Privacy and Civil Liberties Impact Assessment 

for the 

Office of the Chief Information Officer (OCIO)
&

Microsoft O365 Implementation

May 21, 2019 

Reviewing Official

Bureau Certifying Official

Timothy H. Skinner

Bureau Privacy and Civil Liberties Officer

Departmental Offices

Office of Privacy, Transparency, and Records

Department of the Treasury
 

 

 

 

 

 

 

 

Section 1: Introduction 

It is the policy of the Department of the Treasury (“Treasury” or “Department”) and its Bureaus 

to conduct a Privacy and Civil Liberties Impact Assessment (“PCLIA”) when personally 

identifiable information (“PII”) is maintained in a system or by a project. PCLIAs are required 

for all systems and projects that collect, maintain, or disseminate PII, regardless of the manner in 

which the information is retrieved. 

This assessment is being completed pursuant to Section 208 of the E-Government Act of 2002 

(“E-Gov Act”), 44 U.S.C. § 3501, Office of the Management and Budget (“OMB”) 

Memorandum 03-22, “OMB Guidance for Implementing the Privacy Provisions of the EGovernment Act of 2002,” and Treasury Directive 25-07, “Privacy and Civil Liberties Impact 

Assessment (PCLIA),” which requires Treasury Offices and Bureaus to conduct a PCLIA before: 

1. developing or procuring information technology (“IT”) systems or projects that collect, 

maintain or disseminate PII from or about members of the public, or 

2. initiating a new collection of information that: a) will be collected, maintained, or 

disseminated using IT; and b) includes any PII permitting the physical or online 

contacting of a specific individual, if identical questions have been posed to, or identical 

reporting requirements imposed on, 10 or more persons. Agencies, instrumentalities, or 

employees of the federal government are not included. 

This PCLIA provides the following information regarding the system or project: 

(1) an overview of its purpose and functions; 

(2) a description of the information collected; 

(3) a description of the how information is maintained, used, and shared; 

(4) an assessment of whether the system or project is in compliance with federal

requirements that support information privacy; and 

(5) an overview of the redress/complaint procedures available to individuals who may be 

affected by the use or sharing of information by the system or project. 

This is the initial PCLIA for Microsoft O365 Implementation. 

Section 2: Definitions 

Agency – means any entity that falls within the definition of the term “executive agency”' as defined in 31 U.S.C. § 

102. 

Certifying Official – The Bureau Privacy and Civil Liberties Officer(s) who certify that all requirements in TD and 

TD P 25-07 have been completed so a PCLIA can be reviewed and approved by the Treasury Deputy Assistant 

Secretary for Privacy, Transparency, and Records. 

Collect (including “collection”) – means the retrieval, receipt, gathering, or acquisition of any PII and its storage or 

presence in a Treasury system. This term should be given its broadest possible meaning. 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Contractors and service providers – are private companies that provide goods or services under a contract with the 

Department of the Treasury or one of its bureaus. This includes, but is not limited to, information providers, 

information processors, and other organizations providing information system development, information technology 

services, and other outsourced applications. 

Data mining – means a program involving pattern-based queries, searches, or other analyses of 1 or more electronic 

databases, where – (a) a department or agency of the federal government, or a non-federal entity acting on behalf of 

the federal government, is conducting the queries, searches, or other analyses to discover or locate a predictive 

pattern or anomaly indicative of terrorist or criminal activity on the part of any individual or individuals; (b) the 

queries, searches, or other analyses are not subject-based and do not use personal identifiers of a specific individual, 

or inputs associated with a specific individual or group of individuals, to retrieve information from the database or 

databases; and (c) the purpose of the queries, searches, or other analyses is not solely – (i) the detection of fraud, 

waste, or abuse in a government agency or program; or (ii) the security of a government computer system. 

Disclosure – When it is clear from its usage that the term “disclosure” refers to records provided to the public in 

response to a request under the Freedom of Information Act (5 U.S.C. § 552, “FOIA”) or the Privacy Act (5 U.S.C. 

§ 552a), its application should be limited in that manner. Otherwise, the term should be interpreted as synonymous 

with the terms “sharing” and “dissemination” as defined in this manual. 

Dissemination – as used in this manual, is synonymous with the terms “sharing” and “disclosure” (unless it is clear 

from the context that the use of the term “disclosure” refers to a FOIA/Privacy Act disclosure). 

E-Government – means the use of digital technologies to transform government operations to improve 

effectiveness, efficiency, and service delivery. 

Federal information system – means a discrete set of information resources organized for the collection, 

processing, maintenance, transmission, and dissemination of information owned or under the control of a federal 

agency, whether automated or manual. 

Final Rule – After the NPRM comment period closes, the agency reviews and analyzes the comments received (if 

any). The agency has the option to proceed with the rulemaking as proposed, issue a new or modified proposal, or 

withdraw the proposal before reaching its final decision. The agency can also revise the supporting analyses 

contained in the NPRM (e.g., to address a concern raised by a member of the public in response to the NPRM). 

Government information – means information created, collected, used, maintained, processed, disseminated, or 

disposed of by or for the federal government. 

Individual – means a citizen of the United States or an alien lawfully admitted for permanent residence. If a 

question does not specifically inquire about or an issue does not clearly involve a Privacy Act system of records, the 

term should be given its common, everyday meaning. In certain contexts, the term individual may also include 

citizens of other countries who are covered by the terms of an international or other agreement that involves 

information stored in the system or used by the project. 

Information – means any representation of knowledge such as facts, data, or opinions in any medium or form, 

regardless of its physical form or characteristics. This term should be given the broadest possible meaning. This 

term includes, but is not limit to, information contained in a Privacy Act system of records. 

Information technology (IT) – means any equipment or interconnected system or subsystem of equipment, used in 

the automatic acquisition, storage, analysis, evaluation, manipulation, management, movement, control, display, 

switching, interchange, transmission, or reception of data or information by the executive agency, if the equipment 

is used by the executive agency directly or is used by a contractor under a contract with the executive agency that 

requires the use: (i) of that equipment; or (ii) of that equipment to a significant extent in the performance of a service 

or the furnishing of a product. It includes computers, ancillary equipment (including imaging peripherals, input, 

output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled 

by the central processing unit of a computer, software, firmware and similar procedures, services (including support 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

services), and related resources; but does not include any equipment acquired by a federal contractor incidental to a 

federal contract. Clinger-Cohen Act of 1996, 40 U.S.C. § 11101(6). 

Major Information system – embraces “large” and “sensitive” information systems and means “a system or 

project that requires special management attention because of its importance to an agency mission; its high 

development, operating, or maintenance costs; or its significant role in the administration of agency programs, 

finances, property, or other resources.” OMB Circular A-130, § 6.u. This definition includes all systems that contain 

PII and are rated as “MODERATE or HIGH impact” under Federal Information Processing Standard 199. 

