E-Library_NPR_1382_001B_.pdf

| NODIS Library | Organization and Administration(1000s) | Search |

NASA

Procedural Requirements

NPR 1382.1B

Effective Date: July 26, 2022

Expiration Date: July 26, 2027

COMPLIANCE IS MANDATORY FOR NASA EMPLOYEES

NASA Privacy Procedural Requirements

Responsible Office: Office of the Chief Information Officer

NAII 1382.1, NASA Privacy Program Plan

NAII 1382.2, NASA Continuous Monitoring Plan

Table of Contents Change Log

Preface P.1 Purpose P.2 Applicability P.3 Authority P.4 Applicable Documents and Forms P.5 Measurement/Verification P.6 Cancellation

Chapter 1. Privacy Management

1.1 Overview

1.2 Roles and Responsibilities

Chapter 2. Identify

2.1 Overview

2.2 Inventory

2.3 Privacy Threshold Analyses (PTA) and Privacy Impact Assessments (PIA)

Chapter 3. Govern

NPR 1382.1B -- TOC

This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 1382.1B -- TOC Page 1 of 64

3.1 Overview

3.2 Awareness and Training

3.3 Privacy Accountability

3.4 Privacy Complaints

3.5 Privacy Consequences

3.6 Privacy Redress and Privacy Act Information Requests

3.7 Privacy Rules of Behavior

3.8 Risk Management Strategy

Chapter 4. Control

4.1 Overview

4.2 Collection of Personally Identifiable Information (PII) and sensitive PII

Chapter 5. Communicate

5.1 Overview

5.2 Computer Matching Agreements

5.3 Children's Online Privacy Protection Act Notice

5.4 Privacy Act Statements

5.5 Privacy Act System of Records Notices

5.6 Privacy Notice

5.7 Web Measurement and Customization Technology Use and Notice

Chapter 6. Protect

6.1 Overview

6.2 Privacy and Information Security

6.3 Privacy Incident Response and Management

Appendix A. Definitions Appendix B. Acronyms Appendix C. Requirements Matrices

NPR 1382.1B -- TOC

This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 1382.1B -- TOC Page 2 of 64

Change Log

Change # Approver Date Approved Description/Comments

1 CPO 10/11/2024

Throughout the text:

Administrative updates were made throughout the text to use OCIO transformation terminology for personnel formerly known as center privacy managers (CPMs) to agency privacy managers (APMs).

Clarified and revised lettering and numbering of paragraphs.

2 CPO 10/11/2024

In P.4:

Updates were made to reference the documents currently in effect, while the those rescinded were edited out.

Formal references of privacy and other handbooks were updated to reflect current titles.

3 CPO 10/11/2024

In 1.1:

Updates were made to clarify identify function as outlined in the risk management framework.

4 CPO 10/11/2024

In 1.2.2.5:

Added CPO's responsibility to review and approve PIAs and ensure that program managers have completed privacy-related information.

5 CPO 10/11/2024

Throughout the text:

Updates were added to reflect NASA OCIO transformation process agency-centered approach.

APMs' roles were updated to reflect such approach.

6 CPO 10/11/2024

Added the reference to Paperwork Reduction Act and Paperwork Reduction Act Officer since it became part of CPO's area of responsibility.

7 CPO 10/11/2024

In 2.2:

Changes were made to reiterate SAOP's authority /to establish and maintain the NASA Master Privacy Information Inventory (MPII).

NPR 1382.1B -- ChangeLog This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 1382.1B -- ChangeLog Page 3 of 64

8 CPO 10/11/2024

In 2.3.2.2:

Updates were made to edit out the role of Center CISO in ensuring when a PIA or PTA are warranted for application, websites, and information systems. It also aligns with the reformed roles of the Center CISOs.

9 CPO 10/11/2024

In 2.3.2.3:

Further clarifications were made to stress APMs' responsibility to review the PTA & PIAs on information collections to ensure ISO has adequately addressed information protected under the Privacy Act.

CPO 10/11/2024

Throughout:

The reference(s) to ITS-HBK-1382.09-01, Rules of Behavior was edited out in favor of the NASA Cybersecurity and Privacy Rules of Behavior document (NAII 2540.1) now in NAMS and available to every NASA user to sign then revalidate annually.

CPO 10/11/2024

Included:

A reference was added to OMB M-24-11, Advancing Governance, Innovation, and Risk Management for Agency Use of Artificial Intelligence.

CPO 10/11/2024

Throughout:

Edited out the references to the following Privacy handbooks as rendered redundant and overtaken by revised handbooks and documents:

ITS-HBK-1382.07-01,

Privacy Awareness and Training

ITS-HBK-1382.08-01,

Privacy Accountability

ITS-HBK-1382.09-01,

Privacy Rules of Behavior

NPR 1382.1B -- ChangeLog This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 1382.1B -- ChangeLog Page 4 of 64

CPO 10/11/2024

Privacy and Awareness section was updated to reflect findings/recommendations of the NASA Inspector General and GAO pertaining to breach response training. Namely:

NASA requires core BRT members to participate in an incident response assessment (IRA) when a tabletop exercise or actual breach response activity has not been conducted.

