DD FORM 2930, JUN 2017 PREVIOUS EDITION IS OBSOLETE. AEM Designer Page 1 of 9

PRIVACY IMPACT ASSESSMENT (PIA) 

PRESCRIBING AUTHORITY: DoD Instruction 5400.16, "DoD Privacy Impact Assessment (PIA) Guidance". Complete this form for Department of Defense 

(DoD) information systems or electronic collections of information (referred to as an "electronic collection" for the purpose of this form) that collect, maintain, use, 

and/or disseminate personally identifiable information (PII) about members of the public, Federal employees, contractors, or foreign nationals employed at U.S. 

military facilities internationally. In the case where no PII is collected, the PIA will serve as a conclusive determination that privacy requirements do not apply to 

system.

Blackboard Learning System

 1. DOD INFORMATION SYSTEM/ELECTRONIC COLLECTION NAME:

National Geospatial-Intelligence Agency

 2. DOD COMPONENT NAME:

10/24/19

3. PIA APPROVAL DATE:

National Geospatial-Intelligence College

SECTION 1: PII DESCRIPTION SUMMARY (FOR PUBLIC RELEASE)

 a. The PII is: (Check one. Note: foreign nationals are included in general public.)

From members of the general public ✖ From Federal employees and/or Federal contractors

From both members of the general public and Federal employees and/or 

Federal contractors Not Collected (if checked proceed to Section 4)

 b. The PII is in a: (Check one)

 New DoD Information System ✖ New Electronic Collection

 Existing DoD Information System Existing Electronic Collection

 Significantly Modified DoD Information System

Blackboard is a learning management system (LMS) used to deliver instructor-facilitated and web-based training solutions to NGA 

personnel (civilian, military, contractor), military services, other DOD Components, IC partners, and FVEY partners. The types of personal 

information collected are the individual's full name, employee identification number, business organization, business phone number, email 

addresses (business and personal), educational background, whether the individual is a government employee or a contractor, and their job 

position. Blackboard manages both mission and non-mission training records. 

 c. Describe the purpose of this DoD information system or electronic collection and describe the types of personal information about individuals 

 collected in the system.

PII is used for identity authentication, individual training verification, and administrative mission purposes. The intended use of PII involves 

professional development opportunities for potential career paths and data analytics, which is used by leadership for resource decisions and 

congressional reporting.

 d. Why is the PII collected and/or what is the intended use of the PII? (e.g., verification, identification, authentication, data matching, mission-related use, 

 administrative use)

 e. Do individuals have the opportunity to object to the collection of their PII? Yes ✖ No

 (1) If "Yes," describe the method by which individuals can object to the collection of PII.

 (2) If "No," state the reason why individuals cannot object to the collection of PII. 

Users do not have the opportunity to object to collection of PII since the PII is obtained from multiple attributes (internal systems) that are 

required for individual training verification. 

 f. Do individuals have the opportunity to consent to the specific uses of their PII? Yes ✖ No

 (1) If "Yes," describe the method by which individuals can give or withhold their consent.

 (2) If "No," state the reason why individuals cannot give or withhold their consent.

Users do not have the opportunity to consent to the specific use of their PII since it is required for individual training verification and the use 

of the career long learning programs for NGA personnel. 

 g. When an individual is asked to provide PII, a Privacy Act Statement (PAS) and/or a Privacy Advisory must be provided. (Check as appropriate and 

 provide the actual wording.)

✖ Privacy Act Statement Privacy Advisory Not Applicable 
DD FORM 2930, JUN 2017 PREVIOUS EDITION IS OBSOLETE. AEM Designer Page 2 of 9

PERSONAL DATA - PRIVACY ACT OF 1974 Information collected by, contained within, or extracted from Blackboard may contain 

Personally Identifiable Information (PII), and is for official use only. Should you receive any PII in error, please advise the sender 

immediately and promptly discard such information, in addition to immediately notifying the NGA Privacy and Civil Liberties Division 

(MOCP) of such unauthorized PII receipt. All unintended recipients are hereby advised that any use, inclusive of redistribution, copying or 

other form of unauthorized actions, is strictly prohibited. Please note that unauthorized dissemination or use of PII is a violation of Federal 

law. Individuals determined to be in violation may be subject to fines, disciplinary actions or both in accordance with applicable Federal law 

and/or NGA policy. (P.L. 93-579)

 h. With whom will the PII be shared through data exchange, both within your DoD Component and outside your Component? (Check all that apply)

✖ Within the DoD Component

Privileged users in the College, Tradecraft Offices and 

Career Service personnel to evaluate employee progress 

toward training goals.

