1. Presentation at HSPD-12 Workshop Ms. Jeanette Thornton May 4, 2005

2. OMB’s Oversight Effort Develop Implementation Guidance (currently out for public Comment) Address policy issues Support implementation plan template Ensure consistent implementation Oversee of GSA’s acquisition/SmartBuy Activities

3. DateDeliverable 2-25-05Final standard released 6-27-05 Agencies have completed implementation plan 8-27-05 Provide list of other applications to HSC and OMB 10-27-05 You must use IDs meeting the standard to access facilities and info systems. Directive Schedule

4. Implementation Guidance Outline 1.To whom does the directive apply? 2.What is the schedule for implementing the directive? 3.How should I implement the directive? 4.What acquisition services are available? 5.How must I consider privacy in implementing the directive? 6.What is the relationship to NS Systems? 7.Is there anything else I must consider or know?

5. Defining Success GSA must play a strong role –Establish strong service providers –Make implementation easier –Reduce cost through aggregation Definitions and phasing of OMB’s guidance. Collaboration between agencies, and within agencies

6. Where your assistance is needed? Identify gaps where cross agency coordination is needed Provide forum for sharing of ideas Seek agency commitment Provide a “can do” attitude

7. Privacy Requirements and HSPD-12 Jeanette Thornton Eva Kleederman Information Policy and Technology Branch

8. What about privacy? Privacy should not be viewed as an after thought!!! –Member of your team Must tackle the key issues early in the process –What is the purpose of the system? –What are the routine uses? –What information is shared between agencies?

9. What about Privacy? Build on existing law and OMB policy –Ensure privacy documentation is developed early in the process –Minimal data stored on the card and collected during card issuance –Require a PIA to analyze key privacy questions –Limited to strict set of control objectives

10. DRAFT Privacy Deliverables for 10/27 Updated System of Records Notice (or new) Privacy Impact assessment Provide Notice OMB PRA approval (if using new form) Keep to control objectives