National Security systems – a telecommunications or information system operated by the federal government, the 

function, operation or use of which involves: (1) intelligence activities, (2) cryptologic activities related to national 

security, (3) command and control of military forces, (4) equipment that is an integral part of a weapon or weapons 

systems, or (5) systems critical to the direct fulfillment of military or intelligence missions, but does not include 

systems used for routine administrative and business applications, such as payroll, finance, logistics, and personnel 

management. Clinger-Cohen Act of 1996, 40 U.S.C. § 11103. 

Notice of Proposed Rule Making (NPRM) – the Privacy Act (Section (J) and (k)) allow agencies to use the 

rulemaking process to exempt particular systems of records from some of the requirements in the Act. This process 

is often referred to as “notice-and-comment rulemaking.” The agency publishes an NPRM to notify the public that 

the agency is proposing a rule and provides an opportunity for the public to comment on the proposal before the 

agency can issue a final rule. 

Personally Identifiable Information (PII) –any information that can be used to distinguish or trace an individual’s 

identity, either alone or when combined with other personal or identifying information that is linked or linkable to a 

specific individual. 

Privacy and Civil Liberties Impact Assessment (PCLIA) – a PCLIA is: 

(1) a process conducted to: (a) identify privacy and civil liberties risks in systems, programs, and other 

activities that maintain PII; (b) ensure that information systems, programs, and other activities comply 

with legal, regulatory, and policy requirements; (c) analyze the privacy and civil liberties risks 

identified; (d) identify remedies, protections, and alternative or additional privacy controls necessary to 

mitigate those risks; and (e) provide notice to the public of privacy and civil liberties protection 

practices. 

(2) a document that catalogues the outcome of that privacy and civil liberties risk assessment process. 

Protected Information – as the term is used in this PCLIA, has the same definition given to that term in TD 25-10, 

Section 4. 

Privacy Act Record – any item, collection, or grouping of information about an individual that is maintained by an 

agency, including, but not limited to, the individual’s education, financial transactions, medical history, and criminal 

or employment history and that contains the individual’s name, or the identifying number, symbol, or other 

identifying particular assigned to the individual, such as a finger or voice print or a photograph. 5 U.S.C. § 552a 

(a)(4). 

Reviewing Official – The Deputy Assistant Secretary for Privacy, Transparency, and Records who reviews and 

approves all PCLIAs as part of her/his duties as a direct report to the Treasury Senior Agency Official for Privacy. 

Routine Use – with respect to the disclosure of a record outside of Treasury (i.e., external sharing), the sharing of 

such record for a purpose which is compatible with the purpose for which it was collected 5 U.S.C. § 552a(a)(7). 

Sharing – any Treasury initiated distribution of information to government employees or agency contractors or 

grantees, including intra- or inter-agency transfers or exchanges of Treasury information, regardless of whether it is 

covered by the Privacy Act. It does not include responses to requests for agency records under FOIA or the Privacy 

Act. It is synonymous with the term “dissemination” as used in this assessment. It is also synonymous with the 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

term “disclosure” as used in this assessment unless it is clear from the context in which the term is used that it refers 

to disclosure to the public in response to a request for agency records under FOIA or the Privacy Act. 

System – as the term used in this manual, includes both federal information systems and information technology. 

System of Records – a group of any records under the control of Treasury from which information is retrieved by 

the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the 

individual. 5 U.S.C. § 552a (a)(5). 

System of Records Notice – Each agency that maintains a system of records shall publish in the Federal Register 

upon establishment or revision a notice of the existence and character of the system of records, which notice shall 

include: (A) the name and location of the system; (B) the categories of individuals on whom records are maintained 

in the system; (C) the categories of records maintained in the system; (D) each routine use of the records contained 

in the system, including the categories of users and the purpose of such use; (E) the policies and practices of the 

agency regarding storage, retrievability, access controls, retention, and disposal of the records; (F) the title and 

business address of the agency official who is responsible for the system of records; (G) the agency procedures 

whereby an individual can be notified at her/his request if the system of records contains a record pertaining to him; 

(H) the agency procedures whereby an individual can be notified at her/his request how she/he can gain access to 

any record pertaining to him contained in the system of records, and how she/he can contest its content; and (I) the 

categories of sources of records in the system. 5 U.S.C. § 552a (e)(4). 

System Owner – Official responsible for the overall procurement, development, integration, modification, or 

operation and maintenance of a system. 

Section 3: System Overview 

Section 3.1: System/Project Description and Purpose 

This PCLIA covers the Office of the Chief Information Officer (OCIO) Microsoft Office 365 

(O365) G3 Suite for both the online cloud based service and locally installed desktop 

applications. This assessment is limited to the data stored and processed on the online cloud 

based service and locally installed desktop applications that reside within the security controls 

of the O365 G3 suite of products. 

The Department of the Treasury’s Departmental Offices (DO) will pilot the O365 G3 Suite for 

up to 100 select users with the intent to extend its use to all of DO. This system will utilize a 

Microsoft hybrid cloud architecture to identify critical planning and execution tasks and lessons 

learned, as well as validate existing network and security resources. Access to the O365 G3 

suite of services will be limited to users inside the DO Treasury Network (TNET) boundary. The 

O365 pilot will aid planning and execution of the subsequent enterprise implementation of the 

O365 G3 suite of applications for the DO organization as a whole by October 1, 2020. 

The O365 applications/suite of products are: 

• Word 

• Excel 

• PowerPoint 

• OneNote 

• Outlook 

• Publisher & Access (PC installations only) 
 

 

 

 

 

 

 

 

 

•	 Exchange 

•	 Skype for Business 

The pilot will be instrumental in developing an effective testing methodology and identifying 

training requirements and communication planning. Design, change management, risks, 

security constraints, testing results and lessons learned will be compiled to allow for a transition 

of services and institutional knowledge to the OCIO. 

O365 is a cloud computing-based subscription service offering from Microsoft. The National 

Institute for Standards and Technology (NIST) defines cloud computing as “a model for enabling 

convenient, on-demand network access to a shared pool of configurable computing resources 

(e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and 

released with minimal management effort or cloud provider interaction.” Further, as defined in 

NIST SP 800-145 (The NIST Definition of Cloud Computing), the service model for the Microsoft 

cloud computing environments, Office 365 GCC High/DoD, is Software-as-a-Service (SaaS). 

SaaS is a model of software deployment whereby one or more applications and the 

computational resources to run them are provided for use on demand as a turnkey (i.e., ready to 

use) service. Its main purpose is to reduce the Government’s total cost of hardware and software 

development, maintenance, and operations. Security requirements are implemented mainly by 

Microsoft, the cloud provider. Treasury, the cloud subscriber, does not manage or control the 

underlying cloud infrastructure or individual applications, except for preference selections and 

limited administrative application settings. 

Office 365 GCC High/DoD provides customers with cloud versions of Exchange Online (EXO), 

SharePoint Online (SPO) (including Project Online, and OneDrive for Business) and Skype for 

Business (SFB). Exchange Online is an email service. SharePoint Online is a collaboration and 

document management platform. Skype for Business is a communication service that offers 

instant messaging, audio and video calling, online meetings, and web conferencing capabilities. 