Added a definition for Incident Response Assessment (IRA).

Clarified the definition of the breach, an incident endangering the integrity of an information system violation of policies and security protocols centering around the collection and protection of the PII.

14 2/3/25 Administrative edits made to comply with executive actions.

NPR 1382.1B -- ChangeLog This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 1382.1B -- ChangeLog Page 5 of 64

Preface P.1 Purpose

a. The purpose of this directive is to set forth the procedural requirements for safeguarding individual privacy through the protection of personally identifiable information (PII). PII which is collected, used, maintained, and disseminated by the National Aeronautics and Space Administration (NASA) will be protected regardless of format.

b. This NASA Procedural Requirement (NPR) is based on Federal requirements as listed in Section P.4, Applicable Documents and Forms.

P.2 Applicability

a. This NPR is applicable to NASA Headquarters and NASA Centers, including Component Facilities and Technical and Service Support Centers.

b. For the purposes of this NPR, NASA Headquarters is regarded as a Center. Further, all stipulated Center requirements apply to NASA Headquarters.

c. This directive applies to contractors, recipients of grants, cooperative agreements, or other agreements only to the extent specified or referenced in the contracts, grants, or agreements. This directive is applicable to the Jet Propulsion Laboratory (JPL), a Federally Funded Research and Development Center (FFRDC), only to the extent specified in the NASA/Caltech Prime Contract.

d. This directive applies to PII collected, stored, used, processed, disclosed, or disseminated in any format for use by or on behalf of NASA and includes PII collections that are maintained externally through a contract, outsourced to, or operated by:

(1) Government-owned, contractor operated (GOCO) facilities;

(2) Partners under the National Aeronautics and Space Act; 51 United States Code (U.S.C.) § 20101, et seq;

(3) Partners under the Commercial Space Launch Act, as amended, 51 U.S.C. § 50913;

(4) Partners under cooperative agreements; or

(5) Commercial or university facilities.

e. External collections that are not gathered on behalf of NASA or are merely incidental to a contract (e.g., PII in a contractor's payroll and personnel management system) are excluded from this NPR and are considered non-NASA data.

f. This NPR does not apply to PII collected or maintained by NASA employees and contractors for personal use (e.g., contact information for family, relatives, and doctors), as allowed under NASA Policy Directive (NPD) 2540.1, Acceptable Use of Government Furnished Information Technology Equipment, Services, and Resources.

g. In this directive, all mandatory actions (i.e., requirements) are denoted by statements containing

NPR 1382.1B -- Preface This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 1382.1B -- Preface Page 6 of 64 the term "shall." The terms "may" or "can" denote discretionary privilege or permission, "should" denotes a good practice and is recommended but not required, "will" denotes expected outcome, and "are/is" denotes descriptive material.

h. In this directive all document citations are assumed to be the latest version unless otherwise noted. Documents cited as authority, applicable, or reference documents may be cited as a different categorization, which characterizes its function in relation to the specific context.

i. In this directive, the citation "Privacy Act of 1974, 5 U.S.C. § 552a" will be referred to as "Privacy Act" throughout.

P.3 Authority

a. National Aeronautics and Space Act, 51 U.S.C., § 20101 et seq.

b. The E-Government Act of 2002, 44 U.S.C. § 3604 et seq.

c. Privacy Act of 1974, 5 U.S.C. § 552a.

d. NASA Policy Directive (NPD) 1382.7, NASA Privacy Policy.

e. NPR 2810.1, Security of Information and Information Systems.

f. National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 Rev.5, Security and Privacy Controls for Information Systems and Organizations.

P.4 Applicable Documents and Forms

a. Creating Advanced Streamlined Electronic Services for Constituents Act of 2019, 5 U.S.C. § 101.

b. Plain Writing Act of 2010, 5 U.S.C. § 301.

c. Children's Online Privacy Protection Act, 15 U.S.C. §§ 6501-6506.

d. Paperwork Reduction Act (PRA), 44 U.S.C. § 3501 et seq.

e. Federal Information Security Modernization Act of 2014, 44 U.S.C. § 3551 et seq.

f. Social Security Number Fraud Prevention Act of 2017, 10 Code of Federal Regulations CFR Part (pt.) 9.301.

g. Privacy Act-NASA Regulations, 14 CFR pt. 1212.

h. Protection of Privacy and Freedom of Information, 48 CFR pt. 24.

i. Office of Management and Budget (OMB) Circular A-130, Managing Information as a Strategic Resource (7/28/2016).

j. OMB Memorandum M-03-22, OMB Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002 (09/30/2003). as amended by OMB Memorandum M-10-22.

k. OMB Memorandum M-07-12, Preparing for and Responding to a Breach of Personally Identifiable Information (01/03/2017).

NPR 1382.1B -- Preface This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 1382.1B -- Preface Page 7 of 64

l. OMB Memorandum M-10-22, Guidance for Online Use of Web Measurement and Customization Technologies (06/25/ 2010).

m. OMB Memorandum M-10-23, Guidance for Agency Use of Third-Party Websites and Applications (06/25/2010).

n. NASA FAR Supplement 1824.1, Protection of Individual Privacy (09/2015).

o. NPD 2540.1, Acceptable Use of Government Furnished Information Technology Equipment, Services and Resources.

p. NPR 1600.1, NASA Security Program Procedural Requirements

q. NPR 2810.7, Controlled Unclassified Information.

r. NRRS 1441.1, NASA Records Retention Schedules.

