Documenting NASA Forms in PCAT

2 What is an IPTA?  An Initial Privacy Threshold Analysis records general information about a collection and determines if the collection requires a PIA or is subject to any other collection laws.  ITS-HBK : “An IPTA is required for all new collections, applications, websites, and/or systems as well as all pre-existing collections, applications, websites, and/or systems that have not been previously assessed.”

3 IPTA – Initial Registration General identification information

4 IPTA – Initial Registration Be very clear and specific when providing an overview for question It should be extremely clear to someone outside of your organization, or outside of NASA, to understand exactly what the form does for your office, mission, or center. Do not use uncommon acronyms or jargon. Examples: Not good: Contractor reporting of estimated and incurred costs Good: The NASA Contractor Financial Management Report is the basic financial medium for contractor reporting of estimated and incurred costs, providing essential data for projecting costs and hours to ensure that contractor performance is realistically planned and supported by dollar and labor resources. The data provided by these reports is an integral part of the Agency accrual accounting and cost-based budgeting systems required under 31 U.S.C

5 IPTA – Initial Registration See NIST Special Publication Volume II for the entire list and description of types of federal information. *Recommend opening the Publication and doing “ctrl+f” to search for a specific information types. Contact Marion Meissner or Angela Vazzana if you have any questions.

6 IPTA – Initial Analysis Provide citation for why the information must be protected. If you are unsure, enter “e-Government Act, Federal Information Security Management Act (FISMA),” as that applies to all federal information. *Note that the Privacy Act is not necessarily the answer simply because your collection contains privacy data! See Privacy Act slide for more details.

7 IPTA – Initial Analysis These questions determine what other privacy or collection laws apply and which PCAT modules are triggered. See next slides…

8 Privacy Act  2.3 Records on individuals are or will be routinely retrieved from the system by using individual's name or other unique identifier (e.g., personal account number, UUPIC, SSN, etc. is used to locate information about an individual in the application/website/information system/paper record). In other words, if you routinely (as part of normal business processes) enter a unique identifier (name, UUPIC, address, etc.) to pull up more records about an individual, then the answer should be yes. If you have the capability of using a unique identifier (name, UUPIC, address, etc.) to pull up more records about an individual, but you do not do it routinely (as part of normal business processes), the answer should be no. If yes, the collection is considered a System of Records and is subject to the Privacy Act of The collection requires a System of Records Notice. NASA Privacy Act Officer: Patti Stockman

9 Paperwork Reduction Act  2.5 The record/application/website/information system collects information (PII, IIF or any other information), in a standard way (via forms, surveys, questionnaires, etc.), from 10 or more persons (e.g., members of the public, NASA contractors, grantees or other). If yes, the collection may be subject to the Paperwork Reduction Act (PRA). Continue to the PRA module in PCAT to determine what actions should be taken. NASA PRA Officer: Fran Teel

10 Federal Records  2.6 The system contains Federal Records. This will almost always be Yes. If yes, continue to the Records Management module in PCAT to list the Records Retention Schedule. NASA HQ Records Manager: Pat Southerland

11 Privacy Impact Assessment (PIA)  Three reasons why a collection may require a PIA: 1.The collection contains information in identifiable form (IIF)* from members of the public – this may apply to NASA forms. 2.The collection is subject to the Paperwork Reduction Act – this may apply to NASA forms. 3.The collection is conducted using a third party application/website – this will not apply to NASA forms. *Information in Identifiable Form (IIF) is “is information in an IT system or online collection: (i) that directly identifies an individual (e.g. name, address, social security number or other identifying number or code, telephone number, e ‐ mail address, etc.) or (ii) by which an agency intends to identify specific individuals in conjunction with other data elements, i.e., indirect identification. (These data elements may include a combination of gender, race, birth date, geographic indicator, and other descriptors).” (OMB Memorandum 03-22). In other words, it is electronic PII that can be narrowed down to one individual.

12 Tips for Submitting Your IPTA  Answer all questions in complete sentences, free of jargon or uncommon acronyms (e.g., “NASA” is acceptable; “ARMD” is not).  Answer questions in a manner that would be clear to a person who has never heard of your form (i.e., a non-NASA employee).  Where possible, use the comment box to explain your response using clear language.  Click on the orange “?” icon located next to each question number for additional information about the question. Using these tips will reduce the amount of effort and follow-up actions needed after your IPTA is initially submitted!