Office 365 GCC High/DoD has a number of supporting services in addition to these core, 

customer-facing services. Each core and supporting service is supported by a unique group of 

developers, testers, and administrators referred to throughout this document as a “service 

team.” Each service is deployed on service-specific servers, whether physical or virtual. 

Estimated Number of Individuals Whose Personally Identifiable Information is 

Maintained in the System or by the Project 

☒ 0 – 999 ☐ 1000 – 9,999 ☐ 10,000 – 99,999 

☐ 100,000 – 499,999 ☐ 500,000 – 999,999 ☐ 1,000,000+ 

Section 3.2: Authority to Collect

The authorities for operating this system or performing this project are: 

•	 On July 7, 2017, the Office of Management and Budget (OMB) issued Memorandum M-17-22 

which required federal agencies to identify methods to shift existing capital investments to cloud 

computing alternatives. OMB further required that agencies transition to provisioned services, 

including configurable and flexible technology such as Software as a Service (SaaS), Platform as a 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Service (PaaS), and Infrastructure as a Service (IaaS) to the greatest extent practicable, consistent 

with the Cloud First policy. As required by the Federal Information Technology Acquisition 

Reform Act (FITARA), agencies utilizing cloud services must do so in a manner that is consistent 

with requirements of the Federal Risk and Authorization Management Program (FedRAMP) and 

National Institute of Standards and Technology (NIST) guidance. Due to these unique and evolving 

requirements, the Department of the Treasury, Departmental Offices, is using the Office 365 US 

Government GCC High and DOD cloud computing environments to conduct a limited pilot 

implementation of the O365 suite. 

•	 The organization determines the legal authority that permits the collection, use, maintenance, and 

sharing of personally identifiable information (PII), either generally or in support of a specific program 

or information system need. 

•	 The Privacy Act provides the legal authority and requirements governing the maintenance, use and 

dissemination of records covered by the Act. O365 is an operational application required for Treasury 

users to conduct official business. 

•	 The records collected regarding an internal Treasury user’s activities while logged into the system are 

covered by Treasury .015, Treasury General Information Technology Access Account Records. 

•	 Records collected from federal employees and contractors to allow them to obtain credentials 

necessary for access to federally controlled information systems is covered by GSA/GOVT-7 -

Personal Identity Verification Identity Management System (PIV IDMS) September 28, 2006 71 FR 

56983. These SORNs may be found on the Terasury website. 

Section 4: Information Collection 

Section 4.1: Relevant and Necessary 

The Privacy Act requires “each agency that maintains a system of records [to] maintain in its 

records only such information about an individual as is relevant and necessary to accomplish a 

purpose of the agency required to be fulfilled by statute or by executive order of the President.” 5 

U.S.C. § 552a (e)(1). It allows federal agencies to exempt records from certain requirements 

(including the relevant and necessary requirement) under certain conditions5 U.S.C. §552a (k). 

The proposed exemption must be described in a Notice of Proposed Rulemaking (“NPRM”). In 

the context of the Privacy Act, the purpose of the NPRM is to give the public notice of a Privacy 

Act exemption claimed for a system of records and solicit public opinion on the proposed 

exemption. After addressing any public concerns raised in response to the NPRM, the agency 

must issue a Final Rule. It is possible for some, but not all, of the records maintained in the 

system or by the project to be exempted from the Privacy Act through the NPRM/Final Rule 

process. 

Section 4.1(a) Please check all of the following that are true: 

1. ☐ None of the PII maintained in the system or by the project is part of a Privacy Act system of records; 

2. All of the PII maintained in the system or by the project is part of a system of records and none of it is 

exempt from the Privacy Act relevant and necessary requirement; 

☐

3. All of the PII maintained in the system or by the project is part of a system of records and all of it is 

exempt from the Privacy Act relevant and necessary requirement; 

☐

4. Some, but not all, of the PII maintained in the system or by the project is part of a system of records and 

the records to which the Privacy Act applies are exempt from the relevant and necessary requirement; and; 

☐

5. ☒ Some, but not all, of the PII maintained in the system or by the project is part of a system of records and 

none of the records to which the Privacy Act applies are exempt from the relevant and necessary requirement. 
 

 

 

 

 

 

 

 

 

 

 

 

Section 4.1(b) ☒ Yes ☐ No ☐ N/A With respect to PII maintained in the system or by the project that is 

subject to the Privacy Act’s relevant and necessary requirement, was an assessment conducted prior to collection 

(e.g., during Paperwork Reduction Act analysis) to determine which PII types (see Section 4.2 below) were 

relevant and necessary to m eet the system’s or project’s mission requirements? 

Section 4.1(c) ☒ Yes ☐ No ☐ N/A With respect to PII currently maintained in the system or by the project that 

is subject to the Privacy Act’s relevant and necessary requirement, is the PII limited to only that which is relevant 

and necessary to meet the system’s or project’s mission requirements? 

Section 4.1(d) ☒ Yes ☐ No With respect to PII maintained in the system or by the project that is subject to the 

Privacy Act’s relevant and necessary requirement, is there a process to continuously reevaluate and ensure that 

the PII remains relevant and necessary? 

O365 is not a system. It is a suite of products used to process information. O365 does not itself collect PII 

from Treasury DO information technology (IT) users, but Treasury users may use the products to acquire 

information from one of the products in the suite (e.g., via Outlook) or from other sources. In the course of 

performing their official duties, Treasury DO IT users use the O365 suite of products to input and receive PII 

for a wide array of purposes. This includes, but is not limited to: performing HR-related functions, including 

the hiring, suspension and termination of employees and other employee performance-related functions; 

completion of forms related to employment and employee benefits and any other Treasury functions that may 

fall within the scope of a Treasury DO IT user’s official responsibilities. Because of the broad range of 

functions that are performed throughout Treasury, it would be impossible to list and assess the relevance and 

necessity of all of the possible PII that could be processed using the MS O365 suite of products. PII that DO 

Treasury IT users enter into an O365 product that is related to official Treasury business is a Treasury record 

and subject to the Privacy Act if it otherwise meets the Act’s requirements. 

Treasury Directive (TD) 87-04 limits all Treasury IT users (including DO) in their personal use of Treasury 

resources. Treasury IT users are advised in TD 87-04 and when they log on to the system that they have no 

right to privacy, nor should they have an expectation of privacy while using any Government IT resource at any 

time. IT users are also restricted by Rules of Behavior that further limit the purposes for which they may use 

Treasury IT. Under TD 87-04, during non-duty time, for periods of reasonable duration and frequency, 

Treasury IT users are permitted limited personal use of Treasury IT resources. During this time, it is possible 

that some Treasury DO IT users may enter their own personal information into the system (in this case, the 

cloud) using one of the products in the O365 suite. As is true with PII generated in the course of their official 

duties, it would be impossible to catalogue all of the possible types of their own PII Treasury IT u sers might 

store in the cloud using the MS O365 suite of products. Any of their own personal information a Treasury DO 

IT user enters into an O365 application that is unrelated to official Treasury business is not a Treasury record 

and is, therefore, not covered by the Privacy Act. 