P.5 Measurement/Verification

a. Measurement for this policy is determined by Federal regulatory and NASA privacy requirements.

These measurements are based upon NASA's privacy goals and the objectives outlined by the Senior Agency Official for Privacy (SAOP).

b. The SAOP provides assessments and evaluations that consist of periodic reporting from the Centers and collecting information for the satisfaction of OMB and Federal Information Security Modernization Act of 2014, 44 U.S.C. § 3551 reporting requirements.

c. All entities in P.2 of this policy are subject to privacy compliance reviews and evaluations by

NASA.

P.6 Cancellation NPR 1382.1A, NASA Privacy Procedural Requirements, July 10, 2016.

NPR 1382.1B -- Preface This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 1382.1B -- Preface Page 8 of 64

Chapter 1 Privacy Management

1.1 Overview

1.1.1 NIST's publication of the Privacy Framework: A Tool for Improving Privacy through Enterprise Risk Management and aligns the Privacy Framework with the Cybersecurity Framework.

1.1.2 NASA is committed to protecting personal information of individuals from whom it collects, maintains, uses, and/or disseminates such information.

1.1.3 The NIST Privacy Framework establishes a basic set of activities and outcomes encapsulated in three components: the core, profiles, and implementation tiers.

1.1.3.1 The core is composed of a set of functions, categories, and subcategories which work together to enable a dialogue about managing privacy risk.

a. Functions represent the highest level of categorization for privacy activities. The chapters in this directive align to the functions of the framework, which are:

(1) Identify—Activities and policies to identify information collections containing personal information that NASA collects, processes, stores, and shares. Understanding the scope of the privacy information and who has access helps NASA in managing privacy risk (including artificial intelligence (AI)) for individuals.

(2) Govern—Requirements relating to the development and implementation of NASA governance structures to enable an understanding of NASA's risk management priorities and how the priorities are informed by privacy risk.

(3) Control—Requirements for activities to enable NASA to manage data to address privacy risks.

(4) Communicate—Requirements for activities that enable NASA to engage in dialogue about how data are processed and associated privacy risks.

(5) Protect—Requirements for activities relating to data processing safeguards.

b. Categories represent the subdivision of activities under functions.

c. Subcategories representing specific outcomes of technical and/or management activities.

1.1.3.2 Privacy goals and objectives are identified and governed by NASA's Privacy Program Plan maintained by the Chief Privacy Officer, and published as NAII 1382-001.

1.2 Roles and Responsibilities

1.2.1 This section contains overarching roles and responsibilities related to NASA's entire privacy program. Roles and responsibilities related to specific elements of the privacy program are referenced throughout the remainder of this NPR in their respective chapters.

1.2.1.1 NASA Headquarters, Centers, satellite and component facilities, and support service contractor sites may use internal organizational structure to fulfill the roles and responsibilities

NPR 1382.1B -- Chapter1 This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 1382.1B -- Chapter1 Page 9 of 64 described herein.

1.2.2 Throughout this document, roles and responsibilities are generally listed at the highest level possible, with the assumption that specific tasks and functions may be delegated unless explicitly prohibited, (e.g., a conflict of interest or separation of duties is created).

1.2.2.1 The NASA Administrator or Designee shall:

a. Ensure the protection of PII within NASA's information and information systems.

b. Assign a SAOP, who maintains the Agency's privacy program and its overall objectives and priorities.

1.2.2.2 The NASA Chief information Officer (CIO) shall provide guidance to the SAOP.

1.2.2.3 The SAOP shall:

a. Update NPD 1382.17, NASA Privacy Policy, to ensure NASA is current with changes in Federal privacy policy.

b. Provide overall responsibility and accountability for ensuring NASA's implementation of privacy information protections.

c. Ensure that NASA is compliant with applicable Federal laws, regulations, policies, guidelines, and NASA privacy program requirements.

d. Develop and maintain a NASA-wide privacy program.

e. Develop, maintain, and monitor NASA's privacy goals and objectives.

f. Approve handbooks related to this NPR.

g. Assign a Chief Privacy Officer (CPO), formerly known as the Privacy Program Manager, to oversee the NASA-wide privacy program.

h. Assign a Paperwork Reduction Act ( NASA PRA) Clearance Officer to implement the Office of Personnel Management (OPM) information collection process and ensure OPM information collection requests meet the OMB requirements. Under 44 U.S.C. § 3501, the collection owners work with the NASA PRA Clearance Officer to obtain OMB authorization for the collection.

i. Assign a NASA Privacy Act Officer (PAO) responsible for oversight of NASA's compliance with the Privacy Act of 1974, 5 U.S.C. § 552a.

j. Advise senior NASA officials concerning their responsibilities to protect privacy information.

k. Evaluate legislative, regulatory, and other guidelines and policies related to privacy.

l. Ensure that a Privacy Threshold Analysis (PTA) is conducted for any new, or significantly changed, applications, w websites, information systems (including third party applications and information systems and collections of information provided for by external service providers who are collecting information on behalf of NASA), and all non-electronic information collections to determine whether there are any privacy implications or other regulatory compliance requirements.

