1 

AmeriCorps 

Privacy Impact Assessment (PIA) 

1- GENERAL SYSTEM INFORMATION 

1-1 Name of the information system: AmeriCorps Online Ordering System

1-2 System Identifier (3 letter identifier): OOS

1-3 Unique Investment Identifier (Exhibit 53): 485-000000017

1-4 Office or entity that owns the system: AmeriCorps Office of Communications 

and Marketing (OCM)

1-5 Office or entity that operates the system: ITCON Services

1-6 State if the system is operational or 

provide the expected launch date: Operational 

1-7 System’s security categorization: Low

1-8 

Date of most recent Security Assessment 

and Authorization (SA&A) or why one is 

not required: 

06/06/2023 

1-9 Approximate number of individuals with 

PII in the system: 

OOS currently contains PII of 

approximately 9,000 individuals. 

250 E Street SW

Washington, D.C. 20525 

202-606-5000/ 800-942-2677 
 

2 

4- PIA HISTORY 

4-1 State whether this is the first PIA for the system or an update to a signed PIA. 

This is an update to an existing system with a prior signed PIA. 

4-2 If this is an update, describe any major system changes since the last PIA. 

If this is the first time a PIA is being completed, write Not Applicable.

New SA&A is conducted.

4-3 

A 

State whether this is the annual review of PIA. 

It is an annual review. 

4-3 

B 

Describe any changes to the system, data activity, policies, procedures, any 

interrelating component and process, vendor, 3rd parties, contracts and any 

required controls since last PIA. 

None 

4-3 

C Describe objects and results of audit or tests (continuous monitoring). 

Not Applicable 

4-3 

D Certify and state “Completion of Review” if no change occurs. 

 New SA&A is conducted. 

4-4 If the system is being retired, state whether a decommission plan is completed and 

attach a copy. 

Not Applicable 

5- SYSTEM PURPOSE 

5-1 Describe Purpose of the System (or program, product, service) 

The AmeriCorps Online Ordering System (OOS) is a self-contained web 

application of high availability, hosted in FedRAMP approved Microsoft Azure 

3- SIGNATURES (ORIGINAL MAINTAINED BY CHIEF PRIVACY OFFICER) 

 Role *Signature* *Date* 

3-1 Information System Owner: 

3-2 Office of General Counsel: 

3-3 Chief Privacy Officer: 

3-4 Chief Information Security 

Officer: 

3-5 Senior Agency Official for 

Privacy: 
 

3 

Cloud environment. AmeriCorps uses OOS (promote.americorps.gov/) to distribute 

free-of-charge promotional products within AmeriCorps branding such as shirts, 

envelopes, bookmarks, and stationary. Anyone can access the publicly available 

webpages of OOS to view and order products from AmeriCorps, and the members 

of AmeriCorps’ VISTA service program can access OOS’s restricted webpages to 

order VISTA exclusive products. 

OOS runs on Drupal content management system within Microsoft Azure 

Government Cloud and is managed by ITCON Services. AmeriCorps procures the 

service from ITCON Services to provide system and database administration to 

OOS. AmeriCorps is responsible for web content management and product 

shipment. The staff members of AmeriCorps can access restricted webpages to 

review, approve, and manage orders. The staff of OOS service providers can access 

restricted webpages to maintain the system or fulfill the orders. 

6- INVENTORY OF PII 

6-1 Provide a list of all the PII included in the system. 

OOS collects names, shipping addresses, emails, phone numbers, United Parcel 

Service (UPS) shipping accounts and OOS user account credential information. 

7- CATEGORIES OF INDIVIDUALS IN THE SYSTEM 

7-1 Describe the categories of individuals whose PII is in the system and state 

approximately how many individuals are in each category. 

OOS maintains PII of individuals who ordered a product or had a product shipped to 

them. They may be AmeriCorps staff, service members, alumni, grantees, other 

individuals connected to AmeriCorps, and members of the public. For example, 

VISTA Members may use the system to order VISTA-branded clothing, teachers 

may use the system to order stickers for their students, and alumni may use the 

system to request brochures to recruit new Service Members. 

Currently, the system maintains the PII of approximately 165 current AmeriCorps 

staff members, 951 current and recent VISTA Service Members (VISTA Members), 

and 7,909 additional individuals who ordered a product using the system or had a 

product shipped to them. It also stores privileged system user information of five 

vendor staff who maintain the system or fulfill the orders. 

The data collection is minimized and necessary to meet the needs of the organization 

and the customers. OOS maintains a list of carefully identified PII about all current 

VISTA Members in order to determine who should access the VISTA Members Only

webpages. The majority of these individuals place at least one order during their 

service and are therefore counted in the 9,000 individuals above.
 

