DHA DD2930 Fillable Template.pdf

Please wait...

If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.

You can upgrade to the latest version of Adobe Reader for Windows®, Mac, or Linux® by visiting http://www.adobe.com/go/reader_download.

For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader.

Windows is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries. Mac is a trademark of Apple Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

DRAFT

SAMPLE

PREVIOUS EDITION IS OBSOLETE.

Page of AEM Designer

DD FORM 2930, JUN 2017

PRIVACY IMPACT ASSESSMENT (PIA)

PRIVACY IMPACT ASSESSMENT

PRESCRIBING AUTHORITY: DoD Instruction 5400.16, "DoD Privacy Impact Assessment (PIA) Guidance". Complete this form for Department of Defense (DoD) information systems or electronic collections of information (referred to as an "electronic collection" for the purpose of this form) that collect, maintain, use, and/or disseminate personally identifiable information (PII) about members of the public, Federal employees, contractors, or foreign nationals employed at U.S. military facilities internationally. In the case where no PII is collected, the PIA will serve as a conclusive determination that privacy requirements do not apply to system.

PRESCRIBING AUTHORITY: DoDI 5400.16

SECTION 1: PII DESCRIPTION SUMMARY (FOR PUBLIC RELEASE)

SECTION 1: PII DESCRIPTION SUMMARY (FOR PUBLIC RELEASE)

a. The PII is: (Check one. Note: foreign nationals are included in general public.)

b. The PII is in a: (Check one)

e. Do individuals have the opportunity to object to the collection of their PII?

e. Do individuals have the opportunity to object to the collection of their PII?

(1) If "Yes," describe the method by which individuals can object to the collection of PII.

(1) If "Yes," describe method by which individuals can object to the collection of PII.

(2) If "No," state the reason why individuals cannot object to the collection of PII.

(2) If "No," state the reason why individuals cannot object to the collection of PII.

f. Do individuals have the opportunity to consent to the specific uses of their PII?

f. Do individuals have the opportunity to consent to the specific uses of their PII?

(1) If "Yes," describe the method by which individuals can give or withhold their consent.

(1) If "Yes," describe the method by which individuals can give or withhold their consent.

(2) If "No," state the reason why individuals cannot give or withhold their consent.

(2) If "No," state the reason why individuals cannot give or withhold their consent.

g. When an individual is asked to provide PII, a Privacy Act Statement (PAS) and/or a Privacy Advisory must be provided. (Check as appropriate and provide the actual wording.)

g. When an individual is asked to provide PII, a Privacy Act Statement (PAS) or a Privacy Advisory must be provided. (Check as appropriate and provide the actual wording.)

h. With whom will the PII be shared through data exchange, both within your DoD Component and outside your Component? (Check all that apply)

h. With whom will the PII be shared through data exchange, both within your DoD Component and outside your Component? (e.g., other DoD Components, Federal Agencies)? (Check all that apply)

i. Source of the PII collected is: (Check all that apply and list all information systems if applicable)

i. Source of the PII collected is: (Check all that apply and list all information systems if applicable)

j. How will the information be collected? (Check all that apply and list all Official Form Numbers if applicable)

j. How will the information be collected? (Check all that apply and list all Official Form numbers if applicable)

k. Does this DoD Information system or electronic collection require a Privacy Act System of Records Notice (SORN)?

A Privacy Act SORN is required if the information system or electronic collection contains information about U.S. citizens or lawful permanent U.S. residents that is retrieved by name or other unique identifier. PIA and Privacy Act SORN information must be consistent.

If "Yes," enter SORN System Identifier SORN Identifier, not the Federal Register (FR) Citation. Consult the DoD Component Privacy Office for additional information or http://dpcld.defense.gov/ Privacy/SORNs/ or SORN Identifier, not the Federal Register (FR) Citation.Consult the DoD Component Privacy Office for additional information or http://dpcld.defense.gov/ Privacy/SORNs/ If a SORN has not yet been published in the Federal Register, enter date of submission for approval to Defense Privacy, Civil Liberties, and Transparency Division (DPCLTD). Consult the DoD Component Privacy Office for this date

l. What is the National Archives and Records Administration (NARA) approved, pending or general records schedule (GRS) disposition authority for the system or for the records maintained in the system?

l. What is the National Archives and Records Administration (NARA) approved, pending or general records schedule (GRS) disposition authority for the system or for the records maintained in the system?

(1) NARA Job Number or General Records Schedule Authority.