Guidance for conducting PTAs is in ITS-HBK-1382.03-01, Privacy- Collections, and PIAs.

m. Ensure documentation indicating whether a Privacy Impact Assessment (PIA) is required, NPR 1382.1B -- Chapter1 This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 1382.1B -- Chapter1 Page 10 of 64 following initial assessments via the PTA process.

1.2.2.4 The Senior Agency Information Security Officer (SAISO) shall provide necessary management and resources in support of the NASA-wide privacy program as established by the

SAOP.

1.2.2.5 The NASA CPO shall:

a. Oversee and manage the development and implementation of policy and procedure, guidance, directives, and requirements for NASA in support of compliance with Federal laws, statutes, and Government-wide policy.

b. Ensure that NASA complies with privacy requirements within Federal statutes listed in this directive, including the collection, maintenance, use, and dissemination of privacy information.

c. Develop and maintain NASA privacy policies, procedural requirements, and handbooks.

d. Review and approve PIAs and ensure that program managers/information system owners have completed privacy-related information.

e. Establish Agency requirements and processes for conducting PTAs and PIAs for new or significantly changed applications, w websites, or information systems, and make PIAs publicly available (unless public release is otherwise prohibited).

f. Oversee and provide guidance in the implementation and the day-to-day operation of the NASA-wide privacy program.

g. Review NASA's compliance with information privacy laws, regulations, and policies annually to validate effectiveness and ensure conformity with current Federal policies and guidance.

1.2.2.6 The NASA Privacy Act Officer shall:

a. Ensure compliance with requirements of the Privacy Act.

b. Oversee, manage, and implement the Privacy Act requirements for NASA.

1.2.2.7 The Center/Executive Director shall support the protection and management of PII at the Center and consult with Agency Privacy Managers (APMs) on matters pertaining to privacy.

1.2.2.8 The Center CIO shall:

a. Ensure that all Center information and information systems comply with the provisions of this

NPR.

b. Support the protection and management of PII at the Center and consult with the APMs on matters pertaining to privacy.

c. Support the APMs in protecting PII and/or Information in Identifiable Form (IIF) at the Center.

d. Ensure that Information Owners (IOs), Information System Owners (ISOs), and Data Owners (DOs) assess the privacy aspects of information collections and information systems for which they are responsible and ensure all required security safeguards are implemented in accordance with current NASA policy and procedural requirements for the collection, use, maintenance, and dissemination of personal information.

NPR 1382.1B -- Chapter1 This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 1382.1B -- Chapter1 Page 11 of 64

1.2.2.9 The APM shall:

a. Serve as the an advisor to Center Director, Center CIO, Center CISO, and Information System Owners (ISOs) on all matters pertaining to privacy.

b. Function as the primary point of contact/liaison to the NASA CPO and NASA PAO.

c. Work with ISOs to review and aid in ensuring compliance with all privacy requirements, as needed.

d. Validate the proper disposition and/or sanitization process for files and records (paper, electronic, or other media formats), which contain privacy information.

e. Ensure the NASA privacy program is implemented in accordance with NASA policy.

f. Ensure that IOs, ISOs, and DOs perform the required information collection assessments (i.e., PTAs and PIAs) and aid in the development of any additional documentation indicated as required upon completion of the PTA (or PIA if required). (This includes SORNs, Federal Register notices, Paperwork Reduction Act approvals, and Privacy Act Statements.)

g. Serve as liaisons regarding Controlled Unclassified Information (CUI).

1.2.2.10 Contracting Officers (COs) or Agreement Managers shall ensure that the requirements of this directive are included and in scope for all NASA contracts, agreements under 51 U.S.C. § 20101, cooperative agreements, partnership agreements, or other agreements pursuant to which privacy information (e.g., PII, PHI, PAI) is being collected, processed, stored, or transmitted.

1.2.2.11 The ISO shall:

a. Acquire, develop, integrate, operate, modify, maintain, and dispose of information systems containing PII in a manner consistent with Federal statutes, regulation, and NASA privacy policies.

b. Ensure compliance with the Privacy Act for applications and information systems.

c. Verify with the CO/Contracting Officer Representative (COR) that any contract that requires a System of Records (SOR) on behalf of NASA includes the clauses required per Protection of Privacy and Freedom of Information, 48 CFR pt. 24.

d. Notify the CO when purchase requests include services covered by 44 U.S.C. § 3501 et seq.

e. Notify the CO when contractor services will require or include access to PII collected by or on behalf of NASA.

f. Verify that the contract statement of work identifies this NPR as outlining the NASA-specific requirements to be followed by the contractor.

1.2.2.12 The NASA Users shall:

a. Comply with all Federal laws, statutes, and NASA privacy policies and procedures in this and the referenced documents.

b. Protect all PII in the user's custody (whether virtual, electronic, actual, or otherwise) from unauthorized disclosure, use, modification, or destruction so that the confidentiality, integrity, and availability of the information are preserved.

