PRIVACY IMPACT ASSESSMENT

SYSTEM OR APPLICATION NAME: Agency Enterprise General Information System (AEGIS) 

DATE: September 15, 2010 

SYSTEM OWNER & TITLE: Lester Peñaranda 

Chief of Infrastructure Services 

CONTACT POINT Lester Peñaranda 

Chief of Infrastructure Services 

ORGANIZATION: Infrastructure Services 

Bureau of Information Services 

U.S. Railroad Retirement Board 

844 North Rush Street 

Chicago, Illinois 60611-2092 

REVIEWING OFFICIAL NAME & TITLE Patricia Henaghan 

Chief, Information Resources Management Center 

ORGANIZATION: Information Resources Management Center 

Bureau of Information Services 

U.S. Railroad Retirement Board 

844 North Rush Street 

Chicago, Illinois 60611-2092 

PRIVACY IMPACT ANALYSIS - PAGE 1 OF 4 G-514 (7-09) 
PRIVACY IMPACT ANALYSIS - PAGE 2 OF 4 G-514 (7-09) 

SYSTEM OR APPLICATION NAME: Agency Enterprise General Information System (AEGIS) 

DATE: SEPTEMBER 15, 2010 

Overview 

The RRB Agency Enterprise General Information System (AEGIS) is our information system that provides 

mainframe, application hosting, network and personal computer management services for all organizations of 

the Railroad Retirement Board. 

AEGIS hosts our major applications, each of which has its own Privacy Impact Assessment. Our major 

applications are: 

1. Benefit Payment Operations 

2. Financial Interchange 

3. Financial Management 

4. Palmetto GBA (Contractor System) 

Section 1.0 – The Nature of the Information in AEGIS and Its Source. 

AEGIS does not itself collect, use, or maintain information about the public, rather it provides the baseline 

network services, operating platforms and storage systems to host the applications that do work with this 

sensitive information. 

Section 2.0 – The Uses of the Information. 

While AEGIS does not directly use any sensitive information, it does provide the necessary support structure 

to allow our major applications to use this information to provide benefit services to our clients. 

Section 3.0 – Retention of Information 

We use AEGIS to store our electronic information that is necessary to support our major applications. We 

base our need to retain information on what is required to provide the service for which it is collected. The 

National Records and Archives Administration reviews and approves our retention schedules. When the 

information is no longer required, we securely dispose of it. 

Section 4.0 – Internal Sharing and Disclosure of Information 

Sensitive information that AEGIS stores on behalf of the major applications it supports is shared internally 

only to those authorized RRB staff members that have a valid business requirement for it. We have 

established security and privacy policies and procedures, awareness training programs and rules that our 

staff must follow when using our systems and accessing sensitive data. Our rules also cover what is required 

to disclose information and the penalties for improper disclosure. 

Section 5.0 – External Sharing and Disclosure 

We may disclose sensitive information that a major application stores on AEGIS to authorized parties. Our 

Privacy Act Systems of Records Notices list who those parties are and under what routine uses we may 

disclose that information. 
PRIVACY IMPACT ANALYSIS - PAGE 3 OF 4 G-514 (7-09) 

SYSTEM OR APPLICATION NAME: Agency Enterprise General Information System (AEGIS) 

DATE: SEPTEMBER 15, 2010 

Section 6.0 – Notice 

We publish our Privacy Act Systems of Records Notices both in the Federal Register and on our web site 

(http://www.rrb.gov/bis/privacy_act/SORNList.asp). 

These notices explain: 

• What system collects and uses the information; 

• What information is collected; 

• Under what routine uses we may release that information; 

• How we store, retrieve, retain and safeguard that information; 

• What RRB official is the manager of that system; 

• The procedures to follow if you want to see or request corrections made to any information that 

system may have about you. 

We also publish a Privacy Act Notice and a Paperwork Reduction Act Notice on any form that we use to 

collect personal information from you. 

Section 7.0 – Individual Access and Redress 

Anyone whose personal information is stored on AEGIS system has the right to review and correct that 

information, as provided under the Privacy Act and described in our Systems of Records Notices, published 

on our web site (http://www.rrb.gov/bis/privacy_act/SORNList.asp). 

Section 8.0 – Technical Access and Security 

We provide in-depth defense for the AEGIS system by utilizing multiple technologies, trained specialists and 

agency policies and procedures. We secure our information systems in accordance with Federal Information 

Security Management Act requirements and following National Institute of Standards and Technology 

guidance. The AEGIS was certified and accredited for use in August 2010. 

All of our employees and contractors are required to have initial and annual refresher security and privacy 

training. Depending on the system a staff member has access to, they may be required to take specialized 

security and privacy training before granted access. 

Section 9.0 – Technologies Used by the AEGIS System 

AEGIS uses commercial off the shelf technology to store and transport information to and from the major 

applications that we host on the system. We carefully consider security and privacy factors when selecting 

components and technologies for our information systems. Privacy and Security staff review all information 

system proposals in accordance with the E-Government Act of 2002 (Public Law 107-347) and Office of 

Management and Budget directives. 
PRIVACY IMPACT ANALYSIS - PAGE 4 OF 4 G-514 (7-09) 

Conclusion 

The Agency Enterprise General Information System (AEGIS) is the backbone that all of our agency 

information systems use. While the AEGIS itself does not specifically process information, including sensitive 

information that we may have about you, it does host those major applications that do, along with providing 

the network for them to communicate with one another. We take our obligation seriously to protect the data 

that we use to provide benefit services to our railroad workers. We do this by complying with Federal 

information and privacy laws, directives and guidance; by providing technical network defenses in depth; and 

by having established management and operational controls in place to manage our information systems. 

Certification of Responsible Officials 

Preparer Signature & Title 

Lester Peñaranda 

Chief of Infrastructure Services 

Bureau of Information Services 

System Owner Signature 

Lester Peñaranda 

Chief of Infrastructure Services 

Bureau of Information Services 

Approved Signature & Title 

Patricia Henaghan 

Chief, Information Resources Management Center 

Bureau of Information Services 

PTA Control Number PTA-20100727-001 

PIA Control Number PIA-20100915-001