The combination of the Rules of Behavior and limited use policy help minimize the amount of PII Treasury IT 

users introduce into Treasury systems using the O365 suite of products. Relevance and necessity limitations on 

information processed using the O365 products that is stored on particular Treasury systems is addressed in 

the PCLIAs for those systems. 

Section 4.2: PII and/or information types or groupings 

To perform their various missions, federal agencies must necessarily collect various types of 

information. The checked boxes below represent the types of information maintained in the 

system or by the project. Information identified below is used by the system or project to fulfill 

the purpose stated in Section 3.3 – Authority to Collect. 

Because of the broad range of functions that are performed throughout Treasury, it would be impossible to list all 

of the possible PII types that a DO IT user could process pursuant to official functions using the MS O365 suite of 

products. Similarly, it would be impossible to catalogue all of the possible types of their own PII Treasury DO IT 

users might store in the cloud (or on the hard drive of Treasury laptops) using the MS O365 suite of 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

products. For a discussion of the particular PII that might be processed using O365 on particular Treasury 

information systems, please see the PCLIAs on the Treasury and Treasury bureau websites. 

Section 4.3: Sources of information and the method and manner of collection 

Source of PII: Treasury Information Technology Users (in their personal and official 

capacities) 

Specific PII identified in Section 4.2 that was acquired from this source: All information (identify all). 

Manner in which information is acquired from source by the Treasury project/system: (select all that apply): 

☐ From a paper or electronic form provided to individuals, the public or members of a particular group 

Please identify the form name (or description) and/or number (e.g., OMB Control Number): Not 

applicable._________________ 

☐ Received in paper format other than a form. 

☒ Delivered to the project on disk or other portable device and uploaded to the system. 

☒ Accessed and downloaded or otherwise acquired via the internet 

☒ Email (Outlook) 

☒ Scanned documents uploaded to the system. 

☐ Bulk transfer 

☐ Extracted from particular technology (e.g., radio frequency identification data (RFID) devices, video or 

photographic cameras, biometric collection devices). 

☒ Fax 

☒ Extracted from notes of a phone interview or face to face contact 

☒ Other: Please describe: 

The boxes checked above represent the methods by which DO IT users may obtain PII for processing using one of 

the applications in the MS O365 suite of products. DO IT users, other government employees, and members of the 

public use Outlook email to send and receive information. DO IT users also store and maintain information 

derived from the O365 suite of applications. 

Section 4.4: Privacy and/or civil liberties risks related to collection

Notice of Authority, Principal Uses, Routine Uses, and Effect of not Providing 

Information 

When Federal agencies use a form to obtain information from an individual that will be 

maintained in a system of records, they must inform the individual of the following: “(A) the 

authority (whether granted by statute, or by executive order of the President) which authorizes 

the solicitation of the information and whether disclosure of such information is mandatory or 

voluntary; (B) the principal purpose or purposes for which the information is intended to be 

used; (C) the routine uses which may be made of the information as published pursuant to 

paragraph (4)(D) of this subsection; and (D) the effects on her/him, if any, of not providing all or 

any part of the requested information.” 5 U.S.C § 522a(e)(3). 

Section 4.4(a) ☒ Yes ☐ No Is any of the PII maintained in the system or by the project collected directly from 

an individual? 
 

 

 

 

 

 

 

 

 

Section 4.4(b) ☒ Yes ☐ No ☐ N/A Was the information collected from the individual using a form (paper or 

electronic)? 

Section 4.4(c) ☒ Yes ☐ No ☐ N/A If the answer to Section 4.4(b) was “yes,” was the individual notified (on the 

form in which the PII was collected or on a separate form that can be retained by the individual) about the 

following at the point where the information was collected (e.g., in a form; on a website). 

☒ The authority (whether granted by statute, or by Executive order of the President) which authorizes 

the solicitation of the information. 

☒ Whether disclosure of such information is mandatory or voluntary. 

☒ The principal purpose or purposes for which the information is intended to be used. 

☒ The individuals or organizations outside of Treasury with whom the information may be/ will be 

shared. 

☒ The effects on the individual, if any, if they decide not to provide all or any part of the requested 

information. 

PII processed using the O365 suite of products may initially be collected directly from individuals. For example, 

a Treasury DO IT user could obtain information via Outlook that is then uploaded into a Treasury information 

system (including systems not covered by this PCLIA). All Treasury forms in which information is collected 

directly from the individual include notification to the individual regarding, the authority for the collection, the 

voluntary or mandatory nature of the collection, the purpose for which the information is used, and the effects on 

the individual if they decide not to provide all or part of the information requested. 

Use of Social Security Numbers 

Social Security numbers (“SSN”) are commonly used by identity thieves to commit fraudulent 

acts against individuals. The SSN is one data element that has the ability to harm the individual 

and requires more protection when used. Therefore, and in an effort to reduce risk to individuals 

and federal agencies, OMB Memorandum M-07-16, Safeguarding Against and Responding to 

the Breach of Personally Identifiable Information, (May 22, 2007) required agencies to reduce 

the use of SSNs in agency systems and programs and to identify instances in which the collection 

is superfluous. In addition, OMB mandated agencies to explore alternatives to agency use of 

SSNs as personal identifiers for Federal employees and members of the public. 

In addition, the Privacy Act provides that: “It shall be unlawful for any Federal, State or local 

government agency to deny to any individual any right, benefit, or privilege provided by law 

because of such individual’s refusal to disclose his social security account number.” Pub. L. No. 

93–579, § 7. This provision does not apply to: (1) any disclosure which is required by federal 

statute; or (2) any disclosure of an SSN to any federal, state, or local agency maintaining a 

system of records in existence and operating before January 1, 1975, if such disclosure was 

required under statute or regulation adopted prior to such date to verify the identity of an 

individual. Id. at § 7(a)(2)(A)-(B). 

Section 4.4(d) ☒ Yes ☐ No ☐ N/A Does the system or project maintain SSNs? 

Section 4.4(e) ☒ Yes ☐ No ☐ N/A Are there any alternatives to the SSNs as a personal identifier? If yes, 

please provide a narrative explaining why other alternatives to identify individuals will not be used. 

Section 4.4(f) ☒ Yes ☐ No ☐ N/A Will individuals be denied any right, benefit, or privilege provided by law 

because of such individual's refusal to disclose their SSN? If yes, please check the applicable box: 

☒ SSN disclosure is required by Federal statute or Executive Order. ; or 
 

 

 

 

 

 

 

 

 

 

 

☒ the SSN is disclosed to any Federal, state, or local agency maintaining a system of records in 

existence and operating before January 1, 1975, and disclosure was required under statute or regulation 

adopted prior to such date to verify the identity of an individual. If checked, please provide the name of 

the system of records in the space provided below. 