NPR 1382.1B -- Chapter1 This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 1382.1B -- Chapter1 Page 12 of 64

NPR 1382.1B -- Chapter1 This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 1382.1B -- Chapter1 Page 13 of 64

Chapter 2 Identify

2.1 Overview

2.1.1 The Identify chapter ensures NASA's compliance with NIST requirements for the inventory and assessment of PII.

2.1.2 NASA is responsible for assessing the PII it collects and notifying individuals of what information is collected, why it is being collected, and how the information will be used.

2.1.3 In accordance with the Privacy Act, The E-Government Act of 2002, 44 U.S.C. § 3604, and OMB requirements, NASA uses compliance documentation such as PTAs, PIAs, and System of Records Notices (SORNs), which are discussed in Chapter 5. These tools assist NASA in identifying and reducing the privacy risks related to NASA's activities, notifying the public of privacy impacts, and determining which steps to take to mitigate potential impacts to personal privacy.

2.1.4 All NASA applications, information systems, and websites are to be reviewed via the PTA process to determine whether they require a PIA.

2.1.5 NASA Privacy Risk Management and Compliance procedures are governed by

ITS-HBK-1382.03-01.

2.2 Inventory

2.2.1 Overview

2.2.1.1 Inventories are essential to NASA's understanding management of privacy risk.

2.2.1.2 A thorough understanding of the scope of NASA's collection of PII provides visibility into scope of privacy information.

2.2.2 Procedural Requirements

2.2.2.1 The SAOP shall establish and maintain the NASA Master Privacy Information Inventory

(MPII).

2.2.2.2 The APM shall ensure the MPII established per section 2.2.2.1 accurately reflects all electronic and non-electronic collections of information and is current.

2.3 Privacy Threshold Analyses (PTA) and Privacy Impact

Assessments (PIA)

2.3.1 Overview

2.3.1.1 PTAs and PIAs are part of a formal process that NASA uses to analyze how information is processed by an information system, application, or website to ensure that NASA's handling conforms to applicable statutory, regulatory, and policy requirements for privacy information identified in this directive.

NPR 1382.1B -- Chapter2 This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 1382.1B -- Chapter2 Page 14 of 64

2.3.1.2 The PIA documents the risks and effects of collecting, maintaining, and disseminating IIF on members of the public (generally). NASA conducts PIAs in accordance with .OMB M-03-22, Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002 (09/30/2003) as amended.

2.3.1.3 A PIA describes:

a. The information to be collected.

b. The purpose of the collection (why it is collected).

c. The intended use collection.

d. With whom the information will be shared.

e. Whether the information was collected with the consent of the owner (or the owner's parent or guardian, if needed, in accordance with Children's Online Privacy Protection Act, 15 U.S.C. §§ 6501-6506.

f. How the information will be secured.

g. Whether a SOR is created under the Privacy Act.

2.3.1.4 In addition, the PIA examines and documents the evaluation of protections and alternative processes for handling information to mitigate potential privacy risks.

b. For a new collection of ten or more members of the public in accordance with 44 U.S.C. § 3501.

2.3.1.5 Unless otherwise prohibited, NASA is responsible for posting the PIA publicly.

2.3.1.6 NIST SP 800-53 PL-5, Information Security Controls, is governed at NASA by ITS-HBK-2810.03, Planning, and ITS-HBK-1382.03-01.

2.3.1.7 Information on how to conduct a PTA and PIA: review, approval, publication requirements, and the relationship to 44 U.S.C. § 3501 and the Privacy Act are governed by ITS-HBK-1382.03-01.

2.3.2 Procedural Requirements

2.3.2.1 The SAOP shall:

a. Establish Agency policy, requirements, and process for conducting PTAs and/or PIAs for new or revised applications and information systems to limit the identification of individuals.

b. Assess the impact of technology on privacy and the protection of personal information.

c. Evaluate and approve or disapprove all completed PIAs.

d. Ensure that data is disposed of at the Agency level according to NRRS 1441.1, NASA Records Retention Schedules and NPR 2810.7, Controlled Unclassified Information.

2.3.2.2 The NASA CPO shall:

a. Implement Agency policy, requirements, and processes for conducting PTAs and PIAs for new or revised applications and information systems.

b. Ensure PIAs are thorough and meet all applicable standards.

NPR 1382.1B -- Chapter2 This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 1382.1B -- Chapter2 Page 15 of 64

c. Ensure that completed PIAs are made publicly available for applications and information systems, including websites, which collect and/or maintain IIF on members of the public, consistent with Federal policy, unless otherwise prohibited.

2.3.2.3 The APMs shall:

a. Assist ISOs in the completion of PTAs and, when needed, PIAs.

b. Conduct timely review of PTAs and PIAs on information collection to ensure the ISO has addressed adequately the protection of information covered by the Privacy Act.

c. Ensure the ISOs update PTAs and, when needed, PIAs.

d. Conduct annual PIA reviews.

e. Ensure procedures exists to dispose of data at the Center level according to NRRS 1441.1, NPR 2810.1, and NPR 2810.7.