4 

8- INFORMATION IN THE SYSTEM 

8-1 

A 

For each category of individuals discussed above: 

Describe the information (not just PII) collected about that category and how the 

information is used. 

Any individual who wants to place an order yet does not have an account must first 

select the products they want to order, then create a username and password to set 

up an account, provide the address where the products should be shipped to, and 

provide their name, email address, and phone number to complete the purchase 

order. If they want the order to be shipped to a business address, they may provide 

the name of that business. If they request expediting shipment, they must provide 

their UPS shipping account and required date. If they order certain products of a 

certain quantity, they are asked to justify why they need those products. If they 

already had an account, the process is the same except they would login using their 

username and password, their previously used name and contact information would 

automatically populate, and they would adjust that as needed. 

AmeriCorps staff can order products on behalf of others. In that situation, they may 

provide their information, plus the recipient’s email, shipping address, and business 

name. 

If the requested products are in stock and AmeriCorps approves the order, the 

individual receives an email confirmation, and the products are shipped. If there are 

fulfillment limits, shipping challenges, or insufficient justification, AmeriCorps 

staff can use the system to reduce or cancel the order and inform the individual why 

that occurred. Any response from the individual would be provided outside the 

system. 

AmeriCorps regularly updates the file in the system which contains the first name, 

last name, and email address of all current VISTA Members. If a VISTA Member 

creates an account with the same information as in the file, the system will grant 

them access to the VISTA Members Only webpages where they can order their 

VISTA uniform and other products. Soon after individuals leave their VISTA 

service, their PII is deleted from the file, and they lose their access to the restricted 

webpages. 

An audit log captures when individuals access the system and any changes to their 

information, which includes a copy of all new and old shipping addresses and 

contact information. 

8-1 

B 

State whether the system derives new data, or creates previously unavailable data, 

about an individual via aggregation of information or other means. Explain why, 

how it is related to the purpose of the system, how it is used and with whom it is 

shared. 
 

5 

Not Applicable

8-1 

C 

If the system uses commercial or publicly available data, explain why, how it is 

related to the purpose of the system, and how it is used. 

Not Applicable

8-1 

D 

Describe any application of PII redaction, mask, anonymization or elimination. 

The system only collects and processes PII that is necessary to meet the needs of the 

organization and the customers that this system provides service to.

8-1 

E 

Describe any design that is used to enhance privacy protection. 

Not Applicable

9- COLLECTIONS OF PII INTO THE SYSTEM 

9-1 Describe for each source of PII in the system: 

a. The source. 

b. What comes from that source. 

c. How the PII enters the system. 

OOS is designed to allow individuals to place their own order and enter their own 

PII. However, there are two situations where some of the PII is not directly entered 

by the individuals: 

1) AmeriCorps staff may place an order for the individuals upon their request. 

In that situation, the individual may provide AmeriCorps staff members 

with their information, plus the recipient’s email, shipping address, and 

business name. The information is then entered into the system by 

AmeriCorps staff members. 

2) AmeriCorps regularly updates the file in the system which contains the first 

name, last name, and email address of all current VISTA Members. The file 

is uploaded into the system for the current VISTA Members to access 

VISTA Member Only website. 

9-2 If any PII comes directly from the individual, describe the privacy controls in 

place. If all PII comes from a secondary source, write Not Applicable. 

The webforms on OOS website clearly identify each element of PII with separate 

boxes. The PII is limited to information needed to ship an order to an individual or 

contact the individual if there are any limits or challenges. The information is 

collected through a secure connection that encrypts the PII in transit. In addition, 

the footer of every OOS webpage available to the public includes a link to 

AmeriCorps’ privacy program webpage that informs the individual of the privacy 
 

6 

practice of AmeriCorps. A Privacy Act Statement, developed from a draft 

AmeriCorps system of record notice (SORN), is also provided to notify the users of 

the PII collection activities of OOS so that the users can choose to either consent to 

the PII collection or not to proceed further with the order. 

9-3 If PII about an individual comes from a source other than the individual, 

describe: 

a. Why the PII is collected from the secondary source. 

b. Why the PII from the secondary source is sufficiently accurate. 

c. If/how the individual is aware that the secondary source will provide their 

PII. 

If all PII about an individual comes directly from the individual, write Not 

Applicable. 

Individuals have the option to entrust and authorize AmeriCorps staff members to 

order products on their behalf. To do so, a current email address and shipping 

address of the individual is provided to the AmeriCorps staff member. This 

information must be current, complete and accurate so that the order can be 

successfully delivered to the individual as the direct recipient. The AmeriCorps 

staff member will then enter this information into the system and place the order. 