Section 4.4(g) ☒ Yes ☐ No ☐ N/A When the SSN is collected, are individuals given notice whether disclosure 

is mandatory or voluntary, the legal authority such number is solicited, and what uses will be made of it? If yes, 

please explain what means are used to provide notice. 

When Treasury does require the SSN in order to perform a government function, it is typically collected through 

a secured connection and only as allowed by law as discussed in the PCLIA for the relevant information system. 

Treasury IT users complete forms before they are granted access to Treasury IT. Employees are discouraged 

from storing their own sensitive PII on the system (i.e., they are given notice before entering the system that 

there is no guarantee of privacy as a Federal employee while using the system). 

First Amendment Activities 

The Privacy Act provides that Federal agencies “maintain no record describing how any 

individual exercises rights guaranteed by the First Amendment unless expressly authorized by 

statute or by the individual about whom the record is maintained or unless pertinent to and within 

the scope of an authorized law enforcement activity.” 5 U.S.C. § 552a(e)(7). 

Section 4.4(h) ☐ Yes ☒ No Does the system or project maintain any information describing how an individual 

exercises their rights guaranteed by the First Amendment? 

Section 4.4(h) If the system or project maintains information describing how an individual exercises their 

rights guaranteed by the First Amendment, do any of the following exceptions apply (the information may be 

maintained if any of the exceptions apply)? 

☒ N/A (system or project does not maintain any information describing how an individual exercises their rights 

guaranteed by the First Amendment so no exceptions are needed) 

☐ The individual about whom the information was collected or maintained expressly authorizes its 

collection/maintenance. 

☐ The information maintained is pertinent to and within the scope of an authorized law enforcement 

activity. 

☐ There is a statute that expressly authorizes its collection. 

☒ N/A, the system or project does not maintain any information describing how any individual 

exercises their rights guaranteed by the First Amendment. 

This project does not maintain any records describing how any individual exercises rights guaranteed by the 

First Amendment. 

Section 5: Maintenance, use, and sharing of the information 

The following sections require a clear description of the system’s or project’s use of information. 

Section 5.1: Describe how and why the system or project uses the information it 

collects and maintains 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Please describe all of the uses of the information types and groupings collected and maintained 

by the system or project (see Section 4.2), including a discussion of why the information is used 

for this purpose and how it relates to the mission of the bureau or office that owns the system. 

As stated above, it would be impossible to state all of the possible uses to which O365 may be put by Treasury IT 

users. It would include the full scope of all official duties performed throughout Treasury (or Departmental 

Offices for pilot purposes). For individual Treasury IT users who choose to store their own PII in the cloud 

despite Treasury warnings and limitations on system usage, their own PII that they choose to store on the system 

(information not required by Treasury) is not used by Treasury in the absence of evidence that the individual may 

be engaged in some criminal activity or activity in violation of Treasury policy (in which case it may be used by 

Treasury if relevant to those issues). 

Collecting Information Directly from the Individual When Using it to Make Adverse 

Determinations About Them 

The Privacy Act requires that Federal agencies “collect information to the greatest extent 

practicable directly from the subject individual when the information may result in adverse 

determinations about an individual’s rights, benefits, and privileges under Federal programs.” 5 

U.S.C. § 552a(e)(2). 

Section 5.1(a) ☒ Yes ☐ No Is it possible that the information maintained in the system or by the project may 

be used by Treasury to make an adverse determination about an individual’s rights, benefits, and privileges 

under federal programs (e.g., decisions about whether the individual will receive a financial benefit, get a 

clearance or access to a Treasury facility, obtain employment with Treasury)? 

Section 5.1(b) ☒ Yes ☐ No Is it possible that Treasury will share information maintained in the system or by 

the project with a third party external to the Department that will use the information to make an adverse 

determination about an individual’s rights, benefits, and privileges under federal programs? 

Section 5.1(c) ☒ Yes ☐ No ☐ N/A If information could potentially be used to make an adverse determination 

about an individual’s rights, benefits, and privileges under federal programs, does the system or project collect 

information (to the greatest extent practicable) directly from the individual? 

This project does not use information to make adverse determinations about individuals, but the O365 suite of 

products may be used to create, process and store PII that may be used to make adverse determinations about 

individuals. Information processed using O365 products is discussed in other Treasury PCLIAs where the 

processed information is actually used (e.g., the HR Connect PCLIA). 

Data Mining 

As required by Section 804 of the Implementing the 9/11 Commission Recommendations Act of 

2007 (“9-11 Commission Act”), Treasury reports annually to Congress on its data mining 

activities. For a comprehensive overview of Treasury’s data mining activities, please review the 

Department’s Annual Privacy reports available at: http://www.treasury.gov/privacy/annualreports. 

Section 5.1(d) ☐ Yes ☒ No Is information maintained in the system or by the project used to conduct “datamining” activities as that term is defined in the Implementing the 9-11 Commission Act? 

This project is not used to conduct “data mining” activities. 
 

 

 

 

 

Section 5.2: Ensuring accuracy, completeness, and timeliness of information 

collected, maintained, and shared 

Exemption from Accuracy, Relevance, Timeliness, and Completeness Requirements 

The Privacy Act requires that Federal agencies “maintain all records which are used by the 

agency in making any determination about any individual with such accuracy, relevance, 

timeliness, and completeness as is reasonably necessary to assure fairness to the individual in the 

determination.” 5 U.S.C § 552a(e)(5). If a particular system of records meets certain 

requirements (including the NPRM process defined in Section 2 above), an agency may exempt 

the system of records (or a portion of the records) from this requirement. 

Section 5.2(a) ☐ Yes ☒ No Is all or any portion of the information maintained in th e system or by the project: 

(a) part of a system of records and (b) exempt from the accuracy, relevance, timeliness, and completeness 

requirements in sections (e)(5) of the Privacy Act? 

None of the records used in the project are exempt from the Privacy Act accuracy, relevance, timeliness or 

completeness requirements, but the records acquired or created using O365 may be exempt from certain Privacy 

Act requirements, depending on the system in which they are maintained. 

Computer Matching 

The Computer Matching and Privacy Protection Act of 1988 amended the Privacy Act imposing 

additional requirements when Privacy Act systems of records are used in computer matching 

programs. 

Pursuant to the Privacy Act, as amended, there are two distinct types of matching programs. The 

first type of matching program involves the computerized comparison of two or more automated 

federal personnel or payroll systems of records or a system of federal personnel or payroll 

records with non-federal records. This type of matching program may be conducted for any 

purpose. The second type of matching program involves the computerized comparison of two or 

more automated systems of records or a system of records with non-federal records. The 

purpose of this type of matching program must be for the purpose of eligibility determinations or 

compliance requirements for applicants, recipients, beneficiaries, participants, or providers of 

services for payments or in-kind assistance under federal benefit programs, or recouping 

payments or delinquent debts under such federal benefit programs. See 5 U.S.C. § 522a(a)(8). 

