Privacy Impact Assessment 

for

Business Information System (BIS) 

October 6, 2020

System/Business Owner

Melody Chang

Reviewing Official 

Charles Cutshall

Chief Privacy Officer
Page 1 of 8

 SYSTEM OVERVIEW 

1) Describe the purpose of the system/collection:

The Commodity Futures Trading Commission’s (“CFTC” or “Commission”) Financial 

Management Branch (FMB) and Office of Financial Management (OFM) use the Business 

Information System (BIS) in the preparation of budget requests and submissions. FMB 

prepares budget requests for resources required by each division and outlines how the CFTC 

intends to spend its Congressionally-approved appropriation during a given fiscal year. OFM

formulates budgets for biannual submission to the Office of Management and Budget and 

Congress.

In order to account for payroll data in budget submissions, BIS receives salary-related 

information for all CFTC staff via an automated flat file downloaded from the National Finance 

Center (NFC) on a weekly basis.

2) Provide a data map or model illustrating how information is structured or is processed by the 

system throughout its life cycle. Include a brief description of the data flows. 

1. Salary-related information for all CFTC staff is automatically received on a weekly basis 

from NFC via secure transfer and stored in the Amazon Web Service (AWS) cloud. The 

NFC file is then uploaded onto a segregated BIS database within the Oracle EPM cloud.

2. FMB and OFM end users access information using the BIS application.
Page 2 of 8

 AUTHORITY AND PURPOSE

1) What is the legal authority to collect, use, maintain, and share information in the system?

GPRA Modernization Act (formerly Government Performance and Results Act)

Office of Management and Budget (OMB) Circular A-11 “Preparation, Submission and 

Execution of the Budget”

Budget and Accounting Act

Congressional Budget Act

Balanced Budget and Emergency Deficit Control Act, as amended (BBEDCA)

INFORMATION TYPES

1) What information relating to CFTC employees will be collected, maintained, used, and/or 

disseminated? 

Identifying Numbers

☐ Student ID Number ☐ Health Plan Beneficiary Number

☐ Passport Number ☐ Federal Student Aid Number

☒ Employee Identification Number ☐ Taxpayer Identification Number

☐ Professional License Number ☐ Legal Entity Identifier

☐ Credit/Debit Card Number ☐ National Futures Association ID

☐ Personal Bank Account Number ☐ Other ID if it can be traced back to an 

individual

☐ Personal Device Identifiers or Serial Numbers

Contact Information

☐ Personal Mobile Number ☐ Business Phone Number

☐ Personal E-mail Address ☒ Business E-mail Address

☐ Home Phone Number ☐ Personal or Business Fax Number

☐ Home Mailing Address ☐ Business Mailing Address

Sole Proprietors

☐ Business Taxpayer Identification Number ☐ Business Mailing Address

☐ Business Credit Card Number ☐ Business Phone or Fax Number

☐ Business Bank Account Number ☐ Business Mobile Numbers

☐ Business Device identifiers or Serial Numbers

Biographical Information

☒ Name ☐ Gender

☐ Date of Birth ☐ City or County of Birth

☐ Country of Birth ☐ Zip Code

☐ Citizenship ☐ Military Service Information

☐ Spouse Information ☐ Academic Transcript

☐ Group/Org. Membership ☐ Resume or Curriculum Vitae

☒ Location Data (i.e., regional office) ☐ Nationality
Page 3 of 8

☒ Employment Information ☐ Marital Status

☐ Mother’s Maiden Name ☐ Children Information

☒ Other: Employee Income Information

Biometrics/Distinguishing Features/Characteristics

☐ Fingerprints ☐ Height

☐ Retina/Iris Scans ☐ Voice/Audio Recording

☐ Hair Color ☐ Eye Color

☐ Video Recording ☐ Photos

☐ Weight ☐ Signatures

2) What information relating to BIS users will be collected, maintained, used, and/or 

disseminated? 

Active Directory/Device Information

☒ IP Address ☐ MAC Address

☐ CFTC Asset Number ☐ Device Identifiers or Serial Numbers

☒ User Name ☒ Log data

Contact Information

☒ Business E-mail Address

 COLLECTING INFORMATION

1) How is the information in this system collected?

CFTC Employee Information:

CFTC employee information from NFC includes: Name, Federal Accession Date, CFTC 

Accession Date, Series Pay Plan, Base Salary, Locality Code, Standard Pay Period Hours, 

Appointment Type, Retirement Code Type, Date within Grade, and Full Performance Level. 

The collection of this information is automated via a flat file transferred from the NFC to the

AWS cloud and from there loaded into the Salary database within the Oracle EPM Cloud. BIS 

receives data files each week, alternating between a flat file that contains full NFC salary 

information for the previous two-week pay period and an adjustment the following week. 

The entire process is scheduled, maintained, and executed via an Extract, Transform, and 

Load (ETL) process run in Oracle Data Integrator (ODI). 

BIS User Information:

Business email addresses are collected from users during the account approval and creation 

process. Users are required to fill out a User Access Request form (UAR) that includes the

request for business email (ending in @cftc.gov). The UAR must be reviewed and signed by 

three parties: the user, a business manager, and a representative from OFM. Once the form 

is signed, reviewed, and loaded to the SharePoint UAR repository, BIS administrators create 

the user account using the business email and assign a username. 
Page 4 of 8

INFORMATION USE 

1) Will information in the system be retrieved using one or more of the data elements listed in

Section III?