2.3.2.4 The ISO shall:

a. Ensure that a PTA is conducted and approved for the information collections under the ISO's purview.

b. Ensure that a PIA is reviewed and approved for:

(1) An information system that collects, maintains, or disseminates IIF from or about members of the public; or

(2) An electronic collection of IIF for ten or more individuals, consistent with 44 U.S.C. § 3501.

c. Ensure that they conduct a re-evaluation of PTAs and, when needed, PIAs following significant modifications to all applications and information systems, including websites.

d. Ensure that a PIA is conducted prior to use of a third-party website or application that collects PII.

e. Review completed PTAs and PIAs annually to ensure ongoing accuracy.

NPR 1382.1B -- Chapter2 This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 1382.1B -- Chapter2 Page 16 of 64

Chapter 3 Govern

3.1 Overview

The Govern chapter describes NASA's governance structures to understand, manage, and prioritize privacy risk.

3.2 Awareness and Training

3.2.1 Overview

3.2.1.1 The Privacy Awareness and Training section relates to NASA's initiatives to ensure that all NASA Users are aware of and trained on their roles and responsibilities related to PII.

3.2.1.2 Several OMB documents outline the privacy training requirements, including OMB Circular A-130, Managing Information as a Strategic Resource, OMB Memorandum M-05-08, Designation of Senior Agency Officials for Privacy (02/11/2005), and OMB Memorandum M-07-12, Preparing for and Responding to a Breach of Personally Identifiable Information (01/03/2017). Specifically, OMB M-07-12 provides guidance to prepare and respond to breach of PII. It also allows for agencies to streamline breach responses specific to the occurrences and damage caused as a result. To meet the guidance from OMB M-17-12 and its requirement for a tabletop exercise, NASA requires core BRT members to participate in an Incident Response Assessment (IRA) annually if a tabletop exercise or actual breach response activity is not conducted.

3.2.1.3 NASA Privacy Training and Awareness procedures are governed by ITS-HBK-2810.06, Cybersecurity and Privacy Awareness Training and Education.

3.2.2 Procedural Requirements

3.2.2.1 The SAOP shall:

a. Ensure NASA users complete training and education on their privacy responsibilities, including acceptable rules of behavior, when and how to report privacy related incidents, and consequences for violating this NPR.

b. Oversee the mandatory annual privacy training program.

c. Oversee a privacy awareness program.

3.2.2.2 The CPO shall:

a. Review and approve all privacy awareness and training materials.

b. Develop privacy awareness and training materials.

c. Work with the Information Technology Security Awareness and Training Center (ITSATC) to ensure privacy awareness and training materials meet information security training requirements.

d. Ensure the privacy training:

NPR 1382.1B -- Chapter3 incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 1382.1B -- Chapter3 Page 17 of 64

(1) For the NASA user explains the policies and procedures for safeguarding PII collected and maintained at NASA.

(2) For the NASA user explains the privacy rules of behavior and consequences.

(3) For the NASA user with access to NASA data, explains that willful disclosure of information to individuals not entitled to Privacy Act records or sensitive privacy information in any form is strictly prohibited.

(4) For persons involved in the design, development, operation, or maintenance of any Privacy Act SOR, or in the maintenance of any record within any SOR, explains the requirements regarding the protection, use, and release of the Privacy Act records.

(5) For persons involved in the design, development, operation, or maintenance of any PII collection, explains the requirements regarding the protection, use, and release of the records.

e. Determine the annual training requirements for APMs.

3.2.2.3 The APM shall complete privacy role-based training, per NASA Spec 2661.ODVr5.

3.2.2.4 The ISO shall:

a. Ensure that all NASA users who have access to PII or who develop or supervise procedures for handling PII are trained and are compliant with policies and procedures in NPD 1382.17, this directive, and referenced documents for safeguarding PII collected and maintained at or on behalf of

NASA.

b. Ensure that persons involved in the design, development, operation, or maintenance of any Privacy Act SOR, or in the maintenance of any record in any SOR, are trained in the requirements regarding the protection, use, and release of the Privacy Act records.

c. Ensure that persons involved in the design, development, operation, or maintenance of any PII collection are trained in the requirements regarding the protection, use, and release of the records.

3.2.2.5 The NASA User shall participate in mandatory Cybersecurity and Privacy Awareness Training prior to gaining access to NASA information and information systems, and yearly thereafter.

3.2.2.6 The designated core BRT members shall participate an annually in actual BRT, a tabletop exercise, or an IRA conducted by the CSPD.

3.3 Privacy Accountability

3.3.1 Overview

3.3.1.1 The Privacy Accountability section relates to NASA's initiatives to ensure accountability as related to compliance with applicable privacy protection requirements.

3.3.1.2 This section includes requirements that ensure NASA's compliance with established privacy controls and includes internal reporting requirements and external reporting requirements.

3.3.1.3 NASA Privacy Accountability procedures are governed by the privacy laws, regulations, and NASA's policies and procedures on Privacy Accountability.

NPR 1382.1B -- Chapter3 This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 1382.1B -- Chapter3 Page 18 of 64

3.3.2 Internal Reporting Procedural Requirements.

3.3.2.1 Overview

a. Internal reporting requirements exist within NASA to internally track compliance with privacy laws, regulations, and NASA's policies and procedures.

b. Internal reporting requirements include metrics, data calls, and status reports.

c. The results of internal reporting requirements are used to create metrics that allow the SAOP and the NASA CPO to evaluate the goals and objectives of the NASA privacy program.