Matching programs must be conducted pursuant to a matching agreement between the source 

and recipient agencies. The matching agreement describes the purpose and procedures of the 

matching and establishes protections for matching records. 

Section 5.2(b) ☐ Yes ☒ No Is any of the information maintained in th e system or by the project (a) part of a 

system of records and (b) used as part of a matching program? 

Section 5.2(c) ☐ Yes ☐ No ☒ N/A Is there a matching agreement in place that contains the information 

required by Section (o) of the Privacy Act? 

Section 5.2(d) ☐ Yes ☐ No ☒ N/A Are assessments made regarding the accuracy of the records that will be 

used in the matching program? 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Section 5.2(e) ☐ Yes ☐ No ☒ N/A Does the bureau or office that owns the system or project independently 

verify the information, provide the individual notice and an opportunity to contest the findings, or obtain Data 

Integrity Board approval in accordance with Section (p) of the Privacy Act before taking adverse action against 

the individual? 

O365 will not be used to conduct data-mining. 

Ensuring Fairness in Making Adverse Determinations About Individuals 

Federal agencies are required to “maintain all records which are used by the agency in making 

any determination about any individual with such accuracy, relevance, timeliness, and 

completeness as is reasonably necessary to assure fairness to the individual in the 

determination.” 5 U.S.C. § 552a(e)(5). This requirement also applies when merging records 

from two or more sources where the merged records are used by the agency to make any 

determination about any individual. 

Section 5.2(f) ☐ Yes ☒ No With respect to the information maintained in the system or by the project, are 

steps taken to ensure all information used to make a determination about an individual is maintained with such 

accuracy, relevance, timeliness, and completeness as is reasonably necessary to assure fairness to the individual 

in the determination? 

This project does not use information to make adverse determinations about individuals, but the O365 suite of 

products may be used to create, process and store PII that may be used to make adverse determinations about 

individuals. Information processed using O365 products is discussed in other Treasury PCLIAs where the 

processed information is actually used (e.g., the HR Connect PCLIA). 

Merging Information About Individuals 

Section 5.2(g) ☐ Yes ☒ No Is information maintained in the system or by the project merged with 

electronic or non-electronic information from internal or external sources (e.g., other files or systems)? 

Section 5.2(h) ☐ Yes ☒ No ☐ N/A Once merged, is the information used in making determinations about 

individuals (e.g., decisions about whether the individual will receive a financial benefit or payment, get a 

clearance or access to a Treasury facility, obtain employment with Treasury, etc.)? 

Section 5.2(i) ☐ Yes ☐ No ☒ N/A Are there documented policies or procedures for how information is 

merged? 

Section 5.2(j) ☐ Yes ☐ No ☒ N/A Do the documented policies or procedures address how to proceed 

when partial matches (where some, but not all of the information being merged matches a particular 

individual) are discovered after the information is merged? 

Section 5.2(k) ☐ Yes ☐ No ☒ N/A If information maintained in the system or by the project is used to 

make a determination about an individual, are steps taken to ensure the accuracy, relevance, timeliness, and 

completeness of the information as is reasonably necessary to assure fairness to the individual? 

Multiple files are not merged into a single file using O365 for purposes of the pilot, but during the pilot each 

Treasury IT user’s emails will be moved from their existing Outlook account to their O365 account. This is a 

movement of files, not a merger. 

Policies and Standard Operating Procedures or Technical Solutions Designed to 

Ensure Information Accuracy, Completeness, and Timeliness 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Section 5.2(l) ☐ Yes ☐ No ☒ N/A If information maintained in the system or by the project is used to 

make any determination about an individual (even if it is an exempt system of records), are there 

documented policies or standard operating procedures for the system or project that address the accuracy, 

completeness, and timeliness of the information? 

Section 5.2(m) ☐ Yes ☒ No Does the system or project use any software or other technical solutions 

designed to improve the accuracy, completeness, and timeliness of the information used to make an adverse 

determination about an individual's rights, benefits, and/or privileges (regardless of if it is an exempt system 

of records)? 

This project does not use information to make adverse determinations about individuals, but the O365 suite 

of products may be used to create, process and store PII that may be used to make adverse determinations 

about individuals. Information processed using O365 products is discussed in other Treasury PCLIAs where 

the processed information is actually used (e.g., the HR Connect PCLIA). 

Accuracy, Completeness, and Timeliness of Information Received from the Source 

Section 5.2(n) ☐ Yes ☒ No Did Treasury or the bureau receive any guarantee, assurance, or other 

information from any information source(s) regarding the accuracy, timeliness and completeness of the 

information maintained in the system or by the project? 

Treasury IT users may receive assurances when using O365 to collect information from internal or external 

sources. The discussion of those assurances would be discussed in other Treasury PCLIAs where the 

processed information is actually used. 

Disseminating Notice of Corrections of or Amendments to PII 

Section 5.2(o) ☐ Yes ☒ No ☐ N/A Where feasible and appropriate, is there a process in place for 

disseminating corrections of or amendments to the PII maintained in the system or by the project to all 

internal and external information-sharing partners? 

Section 5.2(p) ☐ Yes ☒ No ☐ N/A Where feasible and appropriate, does the process for disseminating 

corrections or amendments include notifying the individual whose information is corrected or amended? 

This project does not disseminate corrections or amendments to PII maintained in the system. Information 

processed using O365 products is discussed in other Treasury PCLIAs where the information is actually 

used. For example, information created using Microsoft Word may be cut and pasted into HR Connect as 

part of the process of making determinations about Treasury employees. If corrections are necessary, they 

would be addressed by the HRConnect system owner. 

Section 5.3: Information sharing within the Department of the Treasury

Internal Information Sharing 

Section 5.3(a) ☒ Yes ☒ No Is PII maintained in the system or by the project shared with other Treasury 

bureaus? 

Section 5.3(b) ☒ Yes ☐ No Does the Treasury bureau or office that receives the PII limit access to those 

Treasury officers and employees who have a need for the PII in the performance of their official duties (i.e., 

those who have a “need to know”)? 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

This project does not share information with other Treasury bureaus, but information processed using O365 

products may be shared by individual Treasury IT users for other purposes that are addressed in the PCLIA 

for the system in which the information is actually used. 

Memorandum of Understanding/Other Agreements Limiting Treasury’s Internal 

Use/Disclosure of PII 

Section 5.3(c) ☒ Yes ☒ No ☐ N/A Is any of the PII maintained in the system or by the project subject to 

the requirements of a Memorandum of Understanding or other agreement (e.g., agreement with another 

federal or state agency that provided the information to the Treasury or subject to an international agreement 

or treaty) that limits or places conditions on Treasury’s internal use, maintenance, handling, or disclosure of 

the PII? 

There are no agreements limiting internal use or disclosure of the PII collected during the pilot. 

Internal Information Sharing Chart 

This project does not share PII with other Treasury bureaus or offices outside Departmental Offices (DO), but 

information processed using O365 products may be shared outside DO by individual Treasury IT users for other 

purposes that are addressed in the PCLIA for the system in which the information is actually used. 