(2) If pending, provide the date the SF-115 was submitted to NARA.

n. Does this DoD information system or electronic collection have an active and approved Office of Management and Budget (OMB) Control Number?

Contact the Component Information Management Control Officer or DoD Clearance Officer for this information. This number indicates OMB approval to collect data from 10 or more members of the public in a 12-month period regardless of form or format.

n. Does this DoD information system or electronic collection have an active and approved OMB Control Number?

SECTION 2: PII RISK REVIEW

SECTION 2: PII RISK REVIEW

a. What PII will be collected (a data element alone or in combination that can uniquely identify an individual)? (Check all that apply)

a. What PII will be collected (a data element alone or in combination that can uniquely identify an individual)? (Check all applicable) If the SSN is collected, complete the following questions.

(DoD Instruction 1000.30 states that all DoD personnel shall reduce or eliminate the use of SSNs wherever possible. SSNs shall not be used in spreadsheets, hard copy lists, electronic reports, or collected in surveys unless they meet one or more of the acceptable use criteria.)

(1) Is there a current (dated within two (2) years) DPCLTD approved SSN Justification on Memo in place?

If the SSN is collected, complete the following questions.

(4) Has a plan to eliminate the use of the SSN or mitigate its use and or visibility been identified in the approved SSN Justification request?

If "Yes," provide the unique identifier and when can it be eliminated?

If "No," explain.

(4) Has a plan to eliminate the use of the SSN or mitigate its use and or visibility been identified in the approved SSN Justification request?

b. What is the PII confidentiality impact level2?

b. What is the PII confidentiality impact level2?

c. How will the PII be secured?

c. How will the PII be secured?

(1) Physical Controls. (Check all that apply)

(1) Physical controls. (Check all that apply)

(2) Administrative Controls. (Check all that apply)

(2) Administrative Controls. (Check all that apply)

(3) Technical Controls. (Check all that apply)

(3) Technical Controls. (Check all that apply)

SECTION 3: RELATED COMPLIANCE INFORMATION

SECTION 3: RELATED COMPLIANCE INFORMATION

a. Is this DoD Information System registered in the DoD IT Portfolio Repository (DITPR) or the DoD Secret Internet Protocol Router Network (SIPRNET) Information Technology (IT) Registry or Risk Management Framework (RMF) tool3?

a. Is this DoD Information System (IS) registered in the DITPR or the DoD Secret Internet Protocol Router Network (SIPRNET) Information Technology (IT) Registry or Risk Management Framework (RMF) tool3?

b. DoD information systems require assessment and authorization under the DoD Instruction 8510.01, “Risk Management Framework for DoD Information Technology”.

Indicate the assessment and authorization status:

b. DoD information systems require assessment and authorization under the DoD Instruction 8510.01, “Risk Management Framework for DoD Information Technology”.

c. Does this DoD information system have an IT investment Unique Investment Identifier (UII), required by Office of Management and Budget (OMB) Circular A-11?

c. Does this DoD information system have an IT investment Unique Investment identifier (UII), required by Office of Management and Budget (OMB) Circular A-11?

If "Yes," Enter UII If unsure, consult the component IT Budget Point of Contact to obtain the UII 3Guidance on Risk Management Framework (RMF) tools (i.g., eMASS, Xacta, and RSA Archer) are found on the Knowledge Service (KS) at https://rmfks.osd.mil.

3Guidance on Risk Management Framework (RMF) tools (i.g., eMASS, Xacta, and RSA Archer) are found on the Knowledge Service (KS) at https://rmfks.osd.mil.

SECTION 4: REVIEW AND APPROVAL SIGNATURES

Completion of the PIA requires coordination by the program manager or designee through the information system security manager and privacy representative at the local level. Mandatory coordinators are: Component CIO, Senior Component Official for Privacy, Component Senior Information Security Officer, and Component Records Officer.

SECTION 4: REVIEW AND APPROVAL SIGNATURES

Publishing: Only Section 1 of this PIA will be published. Each DoD Component will maintain a central repository of PIAs on the Component's public Web site.

DoD Components will submit an electronic copy of each approved PIA to the DoD CIO at: osd.mc-alex.dod-cio.mbx.pia@mail.mill.

If the PIA document contains information that would reveal sensitive information or raise security concerns, the DoD Component may restrict the publication of the assessment to include Section 1.

Publishing 9.0.0.2.20120627.2.874785 DD 2930, Privacy Impact Assessment (PIA), Jun 2017 US Army Futures Command (DHP CSI Funded System) Not Collected (if checked proceed to Section 4) No

discretion) :