 Specify.

Other DoD Components Specify.

Other Federal Agencies Specify.

State and Local Agencies Specify.

Contractor (Name of contractor and describe the language in 

the contract that safeguards PII. Include whether FAR privacy 

clauses, i.e., 52.224-1, Privacy Act Notification, 52.224-2, 

Privacy Act, and FAR 39.105 are included in the contract.)

 Specify.

Other (e.g., commercial providers, colleges). Specify.

 i. Source of the PII collected is: (Check all that apply and list all information systems if applicable)

✖ Individuals Databases

✖ Existing DoD Information Systems Commercial Systems

Other Federal Information Systems

 j. How will the information be collected? (Check all that apply and list all Official Form Numbers if applicable)

E-mail Official Form (Enter Form Number(s) in the box below)

Face-to-Face Contact Paper

Fax Telephone Interview

✖ Information Sharing - System to System Website/E-Form

✖ Other (If Other, enter the information in the box below)

 k. Does this DoD Information system or electronic collection require a Privacy Act System of Records Notice (SORN)? 

 

 A Privacy Act SORN is required if the information system or electronic collection contains information about U.S. citizens or lawful permanent U.S. residents that 

 is retrieved by name or other unique identifier. PIA and Privacy Act SORN information must be consistent.

✖ Yes No

 If "Yes," enter SORN System Identifier NGA 003 - Agency Enterprise Workforce 

 SORN Identifier, not the Federal Register (FR) Citation. Consult the DoD Component Privacy Office for additional information or http://dpcld.defense.gov/ 

 Privacy/SORNs/ 

 or

 If a SORN has not yet been published in the Federal Register, enter date of submission for approval to Defense Privacy, Civil Liberties, and Transparency 

 Division (DPCLTD). Consult the DoD Component Privacy Office for this date

 If "No," explain why the SORN is not required in accordance with DoD Regulation 5400.11-R: Department of Defense Privacy Program.
DD FORM 2930, JUN 2017 PREVIOUS EDITION IS OBSOLETE. AEM Designer Page 3 of 9

 l. What is the National Archives and Records Administration (NARA) approved, pending or general records schedule (GRS) disposition authority for 

 the system or for the records maintained in the system?

 (1) NARA Job Number or General Records Schedule Authority.

Record Collection Schedule 1001-03a - Cut off when superseded or obsolete; Destroy/delete 3 years after cutoff. General Record Schedule 

3.2-031 - Destroy 6 years after password is altered or user account is terminated, but longer retention is authorized if required for business 

use. GRS 5.1 -020 - Temporary Destroy immediately after copying to a record keeping system or otherwise preserving, but longer retention 

is authorized if required for business use.

 (3) Retention Instructions.

 (2) If pending, provide the date the SF-115 was submitted to NARA.

RCS1001-03a, GRS 3.2-0

Title 10 United States Code 442, Title 50 United States Code 3045 and Department of Defense Manual 3305.10. 

 m. What is the authority to collect information? A Federal law or Executive Order must authorize the collection and maintenance of a system of 

records. For PII not collected or maintained in a system of records, the collection or maintenance of the PII must be necessary to discharge the 

requirements of a statue or Executive Order. 

 

 (1) If this system has a Privacy Act SORN, the authorities in this PIA and the existing Privacy Act SORN should be similar. 

 (2) If a SORN does not apply, cite the authority for this DoD information system or electronic collection to collect, use, maintain and/or disseminate PII. 

 (If multiple authorities are cited, provide all that apply). 

 

 (a) Cite the specific provisions of the statute and/or EO that authorizes the operation of the system and the collection of PII. 