Section 5.4: Information sharing with external (i.e., outside Treasury) organizations 

and individuals 

External Information Sharing 

Section 5.4(a) ☐ Yes ☒ No Is PII maintained in the system or by the project shared with agencies, 

organizations, or individuals external to Treasury? 

This project does not share with parties external to Departmental Offices (DO), but information processed 

using O365 products may be shared externally (i.e., outside Treasury) by individual Treasury IT users for 

other purposes that are addressed in the PCLIA for the system in which the information is actually used. 

Accounting of Disclosures 

Section 5.4(b) ☐ Yes ☐ No ☒ N/A With respect to records maintained in the system or by the project that 

are subject to the Privacy Act, do you maintain a paper or electronic log or other record of the date, nature, 

and purpose of each disclosure (not including intra-agency disclosures and FOIA disclosures) of a record to 

any person or to another agency (outside of Treasury) and the name and address of the person or agency to 

whom the disclosure is made? See 5 U.S.C § 552a(c). 

Section 5.4(c) ☐ Yes ☐ No ☒ N/A If you do not keep a running tabulation of every disclosure at the time it 

is made, are you able to reconstruct an accurate and complete accounting of disclosures so as to be able to 

respond to Privacy Act requests in a tim ely fashion? 

Section 5.4(d) ☐ Yes ☐ No ☒ N/A With respect to records maintained in the system or by the project that 

are subject to the Privacy Act, do you retain the log or other record of the date, nature, and purpose of each 

disclosure, for at least five years or the life of the record, whichever is longer, after the disclosure for which 

the accounting is made? 

Section 5.4(e) ☐ Yes ☐ No ☒ N/A With respect to records maintained in the system or by the project that 

are subject to the Privacy Act, does your bureau or office exempt the system of records (as allowed by the 

Privacy Act in certain circumstances) from the requirement to make the accounting available to the individual 

named in the record? 

Section 5.4(f) ☐ Yes ☐ No ☒ N/A With respect to records maintained in the system or by the project that 

are subject to the Privacy Act, does your bureau or office exempt the system of records (as allowed by the 

Privacy Act in certain circumstances) from the requirement to inform any person or other agency about any 

correction or notation of dispute made by the agency of any record that has been disclosed to the person or 

agency if an accounting of the disclosure was made? 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

This project does not share with parties external to Departmental Offices, but information processed using 

O365 products may be shared externally by individual Treasury IT users for other purposes associated with 

particular Treasury information systems. If an individual makes a request for an accounting, Treasury will 

search the O365 Outlook email application as part of the process of tracking external disclosures made using 

Outlook. Issues related to accounting for disclosures from Outlook would, however, be addressed in the 

PCLIA for the Treasury information system from which the information originated. For example, if 

HRConnect information was disclosed outside Treasury pursuant to a routine use, that disclosure may occur 

via email sent from a Treasury IT user’s Outlook account. That type of disclosure (and accounting for that 

disclosure) would be discussed in the HRConnect PCLIA. 

Statutory or Regulatory Restrictions on Disclosure 

Section 5.4(g) ☐ Yes ☒ No In addition to the Privacy Act, are there any other statutory or regulatory 

restrictions on the sharing of any of the PII maintained in the system or by the project (e.g., 26 U.S.C § 6103 

for tax returns and return information)? 

Some of the information processed using the O365 suite of products may be subject to specific statutory 

requirements. Those restrictions are discussed in the PCLIA for the appropriate system in which the 

Treasury IT user stores information processed using O365 products. 

Memorandum of Understanding Related to External Sharing 

Section 5.4(h) ☐ Yes ☐ No ☒ N/A Has Treasury (including bureaus and offices) executed a Memorandum 

of Understanding, or entered into any other type of agreement, with any external agencies, organizations, or 

individuals with which/whom it shares PII maintained in the system or by the project? 

This project does not share PII with parties external to Departmental Offices, but information processed 

using O365 products may be shared externally by individual Treasury IT users for other purposes that are 

addressed in the PCLIA for the system in which the information is actually used. 

Memorandum of Understanding Limiting Treasury’s Use or Disclosure of PII 

Section 5.4(i) ☐ Yes ☒ No Is any of the PII maintained in the system or by the project subject to the 

requirements of a Memorandum of Understanding or other agreement (e.g., agreement with another federal 

or state agency, an international agreement or treaty, or contract with private vendor that provided the 

information to Treasury or one of its bureaus) that limits or places conditions on Treasury’s internal use or 

external (i.e., outside Treasury) sharing of the PII? 

See the previous answer.
%

Memorandum of Understanding Limiting External Party’s Use or Disclosure of PII 

Section 5.4(j) ☐ Yes ☒ No Is any of the PII maintained in the system or by the project subject to the 

requirements of a Memorandum of Understanding or other agreement in which Treasury limits or places 

conditions on an external party’s use, maintenance, handling, or disclosure of PII shared by Treasury? 

See the previous answer.
%

External Information Sharing Chart 

This project does not share with parties external to Departmental Offices, but information processed using 

O365 products may be shared externally by individual Treasury IT users for other purposes that are 

addressed in the PCLIA for the system in which the information is actually used. 

Obtaining Consent Prior to New Disclosures Not Included in the SORN or Authorized 

by the Privacy Act 

Section 5.4(l) ☐ Yes ☒ No ☐ N/A Is the individual’s consent obtained, where feasible and appropriate, 

prior to any new disclosures of previously collected records in a system of records (those not expressly 

authorized by the Privacy Act or contained in the published SORN (e.g., in the routine uses))? 

See the answer to the previous question. 
 

 

 

 

 

 

 

 

 

Section 6: Compliance with federal information management 

requirements 

Responses to the questions below address the practical, policy, and legal consequences of 

failing to comply with one or more of the following federal information management 

requirements (to the extent required) and how those risks were or are being mitigated: (1) the 

Privacy Act System of Records Notice Requirement; (2) the Paperwork Reduction Act; (3) the 

Federal Records Act; (4) the E-Gov Act security requirements; and (5) Section 508 of the 

Rehabilitation Act of 1973. 

Section 6.1: Privacy Act System of Records Notice (SORN) 

For collections of PII that meet certain requirements, the Privacy Act requires that the agency 

publish a SORN in the Federal Register. 

System of Records 

Section 6.1(a) ☒ Yes ☐ No Does the system or project retrieve records about an individual using an 

identifying number, symbol, or other identifying particular assigned to the individual? (see items selected in 

Section 4.2 above) 

Section 6.1(b) ☒ Yes ☐ No ☐ N/A Was a SORN published in the Federal Register for this system of 

records? 

Records processed using O365 that are subject to the Privacy Act could include virtually every Treasury 

SORN. Please see the list of SORNs on the Treasury website for more information. 