9-4 If any collections into the system are subject to the Paperwork Reduction Act 

(PRA), identify the Office of Management and Budget (OMB) Control Number 

for the collection and effective date. If the system does not implicate the PRA, 

write Not Applicable. 

Not applicable; an OMB Control Number is not required for this system. 

9-5 If any collections into the system are subject to an agreement, describe those 

agreements. If no agreements are relevant, write Not Applicable. 

Not Applicable 

10- SYSTEM ACCESS 

10-1 Separately describe each category of individuals who can access the system along 

with: 

a. What PII they can access (all or what subset). 

b. Why they need that level of access. 

c. How they would request and receive that access. 

d. How their access is reduced or eliminated when no longer necessary. 

e. Identify policies and procedures outlining roles and responsibilities and 

auditing processes. 

Individuals who have accounts with OOS can access their own PII in their 

accounts. If an individual accesses OOS and orders a product, the PII except for the 
 

7 

username and password of the individual can be viewed by a limited number of (1) 

AmeriCorps staff who review orders and help manage the inventory and (2) vendor 

staff who manage the system or fulfill the orders. AmeriCorps can disable the 

account of any AmeriCorps employee who no longer requires access to OOS and 

the vendor can disable the OOS account of any vendor employee who no longer 

requires access. 

11- PII SHARING 

11-1 Separately describe each entity that receives PII from the system and: 

a. What PII is shared. 

b. Why PII is shared (specify the purpose)

c. How the PII is shared (what means/medium). 

d. The privacy controls to protect the PII while in transit. 

e. The privacy controls to protect the PII once received. 

f. PII sharing agreements (describe if the agreement specifies the scope of the 

information sharing, parties of agreement and the duration of the agreement) 

g. Describe security and privacy clauses and audit clauses in the agreement 

or vendor (including third party vendors) contract. 

If PII is not shared outside the system, write Not Applicable. 

The PII collected through OOS is not shared with, or exported to, another system. 

Shipment labels are attached to the mail package for the delivery service provider 

to use. 

12- PRIVACY ACT REQUIREMENTS 

12-1 If the system creates one or more systems of records under the Privacy Act of 

1974: 

a. Describe the retrieval that creates each system of records. 

b. State which authorities authorize each system of records. 

c. State which SORNs apply to each system of records. 

If the system does not create a system of records, write Not Applicable. 

OOS gives AmeriCorps and vendor staff the ability to search for orders by the 

email address of the individual who placed the order. AmeriCorps uses this feature 

to compare an individual’s orders over time and determine if they are requesting an 

unreasonable number of products. 

Authorities authorizing this system of records include the National and Community 

Service Act of 1990 as amended (42 USC 12501 et seq.) and the Domestic 

Volunteer Service Act of 1973 as amended (42 USC 4950 et seq.). 
 

8 

The SORN that will apply to the records in this system is currently being drafted. 

A Privacy Act Statement, developed from the draft SORN, is provided to 

individuals before their personal information is collected into this system: 

We are required by the Privacy Act of 1974 (5 U.S.C. § 552a) to tell you 

what personal information we collect and how it will be used: 

Authorities – This information is requested pursuant to the National and 

Community Service Act of 1990 as amended (42 USC 12501 et seq.) and the 

Domestic Volunteer Service Act of 1973 as amended (42 USC 4950 et seq.). 

Purposes – AmeriCorps requests your user name, email address, phone 

number and address to manage and fulfill your order in the AmeriCorps 

Online Ordering System. 

Routine Uses – Routine uses of this information may include disclosure to 

the contractors who support the AmeriCorps Online Ordering System. 

Effects of Nondisclosure – This request for information is voluntary, but 

necessary to fulfill your order. 

Additional Information – The applicable system of records notice is 

[Social Network and Public Engagement –pending publication)]. 

13- SAFEGUARDS 

13-1 Describe the data processing environments and the technical, physical, and 

administrative safeguards (including vendors’) that protect the PII in the system. 

OOS is hosted in the Microsoft Azure Government cloud which currently maintains 

a FedRAMP Provisional Authority to Operate at the Moderate Impact Level. 

OOS’s overall system security at the cloud level is provided by the Azure cloud. 

Via the continuous monitoring mechanism, AmeriCorps ensures all the system 

specific controls are properly implemented and the vendors are in compliance with 

the contractual requirements. The safeguards which have been implemented and are 

specific to this system include but are not limited to: 

 Not storing PII on any removable media 

 Encrypting all PII in transit and at rest 

 Controlling all user access via a username and password 

 Only individuals with administrator access can modify other user accounts 

 Regular system backups and 

 The automatic creation of audit logs. 