3.3.2.2 The SAOP shall update NASA senior management on the status of Agency performance in meeting privacy goals and objectives.

3.3.2.3 The NASA CPO shall update the SAOP on privacy metrics annually as part of the 44 U.S.C.

§ 3551 reporting process.

3.3.2.4 The APM shall:

a. Respond to various privacy related mandates and requests for information from the NASA CPO and NASA PAO.

b. Report any Privacy (PII) or the Privacy Act violations to the CPO.

c. Track planned, in progress, and completed corrective actions taken to remedy deficiencies identified in compliance reviews.

d. Ensure the NASA MPII is up to date and accurately reflects all electronic and non-electronic collections of information.

e. Report all significant privacy related activities (e.g., BRT activities and privacy complaints) to the

CPO.

3.3.2.5 The ISO shall:

a. Report TO APMS on the status of compliance with NASA Privacy requirements through the PTA and PIA processes accomplished in RISCS.

b. Control disclosures from their SOR and maintain accountings of all disclosures of information in accordance with Privacy Act NASA Regulations, 14 CFR pt. 1212.

3.3.2.6 The NASA User shall report any suspected or confirmed unauthorized disclosures of PII in any form to the Security Operations Center (SOC) in accordance with Agency IT security incident reporting procedures.

3.3.3 External Reporting Procedural Requirements.

3.3.3.1 Overview

NASA has a number of external reporting requirements, including those required by OMB, Department of Homeland Security (DHS), 44 U.S.C. § 3551, Office of the Inspector General (OIG), Government Accountability Office (GAO), and Congressional inquiries. For example, NASA is required to report annually to OMB or DHS under 44 U.S.C. § 3551 on privacy-related issues, including metrics on PIAs and SORNs.

NPR 1382.1B -- Chapter3 This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 1382.1B -- Chapter3 Page 19 of 64

3.3.3.2 The SAOP shall:

a. Ensure external reporting requirements are met.

b. Respond to external reporting requirements.

c. Approve NASA's privacy reports required by OMB and 44 U.S.C. § 3551.

d. Develop and maintain a privacy reviews schedule.

e. Ensure that reviews are conducted in accordance with the Privacy Act and OMB Circular A-130.

Table 1. Mandated Reviews Overview and Frequency Type of Review Frequency Brief Description Year

Required Matching Programs Annually Review each matching program in which the Agency has participated. Where possible, reduce the amount or type of PII collected to the bare minimum necessary.

Annually

Review and Reduce PII Annually Review all personally identifiable information (PII) holdings

Annually

Privacy Impact Assessments

Annually Review the number of completed Privacy Impact Assessments (PIAs) to number of posted PIA summaries.

Annually

Website Privacy Compliance

Annually Review NASA websites to ensure that they have posted links to the NASA privacy page

Annually

Contract Every 2 years Review random sample of Agency contracts that provide for the maintenance of a System of Record (SOR) on behalf of

NASA

Every 2 years

Recordkeeping Practices Every 2 years Review System of Records Notice (SORN) disposal policies and practices, including the maintenance of automated records.

Every 2 years

Privacy Act Training Every 2 years Review training practices to ensure that all Agency personnel are familiar with Privacy Act requirements.

Every 2 years

Violations Every 2 years Review actions of Agency personnel that have resulted in the Agency or the employee being found liable or guilty.

Every 2 years

System of Record Notices Every 2 years Review each SORN for accuracy and appropriateness.

Every 2 years

Routine Use of Disclosures Every 4 years Review the disclosure practice associated with each SOR.

Every 4 years

NPR 1382.1B -- Chapter3 This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 1382.1B -- Chapter3 Page 20 of 64

Exemption of System of Records

Every 4 years Review each SOR for which the Agency has identified exemption rules.

Every 4 years

3.3.3.3 The CPO shall:

a. Produce and provide NASA's privacy reports required by OMB and 44 U.S.C. § 3551 to the NASA SAISO and the NASA SAOP.

b. Ensure privacy reviews are occur within the time frame set out in Table.1.

3.3.3.4 The NASA PAO shall coordinate and conduct the review directed by the Privacy Act and OMB Circular A-130 in accordance with designated timelines.

3.3.3.5 The APMs shall:

a. Coordinate privacy reporting data collection efforts for the Agency report to the NASA CPO.

b. Coordinate the Privacy Act reviews as directed by the NASA PAO.

3.4 Privacy Complaints

3.4.1 Overview

3.4.1.1 NASA is required by OMB to provide a mechanism for receiving and managing complaints from the public and from NASA users.

3.4.1.2 Specific information on the privacy complaints process is governed by ITS-HBK-1382.06-01, Web Privacy Notice and Redress—Web Privacy and Written Notice, Complaints, Access, and Redress.

3.4.2 Procedural Requirements

3.4.2.1 The SAOP shall:

a. Ensure policies and processes for filing and managing privacy complaints and inquiries are developed and maintained.

b. Ensure that complaints are recorded, tracked, and addressed.

