy & security into the 

system and build privacy extensions to the extent feasible? 

Yes 

7.2. Is an Authority to Operate (ATO) required? 

Yes 

Fiscal Year 2020 Privacy Impact Assessment -Page 17 
 

 

 

 

 

 

 

7.3. Under NIST FIPS Pub. 199, what is the security categorization of the system: Low, 

Moderate, or High? 

N/A 

Low 

7.4. What administrative, technical, and physical safeguards are in place to protect the 

information? 

NCELA 

Information collected on the NCELA website is accessible only to authorized users. 

Physical security of electronic data will be maintained in a secured data center, access to 

which is controlled by multiple access controls. NCELA has technical and 

administrative controls in place that are compliant with the Federal Information Security 

Modernization Act (FISMA) and with National Institute of Standards and Technology 

(NIST) standards. NCELA also operates under an approved Authorization to Operate. 

When users select a link to go to Constant Contact, the Department provides them with 

notice that they are leaving the ED environment and are going to the Constant Contact 

environment. That environment has strong security, a description of which can be found 

at the Constant Contact webpage. 

As the system is housed on a virtual server and is a public-facing website, all usage and 

user access are based on the least privilege concept and practices. Login access to 

system servers can only be performed from the NCELA internal network. Permitted 

remote access to the NCELA server is regulated by Amazon Web Services Security 

Groups based on specific IP Addresses. 

For the Contact Us form, Emails are sent to a shared mailbox controlled the System 

Administrator. The staff is responsible for responding to the emails to provide 

assistance and have access to the information for that purpose. PII is only accessible by 

select staff who have been granted access to the Constant Contact account and contact 

us, and only staff who require access to the information are granted access. 

KMS 

Information collected on the KMS website is accessible only to authorized users. 

Physical security of electronic data will be maintained in a secured data center, access to 

which is controlled by multiple access controls. NCELA has technical and 

administrative controls in place that are compliant with the Federal Information Security 

Modernization Act (FISMA) and with National Institute of Standards and Technology 

(NIST) standards. NCELA also operates under an approved Authorization to Operate. 

Fiscal Year 2020 Privacy Impact Assessment -Page 18 
 

 

 

 

 

 

 

 

 

Access to the KMS website requires authentication (username and password). 

Information is transmitted using TLS 1.2. 

The KMS system utilizes ASP.NET Identity for User Management, including 

Authentication and Authorization. ASP.NET Identity is a proven software library 

provided by Microsoft. This framework manages user credentials. No passwords are 

stored in the system." 

"Password hashes are stored and encrypted with a Salt as per OWASP specifications. 

Password hashes are a one-way encryption scheme and cannot be reversed. 

7.5. Is the information in the system appropriately secured in accordance with the IT 

security requirements and procedures as required by Federal law and policy? 

Yes 

7.6. Has a risk assessment been conducted where appropriate security controls to protect 

against that risk have been identified and implemented? 

Yes 

7.7. Please describe any monitoring, testing or evaluation conducted on a regular basis to 

ensure the security controls continue to work properly at safeguarding the PII. 

The following is applicable to all collections under NCELA and KMS: 

PII is regularly reviewed to determine whether the PII is still relevant. If PII is no longer 

relevant and necessary, then PII will be properly destroyed. The destruction or disposal 

of PII will be conducted in accordance with any litigation holds and the Federal Records 

Act and records control schedules approved by the National Archives and Records 

Administration (NARA). 

8. Auditing and Accountability 

8.1. How does the system owner assess and ensure that the PII is used in accordance with 

stated practices in this PIA? 

The following is applicable to all collections under NCELA and KMS: 

Fiscal Year 2020 Privacy Impact Assessment -Page 19 
 

OELA has standard operating procedures and protocols in place to safeguard grantee 

information. In addition, for grantee monitoring processes, OELA follows the guidelines 

provided in the Discretionary Handbook. 

All staff that have access to PII are required to complete the “User Agreement for 

System Access” form that requires users to access and use the NCELA system using 

good security and privacy practices. 

8.2. Does the system owner continuously monitor and audit the privacy controls to ensure 

effective implementation? 

Yes 

8.3. What are the privacy risks associated with this system and how are those risks 

mitigated? 

This PIA details the privacy controls and safeguards implemented for this system in 

order to mitigate privacy risk. These controls and safeguards work to protect the data 

from privacy threats and mitigate the risks to the data. 

One privacy risk associated with this system is unauthorized access, use, or disclosure of 

PII pertaining to the users. These data breaches involving PII can be hazardous to 

individuals because they can result in identity theft or financial fraud. 

The risks are mitigated by the above-mentioned controls and safeguards, limiting access 

to only those with a legitimate need to know, and working closely with the security and 

privacy staff at the Department. The system also collects only the minimum information 

necessary to achieve the purpose of the system, and the information is collected, 

processed, or stored by the system is either voluntarily supplied by the user and is low 

risk information, or already publicly available information. 

Additionally, OELA has developed and abide by a set of policies and control 

implementations, pursuant to NIST 800-53 Rev 4, to protect the information system and 

the data collected, stored, and processed in the system. 

Fiscal Year 2020 Privacy Impact Assessment -Page 20