OOS has an internal access control policy, procedure and process in place and has 

created the OOS User Management process that meets the Audit and 

Accountability policy. For external and general users, their accounts will be 

blocked if they remain inactive for 365 days, an account audit report is generated 

and reviewed regularly. 

To ensure transparency and minimize potential privacy risks, AmeriCorps posts a 

Privacy Act Statement on the login page of OOS and provides the users of OOS 
 

9 

with choice and consent options that the users can choose to either provide PII so as 

to proceed further with the order or not to continue. The OOS website also has 

links to the privacy policy of AmeriCorps, which provides details about the privacy 

practice of AmeriCorps. AmeriCorps develops a SORN that covers OOS and 

conducts this Privacy Impact Assessment as a mean to appropriately notify the 

public of the data collection and data handling activities of OOS, the relevant 

routine uses and purpose, the privacy rights of the individuals protected by the 

Privacy Act of 1974 as amended and how their data privacy is safeguarded. 

In addition, AmeriCorps requires that all AmeriCorps and vendor staff members 

who operate the system must take annual security and privacy training and agree to 

follow the AmeriCorps Rules of Behavior and policies, to ensure that they have 

sufficient knowledge about the privacy and cybersecurity compliance requirements, 

and maintain good information security and privacy compliance posture. 

13-2 Describe the technical, physical, and administrative measures that protect PII if 

the system is being retired. 

Not Applicable 

13-3 State if a system security plan and privacy plan is completed and the date of 

control verification. 

The System Security Plan was updated on July 23, 2023. 

14- DATA ACCURACY, ACCESS, AMENDMENT, AND CONTROL 

14-1 Describe the steps taken to ensure PII is sufficiently accurate, relevant, current, 

and complete and the assurance procedure. 

The PII of most of the accounts is provided by the individual and the rest is entered 

into the system by AmeriCorps staff on behalf of the individual upon request. The 

webforms provide a separate box for each element of PII and clearly indicates what 

should be provided in each box. Individuals can correct or update their name and 

contact information when they complete a new order; the inability to change their 

PII at other times is not a concern because it is only needed to fulfill an order. 

14-2 Describe how an individual could view, correct, update, or ask to amend their PII. 

All individuals can correct or update their name and contact information whenever 

they complete an order. If they have any challenges involving an order or their PII, 

one or more “Contact Us” links towards the top of each screen will send the 

individual to the National Service Hotline page that explains how to request help 

via phone, live chat, or a message. 
 

10 

14-3 Describe how an individual could control what PII about themselves is included in 

the system or how it is used. Also describe how those decisions could affect the 

individual. 

An individual could decline to order from the system or limit the sensitivity of their 

PII in the system by providing their business contact information. When they ask 

AmeriCorps staff members to place an order on their behalf, they could also ask the 

AmeriCorps staff member to use their business contact information to complete the 

order. 

14-4 State if PII handling processes apply automation technology for decision making 

and describe the measures taken to eliminate risk to privacy interests. 

Not Applicable 

15- DATA RETENTION AND DESTRUCTION 

15-1 Identify the National Archives and Records Administration (NARA) provided 

retention schedule for the system and provide a summary of that schedule. 

AmeriCorps is working to assign a NARA retention schedule to these records. On 

an annual basis, AmeriCorps deletes the account of everyone who ordered a 

product and has not returned to the system in over a year. However, a copy of all 

information collected into the system will remain in the audit log until a disposition 

schedule has been established. 

15-1 Identify the role and process to coordinate with the parties involved in record 

retention and disposition. 

The Information System Owner will coordinate the record retention activities with 

the agency records officer.

16- SOCIAL SECURITY NUMBERS (SSNs) 

16-1 If the system collects truncated or full social security numbers (SSNs): 

a. Explain why the SSNs are required. 

b. Provide the legal authority for the usage of the SSNs. 

c. Describe any plans to reduce the number of SSNs. 

If the system does not collect any part of an SSN, write Not Applicable. 

Not Applicable; none of the online forms request or imply that someone should 

provide their SSN. 
 

11 

17- WEBSITES 

17-1 If the system includes a website which is available to individuals apart from 

AmeriCorps personnel and contractors, discuss how it meets all AmeriCorps and 

Federal privacy requirements. If the system does not include a website, write Not 

Applicable. 

The website includes a footer that links to the AmeriCorps Privacy Program web 

page. 

The system does not use web measurement and customization technologies apart 

from temporary cookies. 

18- OTHER PRIVACY RISKS 

18-1 Discuss any other system privacy risks or write Not Applicable. 

Not Applicable