 

 (b) If direct statutory authority or an Executive Order does not exist, indirect statutory authority may be cited if the authority requires the 

 operation or administration of a program, the execution of which will require the collection and maintenance of a system of records. 

 

 (c) If direct or indirect authority does not exist, DoD Components can use their general statutory grants of authority (“internal housekeeping”) as 

 the primary authority. The requirement, directive, or instruction implementing the statute within the DoD Component must be identified.

 n. Does this DoD information system or electronic collection have an active and approved Office of Management and Budget (OMB) Control 

 Number? 

 

 Contact the Component Information Management Control Officer or DoD Clearance Officer for this information. This number indicates OMB approval to 

 collect data from 10 or more members of the public in a 12-month period regardless of form or format. 

Yes ✖ No Pending

Per DODM 8910.01" DoD Information Collection Manual: Procedures for DoD Public Information Collections" -Volume 2- para 8 (b) item 

#10, Comparable items as designated by OMB exclusion to regulatory of "information" under the Paperwork Reduction Act, # 4 (a) User 

Accounts: Items collected to create user accounts or profiles for agency websites. This category does not apply to information collected for 

programmatic purposes. 

 (1) If "Yes," list all applicable OMB Control Numbers, collection titles, and expiration dates. 

 (2) If "No," explain why OMB approval is not required in accordance with DoD Manual 8910.01, Volume 2, " DoD Information Collections Manual: 

 Procedures for DoD Public Information Collections.” 

 (3) If "Pending," provide the date for the 60 and/or 30 day notice and the Federal Register citation.
DD FORM 2930, JUN 2017 PREVIOUS EDITION IS OBSOLETE. AEM Designer Page 4 of 9

SECTION 2: PII RISK REVIEW

 a. What PII will be collected (a data element alone or in combination that can uniquely identify an individual)? (Check all that apply)

Biometrics Birth Date Child Information

Citizenship Disability Information ✖ DoD ID Number

Driver's License ✖ Education Information Emergency Contact 

✖ Employment Information Financial Information Gender/Gender Identification

Home/Cell Phone Law Enforcement Information Legal Status

Mailing/Home Address Marital Status Medical Information 

Military Records Mother's Middle/Maiden Name ✖ Name(s)

✖ Official Duty Address ✖ Official Duty Telephone Phone ✖ Other ID Number

Passport Information ✖ Personal E-mail Address Photo

Place of Birth ✖ Position/Title Protected Health Information (PHI)1

Race/Ethnicity ✖ Rank/Grade Religious Preference 

Records Security Information Social Security Number (SSN) (Full or in any 

form)

✖ Work E-mail Address If Other, enter the information in the box below

 If the SSN is collected, complete the following questions. 

 

 (DoD Instruction 1000.30 states that all DoD personnel shall reduce or eliminate the use of SSNs wherever possible. SSNs shall not be used in spreadsheets, 

 hard copy lists, electronic reports, or collected in surveys unless they meet one or more of the acceptable use criteria.) 

 

 (1) Is there a current (dated within two (2) years) DPCLTD approved SSN Justification on Memo in place? 

Yes No

If "Yes," provide the signatory and date approval. If “No,” explain why there is no SSN Justification Memo. 

 (2) Describe the approved acceptable use in accordance with DoD Instruction 1000.30 “Reduction of Social Security Number (SSN) Use within DoD”.

 (3) Describe the mitigation efforts to reduce the use including visibility and printing of SSN in accordance with DoD Instructoin 1000.30, “Reduction of 

 Social Security Number (SSN) Use within DoD”.

 (4) Has a plan to eliminate the use of the SSN or mitigate its use and or visibility been identified in the approved SSN Justification request? 

 

 If "Yes," provide the unique identifier and when can it be eliminated? 

 If "No," explain. 

Yes No

 b. What is the PII confidentiality impact level2? ✖ Low Moderate High

1The definition of PHI involves evaluating conditions listed in the HIPAA. Consult with General Counsel to make this determination. 