3.4.2.2 The NASA CPO shall work with the SAOP to record, track, and address privacy complaints.

3.4.2.3 The APMs shall:

a. Receive and seek to address privacy complaints.

b. Report privacy complaints to the NASA CPO via the process defined in ITS-HBK-1382.06-01.

3.4.2.4 The ISO shall:

a. Receive and seek to address privacy complaints associated with the application, information system, or website.

b. Report application, information system, or website privacy complaints to the APM.

NPR 1382.1B -- Chapter3 This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 1382.1B -- Chapter3 Page 21 of 64

3.5 Privacy Consequences

3.5.1 Overview

3.5.1.1 NASA can impose penalties on a NASA user who violates this NPR for privacy related violations. Consequences may range from reprimand to suspension or removal. Specifically, the consequences for violating the privacy-related provisions of this NPR are defined in the Privacy Act, 44 U.S.C. § 3604, and the NAII 2540.1, NASA's Cybersecurity and Privacy Rules of Behavior.

3.5.1.2 Consequences for privacy-related violations are governed by NAII 2540.1.

3.5.2 Procedural Requirements

3.5.2.1 The SAOP shall outline the consequences and penalty guidelines related to privacy violations.

3.5.2.2 The CPO shall:

a. Advises the SAOP on consequences for violating this NPR.

b. Advises the APMs on consequences for violating this NPR.

c. Establish requirements and procedures for reporting known, suspected, or likely violations of the privacy requirements of this NPR.

3.5.2.3 APMs provide support to the CPO to ensure adherence to the requirements of this NPR at the Center level.

3.5.2.4 The ISO shall:

a. Meet publication requirements for Privacy Act SOR. Any official who willfully maintains a Privacy Act SOR without meeting the publication requirements is subject to possible criminal penalties or administrative sanctions, or both.

b. Be held accountable for privacy violations of this NPR. Penalties range from criminal to administrative.

3.5.2.5 The NASA User shall be held accountable for violations of this NPR and related handbooks.

Penalties may include reprimand, suspension, removal, or other administrative action, fines, additional privacy training, or other actions in accordance with applicable laws and Agency disciplinary policy.

3.5.2.6 NASA Users may:

a. Be subject to written reprimand, suspension, removal, or other administrative action under the following situations:

(1) Knowingly failing to implement and maintain information security controls required by this NPR for the protection of PII regardless of whether such action results in the loss of control or unauthorized disclosure of PII.

(2) Failing to report any known or suspected loss of control or unauthorized disclosure of PII.

(3) For managers, failing to adequately instruct, train, or supervise employees in their privacy

NPR 1382.1B -- Chapter3 incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 1382.1B -- Chapter3 Page 22 of 64 responsibilities.

b. Be subject to criminal penalties for willful and intentional violations of the Privacy Act.

3.6 Privacy Redress and Privacy Act Information Requests

3.6.1 Overview

3.6.1.1 NASA provides a mechanism for redress and remedy from misuse or mishandling of PII and for correcting inaccuracies. Specifically, NASA provides the public and the NASA user with the opportunity to amend or correct their PII.

3.6.1.2 The redress process is governed by ITS-HBK-1382.06-01.

3.6.1.3 Additionally, NASA responds request for information maintained in a system of records in accordance with 14 CFR pt. 1212.

3.6.2 Procedural Requirements

3.6.2.1 The SAOP shall:

a. Ensure policies and procedures for redressing misuse or mishandling of PII and for correcting inaccuracies are maintained. The SAOP will ensure that the policies follow these guidelines:

(1) Comply with the Plain Writing Act of 2010, 5. U.S.C. § 301, be in plain language and easy to read and understand.

(2) Explain the right of redress.

(3) Explain the process for complaining, seeking redress, and/or appealing adverse decisions.

(4) Provide a general timeline for the redress process.

(5) Identify the privacy policy related to PII being collected, processed, or maintained.

b. Permit individual access to the Privacy Act SOR in order to amend those Privacy Act records, as permitted in accordance with 14 CFR pt. 1212.

c. In accordance with the Creating Advanced Streamlined Electronic Services for Constituents Act of 2019, 5 U.S.C. § 101:

(1) Ensure the ability for NASA to accept remote identity-proofing and authentication for the purposes of allowing an individual to request access to their records or to provide prior written consent authorizing disclosure of their records under the Privacy Act.

(2) Ensure the ability for NASA to accept the access and consent forms from any individual properly identity-proofed and authenticated remotely through digital channels for the purpose of individual access to records for authorizing disclosure of the individual's records to another person or entity, including a congressional office.

3.6.2.2 The NASA CPO shall assist the SAOP in redressing PII issues.

3.6.2.3 The PAO shall provide a Privacy Act record access request process for individuals seeking access to their individual NASA maintained record in 14 CFR pt. 1212.

NPR 1382.1B -- Chapter3 This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 1382.1B -- Chapter3 Page 23 of 64

3.6.2.4 APMs shall forward any Privacy Act record access requests received to the relevant System Manager for processing in accordance with 14 CFR pt. 1212.

3.6.2.5 The System Manager (the ISO or IO) shall process Privacy Act record access requests from an…