Please refer to of DOE Cyber your organization’s implementation Security Directives and Senior DOE Management Program Cyber Security Plans (PCSP). For example: "The System Owner has What controls are in place to implemented and tested all baseline security controls appropriate to its protect the data from FIPS categorization in accordance with the Senior DOE Management unauthorized access, PCSP and DOE Directives. The system was certified and accredited modification or use? (provide date(s)) and found to have mitigated risk to an acceptable level." List Roles Only of individuals who will have access to the PII data. Who will have access to PII Point to current access control list(s) (with version), but Please Do Not data? List Names Here. For example, will users have access to all data on the information How is access to PII data system or will the access be restricted? user’s determined? Do other information systems Many information systems interconnect and share data. Please share data or have access to identify all systems that connect to and access information on this the data in the system? If yes, system. explain. For connecting information systems, is there an Interconnection Security Agreements (ISA) outline the responsibilities Interconnection Security and expectations associated with system interconnection. ISAs specify Agreement (ISA) or other security requirements and controls necessary for interconnection and agreement between System compliance. Owners to ensure the privacy of individuals is protected? List Roles Only of individuals who are responsible for ensuring the Who is responsible for authorized use of personal information. Point to current access control ensuring the authorized use list(s) (with version), but Please Do Not List Names Here. of personal information? END OF MODULE II SIGNATURE PAGE
What controls are in place to protect the data from unauthorized access, modification or use? Please refer to your organization’s implementation of DOE Cyber Security Directives and Senior DOE Management Program Cyber Security Plans (PCSP). For example: "The System Owner has implemented and tested all baseline security controls appropriate to its FIPS categorization in accordance with the Senior DOE Management PCSP and DOE Directives. The system was certified and accredited (provide date(s)) and found to have mitigated risk to an acceptable level." Who will have access to PII data? List Roles Only of individuals who will have access to the PII data. Point to current access control list(s) (with version), but Please Do Not List Names Here. How is access to PII data determined? For example, will users have access to all data on the information system or will the user’s access be restricted? Do other information systems share data or have access to the data in the system? If yes, explain. Many information systems interconnect and share data. Please identify all systems that connect to and access information on this system. For connecting information systems, is there an Interconnection Security Agreement (ISA) or other agreement between System Owners to ensure the privacy of individuals is protected? Interconnection Security Agreements (ISA) outline the responsibilities and expectations associated with system interconnection. ISAs specify security requirements and controls necessary for interconnection and compliance. Who is responsible for ensuring the authorized use of personal information? List Roles Only of individuals who are responsible for ensuring the authorized use of personal information. Point to current access control list(s) (with version), but Please Do Not List Names Here. END OF MODULE II SIGNATURE PAGE
PIA%20Template%20June%202014%20%28Final%29_1.docx