2Guidance on determining the PII confidentiality impact level, see Section 2.5 “Categorization of PII Using NIST SP 800-122.” Use the identified PII confidentiality impact level to apply the appropriate Privacy Overlay 

low, moderate, or high. This activity may be conducted as part of the categorization exercise that occurs under the Risk Management Framework (RMF). Note that categorization under the RMF is typically 

conducted using the information types described in NIST Special Publication (SP) 800-60, which are not as granular as the PII data elements listed in the PIA table. Determining the PII confidentiality impact level is 

most effective when done in collaboration with the Information Owner, Information System Owner, Information System Security Manager, and representatives from the security and privacy organizations, such as the 

Information System Security Officer (ISSO) and Senior Component Official for Privacy (SCOP) or designees.
DD FORM 2930, JUN 2017 PREVIOUS EDITION IS OBSOLETE. AEM Designer Page 5 of 9

 c. How will the PII be secured?

 (1) Physical Controls. (Check all that apply)

Cipher Locks Closed Circuit TV (CCTV)

Combination Locks ✖ Identification Badges

✖ Key Cards Safes

Security Guards If Other, enter the information in the box below

 (2) Administrative Controls. (Check all that apply)

✖ Backups Secured Off-site

✖ Encryption of Backups 

✖ Methods to Ensure Only Authorized Personnel Access to PII

✖ Periodic Security Audits

Regular Monitoring of Users' Security Practices

✖ If Other, enter the information in the box below

AWS GovCloud (US) is an isolated AWS Region designed to allow U.S. government agencies and customers to move sensitive workloads 

into the cloud by addressing their specific regulatory and compliance requirements. The AWS GovCloud (US) Region adheres to U.S. 

International Traffic in Arms Regulations (ITAR) requirements. The restricting of physical and logistical administrative accesses apply to 

U.S. citizens only. AWS GovCloud also provides FIPS 140-2 endpoints. (For details on each service, see the AWS GovCloud (US) 

Endpoints section.) 

 (3) Technical Controls. (Check all that apply) 

Biometrics ✖ Command Access Card (CAC) ✖ DoD Public Key Infrastructure Certificates

✖ Encryption of Data at Rest ✖ Encryption of Data in Transit ✖ External Certificate Authority Certificates

✖ Firewall Intrusion Detection System (IDS) Least Privilege Access

Role-Based Access Controls Used Only for Privileged (Elevated Roles) ✖ User Identification and Password

Virtual Private Network (VPN) If Other, enter the information in the box below

 d. What additional measures/safeguards have been put in place to address privacy risks for this information system or electronic collection?
DD FORM 2930, JUN 2017 PREVIOUS EDITION IS OBSOLETE. AEM Designer Page 6 of 9

SECTION 3: RELATED COMPLIANCE INFORMATION

 a. Is this DoD Information System registered in the DoD IT Portfolio Repository (DITPR) or the DoD Secret Internet Protocol Router Network 

 (SIPRNET) Information Technology (IT) Registry or Risk Management Framework (RMF) tool3?

Yes, DITPR DITPR System Identification Number

Yes, SIPRNET SIPRNET Identification Number

✖ Yes, RMF tool RMF tool Identification Number 65016

No

 If “No,” explain.

 b. DoD information systems require assessment and authorization under the DoD Instruction 8510.01, “Risk Management Framework for DoD 

 Information Technology”. 

 

 Indicate the assessment and authorization status:

✖ Authorization to Operate (ATO) Date Granted: 9/26/2019

ATO with Conditions Date Granted:

Denial of Authorization to Operate (DATO) Date Granted:

Interim Authorization to Test (IATT) Date Granted:

The National Geospatial-Intelligence College, which partners with the NGA Chief Information Officer-IT Services Directorate (CIO-T) and 

Blackboard LMS are working towards meeting the security requirements mandated to achieve moderate level FedRAMP certification. 

Estimated date of completion is forthcoming. 

 (1) If an assessment and authorization is pending, indicate the type and projected date of completion.

 (2) If an assessment and authorization is not using RMF, indicate the projected transition date.

 c. Does this DoD information system have an IT investment Unique Investment Identifier (UII), required by Office of Management and Budget (OMB) 

 Circular A-11? 