Section 6.2: The Paperwork Reduction Act 

The PRA requires OMB approval before a Federal agency may collect standardized data from 10 

or more respondents within a 12 month period. OMB requires agencies to conduct a PIA (a 

Treasury PCLIA) when initiating, consistent with the PRA, a new electronic collection of PII for 

10 or more persons (excluding agencies, instrumentalities, or employees of the federal 

government). 

Paperwork Reduction Act Compliance 

Section 6.2(a) ☒ Yes ☐ No Does the system or project maintain information obtained from individuals and 

organizations who are not federal personnel or an agency of the federal government (i.e., outside the federal 

government)? 

Section 6.2(b) ☐ Yes ☒ No ☐ N/A Does the project or system involve a new collection of information in 

identifiable form for 10 or more persons from outside the federal government? 

Section 6.2(c) ☐ Yes ☐ No ☒ N/A Did the project or system complete an Information Collection Request 

(“ICR”) and receive OMB approval? 

Information is not collected by this project, but the O365 suite of products may be used by a Treasury IT user 

to collect information in the performance of their official duties with respect to another project or system. 

Please see the Treasury PCLIA site for specific types of information collections that might trigger this 

requirement. 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Section 6.3: Records Management - NARA/Federal Records Act Requirements 

Records retention schedules determine the maximum amount of time necessary to retain 

information in order to meet the needs of the project or system. Information is generally either 

disposed of or sent to the NARA for permanent retention upon expiration of this period. 

NARA Records Retention Requirements 

Section 6.3(a) ☒ Yes ☐ No Are the records used in the system or by the project covered by NARA’s 

General Records Schedules (“GRS”) or Treasury/bureau Specific Records Schedule (SRS)? 

Section 6.3(b) ☒ Yes ☐ No Did NARA approved a retention schedule for the records maintained in the 

system or by the project? 

Section 6.3(c) ☐ Yes ☐ No ☒ N/A If NARA did not approve a retention schedule for the records 

maintained in the system or by the project and the records are not covered by NARA’s GRS or 

Treasury/bureau SRS, has a draft retention schedule (approved by all applicable Treasury and/or Bureau 

officials) been developed for the records used in this project or system? 

NARA requirements for Treasury retention of email is seven years for non-Capstone positions and permanent 

retention for Capstone positions. 

Section 6.4: E-Government Act/NIST Compliance 

The completion of Federal Information Security Management Act (“FISMA”) Security 

Assessment & Authorization (SA&A) process is required before a federal information system 

may receive Authority to Operate (“ATO”). Different security requirements apply to National 

Security Systems. 

Federal Information System Subject to FISMA Security Assessment and Authorization 

Section 6.4(a) ☒ Yes ☐ No ☐ N/A Is the system a federal 

information system subject to FISMA requirements? 

Section 6.4(b) ☐ Yes ☒ No ☐ N/A Has the system or 

project undergone a SA&A and received ATO? 

Access Controls and Security Requirements 

Section 6.4(c) ☒ Yes ☐ No Does the system or project include access controls to ensure limited access to 

information maintained by the system or project? 

This project includes access controls to ensure limited access to the system. Treasury employs access 

controls that limit access to the Treasury system or IT that contains the O365 application. Microsoft is 

responsible for limiting access to any PII stored in the cloud. 

Security Risks in Manner of Collection 

Security Controls When Sharing Internally or Externally 

Section 6.4(d) ☐ Yes ☒ No In Section 4.3 above, you identified the sources for information used in the 

system or project and the method and manner of collection. Were any security, privacy, or civil liberties risks 

identified with respect to the manner in which the information is collected from the source(s)? 

Identifying security risks is the purpose of this project. 

Section 6.4(e) ☒ Yes ☐ No ☐ N/A Are all Treasury/bureau security requirements met in the method of 

transferring information (e.g., bulk transfer, direct access by recipient, portable disk, paper) from the Treasury 

project or system to internal or external parties? 

ATO in process. 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Monitoring of Individuals 

Section 6.4(f) ☒ Yes ☐ No Will this system or project have the capability to identify, locate, and monitor 

individuals or groups of people? 

Treasury system rules of behavior are applicable. 

Audit Trails 

Section 6.4(g) ☒ Yes ☐ No Are audit trails regularly reviewed for appropriate use, handling, and 

disclosure of PII maintained in the system or by the project inside or outside of the Department? 

Yes, audit trails will be reviewed in accordance with DO-910. 

Section 6.5: Section 508 of the Rehabilitation Act of 1973 

When Federal agencies develop, procure, maintain, or use Electronic and Information 

Technology (“EIT”), Section 508 of the Rehabilitation Act of 1973 (as amended in 1998) 

requires that individuals with disabilities (including federal employees) must have access and use 

(including privacy policies and directives as well as redress opportunities) that is comparable to 

that which is available to individuals who do not have disabilities. 

Applicability of and Compliance With the Rehabilitation Act 

Section 6.5(a) ☒ Yes ☐ No Will the project or system involve the development, procurement, maintenance 

or use of EIT as that term is defined in Section 508 of the Rehabilitation Act of 1973 (as amended in 1 998)? 

Section 6.5(b) ☐ Yes ☐ No ☒ N/A Does the system or project comply with all Section 508 requirements, 

thus ensuring that individuals with disabilities (including federal employees) have access and use (including 

access to privacy and civil liberties policies) that is comparable to that which is available to individuals who 

do not have disabilities? 

This project complies with Section 508 requirements. 

Section 7: Redress

Access Under the Freedom of Information Act and Privacy Act 

Section 7.0(a) ☒ Yes ☐ No Does the agency have a published process in place by which individuals may 

seek records under the Freedom of Information Act and Privacy Act? 

The Treasury/bureaus FOIA and PA disclosure regulations can be found at 31 C.F.R. Part 1, Subtitle A, 

Subparts A and C. 

Privacy Act Access Exemption 

Section 7.0(b) ☐ Yes ☒ No Was any of the information that is maintained in system of records and used in 

the system or project exempted from the access provisions of the Privacy Act? 

None of the records used in the project are exempt from the Privacy Act access requirements, but the records 

acquired or created using O365 may be exempt from certain Privacy Act requirements, depending on the 

system in which they are maintained. 

Additional Redress Mechanisms 

Section 7.0(c) ☐ Yes ☒ No With respect to information maintained by the project or system (whether or 

not it is covered by the Privacy Act), does the bureau or office that owns the project or system have any 

additional mechanisms other than Privacy Act and FOIA remedies (e.g., a customer satisfaction unit; a 

complaint process) by which an individual may request access to and/or amendment of their information 

and/or contest adverse determinations about denial of their rights, benefits, and privileges under federal 
 

 

programs (e.g., decisions about whether the individual will receive a financial benefit, get a clearance or 

access to a Treasury facility, obtain employment with Treasury)? 

No additional redress mechanisms are in place for this project. 
________________________________ 

Responsible Officials 

Timothy H. Skinner 

Bureau Privacy and Civil Liberties Officer 

Departmental Offices 

U.S. Department of the Treasury 

Approval Signature 

Timothy H. Skinner