SPIA Web Application Introduction

Privacy Impact Assessment What is SPIA? Security and Annual risk assessment program conducted at School/Center level to identify privacy and security risks in databases and applications

Why SPIA is Important? Helps ensure information entrusted to Penn is properly protected Need to understand: What data Penn has on its systems What risks exist in our environment How those risks can be reduced or even eliminated Trustees recognize the need to create data inventories in order to assess risks to Penn data

SPIA 2.0 – Goals Simplify the SPIA program Create one tool for inventory and risk assessment Provide ability to view data inventories Make risk assessment simpler, more flexible Raise awareness of controls/safeguards Make updates easier year-to-year Areas for improvement with the program

SPIA 2.0 - Web Application Automated assessments - no more spreadsheets/emails Role-based access controls allow for delegation of inventory creation Flexible approach to assessing controls and risk Populates selected information into an Executive Summary Data rolled over annually for easier updates Data will be stored in database to enable reporting

Administration “Asset” represents the item being assessed. “Inventory” represents a collection of related assets. “Departments/Units” represent subgroups within a School/Center created for the purpose of organizing data inventories.

Roles & Responsibilities Inventory Managers Create and edit inventories and assets within their Unit Multiple users available at this level View only those inventories and assets within their Department/Unit Assess/review all Department/Unit level assets for inclusion in an Executive Summary School/Center Administrator All of the above plus… Create Departments/Units Assign Inventory Managers Create an Executive Summary Push an Executive Summary and Final Inventory to InfoSec/Privacy A snapshot of the “Final” inventory will be taken annually at the time the School/Center submits it to InfoSec/Privacy.  

Roles & Responsibilities InfoSec/Privacy Manage controls list Manage School/Center Administrators View all School/Center Inventories/Executive Summaries Provide Responses to Submissions Create Reports

Organizational Structure

Process Submit Inventories and Executive Summary to InfoSec/Privacy Create and Assess Inventories of Assets Create Executive Summary Submit Inventories and Executive Summary to InfoSec/Privacy

Questions