Yes ✖ No

 If "Yes," Enter UII If unsure, consult the component IT Budget Point of Contact to obtain the UII 
DD FORM 2930, JUN 2017 PREVIOUS EDITION IS OBSOLETE. AEM Designer Page 7 of 9

 

3

Guidance on Risk Management Framework (RMF) tools (i.g., eMASS, Xacta, and RSA Archer) are found on the Knowledge Service (KS) at https://rmfks.osd.mil.
DD FORM 2930, JUN 2017 PREVIOUS EDITION IS OBSOLETE. AEM Designer Page 8 of 9

SECTION 4: REVIEW AND APPROVAL SIGNATURES 

 

Completion of the PIA requires coordination by the program manager or designee through the information system security manager and privacy representative at 

the local level. Mandatory coordinators are: Component CIO, Senior Component Official for Privacy, Component Senior Information Security Officer, and 

Component Records Officer. 

Russell W. Christensen a. Program Manager or 

 Designee Name (1) Title Team Lead, Learning Technology

 (2) Organization National Geospatial-Intelligence College 571-557-5832 (3) Work 

 Telephone

 (4) DSN russell.w.christensen@coe.ic.gov 

russell.w.christensen@nga.mil (5) E-mail address

 (6) Date of Review (7) Signature

 b. Other Official (to be 

 used at Component 

 discretion) 

 (1) Title

 (2) Organization (3) Work 

 Telephone

 (4) DSN (5) E-mail address

 (6) Date of Review (7) Signature

Jessica Dwyer-Moss

 c. Other Official (to be 

 used at Component 

 discretion) 

 (1) Title Assistant General Counsel 

 (2) Organization Office Of General Counsel (OGC) 571-558-4805 (3) Work 

 Telephone

 (4) DSN (5) E-mail address Jessica.R.DwyerMoss@coe.ic.gov

 (6) Date of Review (7) Signature

Terrance Reeves d. Component Privacy 

 Officer (CPO) (1) Title Chief Privacy Officer

 (2) Organization Mission Oversight and Compliance (MOC) 571-558-7641 (3) Work 

 Telephone

 (4) DSN (5) E-mail address Terrance.J.Reeves@coe.ic.gov

 (6) Date of Review (7) Signature
DD FORM 2930, JUN 2017 PREVIOUS EDITION IS OBSOLETE. AEM Designer Page 9 of 9

Robert W. Milford e. Component Records 

 Officer (1) Title Agency Records Officer

Information Management Division , 

Records Management Program (SISM) (2) Organization 571-557-7729 (3) Work 

 Telephone

 (4) DSN (5) E-mail address robert.w.milford@coe.ic.gov

 (6) Date of Review 30 October 2019 (7) Signature

Reginald Stevenson

 f. Component Senior 

 Information Security 

 Officer or Designee 

 Name

 (1) Title Delegated Authorizing Official

 (2) Organization CIO-T/TSR Risk Management 314-676-6648 (3) Work 

 Telephone

 (4) DSN (5) E-mail address Reginald.L.Stevenson@coe.ic.gov

 (6) Date of Review: (7) Signature

Kevin Cichetti

 g. Senior Component 

 Official for Privacy 

 (SCOP) or Designee 

 Name

 (1) Title Senior Component Official for Privacy (SCOP)

 (2) Organization Mission Oversight and Compliance 571-557-0777 (3) Work 

 Telephone

 (4) DSN (5) E-mail address kevin.p.cichetti@coe.ic.gov

 (6) Date of Review (7) Signature

Susan J. Shuback

 h. Component CIO 

 Reviewing Official 

 Name

 (1) Title Associate Chief Information Officer (CIO)

 (2) Organization Associate Chief Information Officer (CIO) 571-558-1424 (3) Work 

 Telephone

 (4) DSN (5) E-mail address susan.j.shuback@coe.ic.gov

 (6) Date of Review (7) Signature

 

Publishing: Only Section 1 of this PIA will be published. Each DoD Component will maintain a central repository of PIAs on the Component's public Web site. 

 DoD Components will submit an electronic copy of each approved PIA to the DoD CIO at: osd.mc-alex.dod-cio.mbx.pia@mail.mill. 

 

 If the PIA document contains information that would reveal sensitive information or raise security concerns, the DoD Component may restrict the 

 publication of the assessment to include Section 1.