CFTC Employee Information:

No, information cannot be searched or retrieved using an employee’s name or other personal 

identifiers. Information is only displayed alphabetically by name. 

BIS User Information:

Yes, the list of end users and action logs can be searched and filtered by username or 

employee name.

2) If the information in the system is retrieved using one or more of the identifiers, what CFTC 

System of Records Notice (SORN) covers the information?

Information retrieved about BIS users is covered by CFTC-35, General Information Technology 

Records. 

ACCESS AND SHARING

1) With which internal CFTC Offices or Divisions is the information shared? For each Office or 

Division, what information is shared and for what purpose?

CFTC Employee Information:

CFTC employee information is stored exclusively in the Salary Module of the Oracle EPM 

Cloud. Only specific FMB users with a business need are authorized to view employee names

and other personal information stored in the Salary Module. Other CFTC offices and divisions 

do not have access to the Salary Module. 

BIS User Information:

BIS user information is only visible to system administrators with access to the Shared 

Services module for user authentication and management. 

2) How is the information shared internally?

FMB users with a business need, as defined by the system administrator, are able to access 

the information via the web interface. 

3) With which external organization(s) is the information shared?
Page 5 of 8

CFTC Employee Information:

CFTC employee information is notshared outside of the Salary Module within the Oracle EPM 

Cloud. 

BIS User Information:

BIS user information is not shared outside of the Shared Services Module within the Oracle 

EPM Cloud. 

4) How is the information shared externally?

AWS and Oracle will provide routine server-level support and maintenance functions but will 

not have access to data residing within BIS.

TRANSPARENCY

1) How are individuals notified as to how their information will be collected, used, and/or 

shared within this system? 

This assessment provides notice of how CFTC employee information is collected and 

processed by BIS. BIS users are notified when logging in to the system that their activity will 

be monitored.

2) Is a SORN is required? If so, explain how the use of the information in this system is limited 

to the use specified in the SORN?

Retrieval of BIS user information is covered by CFTC-35, General Information Technology 

Records. 

INDIVIDUAL PARTICIPATION 

1) Is the information collected directly from the individual?

CFTC Employee Information:

No, CFTC employee information is collected from the NFC.

BIS User Information:

Yes, this information is collected directly from the user via the UAR Form. 

2) Is the collection mandatory or voluntary? If voluntary, what opportunities do the 

individuals have to decline to provide information?

CFTC Employee Information:

Use of CFTC employee information is mandatory and is required to formulate and prepare 

budget requests. 
Page 6 of 8

BIS User Information:

The collection of BIS user information is mandatary in order to access the application. 

3) Do individuals have an opportunity to consent to a particular use of the information? If so, 

how do they provide consent for a particular use?

No.

 DATA MINIMIZATION 

1) What steps were taken to minimize the collection of PII in the system?

Data fields and values within the system are collected via source systems external to BIS. BIS 

developers specifically map and load data fields into the application containing only the 

personal information necessary for FMB and OFM to complete their mission.

DATA QUALITY AND INTEGRITY 

1) How is data quality ensured throughout the information lifecycle and business processes 

associated with the use of the information?

☐ Cross referencing data entries with other systems

☐ Third party data verification

☐ Data taken directly from individuals

☐ Character limits on text submissions

☐ Numerical restrictions in text boxes

☒ Other: Information maintained in the system is refreshed weekly, ensuring the accuracy 

of the information over time.

RETENTION 

1) What are the retention periods for the information?

Information related to CFTC employees will be retained for two years after the close of the 

fiscal year to which the records relate, but longer retention is authorized if required for 

business. This retention period derives from General Records Schedule 1.3, Item 040, Budget 

Preparation Background Records.
Page 7 of 8

SECURITY 

1) What types of administrative safeguards protect the information?

☒ Contingency Plan

☒ User manuals for the system

☐ Rules of Behavior

☐ Non-Disclosure or other contractual agreement

☐ Other:

2) What types of physical safeguards protect the information?

☐ Guards

☐ Identification Badges 

☐ Biometric

☐ Cameras

☐ Physically secured space with need to know access

☐ Other: 

3) What types of technical safeguards protect the information?

☒ User Identification

☒ Firewall 

☒ Virtual Private Network (VPN)

☐ Multi-factor Authentication (MFA)

☒ Passwords

☐ Encryption

☐ De-Identification

☐ Anonymization

☐ Other: 

4) What monitoring, recording, and auditing safeguards are in place to prevent or detect 

unauthorized access or inappropriate use of the information?

The firewall and VPN safeguards placed on the networking layer allow for the prevention and 

detection of unauthorized attempts to access the Oracle EPM Cloud. The only traffic allowed 

to make requests to the Oracle EPM cloud is that from the specific CFTC VPN Source IP 

address. All events and actions in BIS are logged. Logs are viewable by system administrators.

5) Is this system hosted by a Cloud Service Provider (CSP)? Yes

a. If yes, which one? Yes, AWS and Oracle EPM Cloud 

b. If yes, has the system obtained a FedRAMP Authorization? Yes
Page 8 of 8

TRAINING 

1) What privacy training is provided to users of the system?

All BIS end users are employees of the CFTC, and annual privacy and cybersecurity training is 

mandatory for all CFTC staff. In addition, the BIS system administrator is responsible for 

documenting and monitoring BIS-specific user training, including role-based security training,

for the BIS system.